Privacy policy

About this policy

This policy covers Flashcade at flashcade.app. References to data protection rights include the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU and UK General Data Protection Regulation (GDPR).

What we collect

• Account: when you sign in, our sign-in provider Clerk gives us your account ID, display name, profile picture and email address. We use your email only to run your account and, if needed, to contact you about it.
• Study material: the files, photos, links and instructions you add to a project, and the flashcards made from them. Our generation workflow removes uploaded files and intermediate text when it finishes, including after a failed generation. We store flashcards, project details, source names and source URLs separately.
• Learning and game data: which cards you got right or wrong, scores, coins, avatar items, daily streaks (including your time zone), games you played and for how long, feedback and game suggestions you send us. Signed-in sessions and feedback can be linked to your account.
• Typed answers: when a game needs to check whether a typed answer means the same as the card, we send the question, the expected answer and what you typed to an AI model.
• Subscriptions: if you buy Flashcade Plus, Stripe handles the payment. We receive and store a customer ID, the plan, its status and when the paid period ends. We never see or store your card details.
• Technical data: our hosting provider Cloudflare processes request information such as your IP address, browser information and requested URLs to deliver the site, troubleshoot errors and keep it secure.

If you play without signing in, your learning progress stays in your browser. We also record game sessions, scores, answer counts, timing and any feedback you submit. Guest sessions are not linked to a signed-in account, but can include the project you played and the text you submit as feedback.

What other people can see

• Your display name, profile picture and avatar appear on leaderboards and "playing now" lists of projects you study, and to other players in multiplayer games.
• If you share a project, anyone with the link can see and study its flashcards. Only share material you are allowed to share.

Why we use it (legal bases)

• To provide the service you asked for: your account, making flashcards, saving progress, games, multiplayer and Plus (performance of a contract, GDPR art. 6(1)(b)).
• To keep Flashcade secure, find bugs and decide which games to improve, using game statistics and feedback (legitimate interest, art. 6(1)(f)).
• To keep payment and tax records (legal obligation, art. 6(1)(c)).

We do not sell your personal data or use it for advertising. Flashcade does not train its own AI models on your study material. AI providers handle requests under their own policies and the applicable account settings; this policy does not promise zero retention or no training by every provider.

Services we share data with

We use these services to run Flashcade. Some providers also process data for their own security, legal and account-management purposes:

• Cloudflare, Inc. (USA): hosting, database, file storage, document reading and request logs.
• Clerk, Inc. (USA): sign-in and account management.
• Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA): payments for Plus. Stripe is also an independent controller for payment and fraud-prevention data; see stripe.com/privacy.
• OpenRouter (USA) and the AI providers handling each request: extracted study material, source labels, links and your instructions to write flashcards; questions, expected answers and typed answers to check them. Configured models currently include an OpenAI model for generation and a Baseten model for answer checking. Routing and providers can change. We do not add your account name or email to these requests, but personal information included in your material or answers is sent with them.

When you add a link, we send its URL to the AI Context Scraper service hosted on Cloudflare to fetch the page or obtain a transcript. The destination website and services involved in fetching or transcription may receive the URL and relevant content. Do not submit private links, access tokens or sensitive information in URLs.

International transfers

Using these services can involve processing outside Switzerland, including in the USA and Ireland. Provider infrastructure and AI routing may involve other countries. Where applicable law requires safeguards for a transfer, these must include a recognised adequacy decision, a relevant Data Privacy Framework certification, or standard contractual clauses with any required Swiss or UK additions. The safeguards depend on the provider and destination.

How long we keep it

• Uploaded files and intermediate text: removed by the cleanup step when generation finishes or fails. Interrupted jobs or cleanup failures can delay removal. Provider logs, workflow history and backups have separate retention rules.
• Active projects and progress: kept to provide your library and learning history. Deleting a project you own removes its cards and progress and disables shared links; some project metadata, source details and game records remain in the database.
• Account, wallet, game records, feedback and suggestions: kept while needed to provide the service and its history, investigate abuse, resolve disputes or meet legal obligations. Account erasure requires a separate request; removing a Clerk sign-in account alone does not automatically erase all Flashcade database records.
• Payment records: retained as required for accounting, tax and disputes. Stripe applies its own retention obligations.
• Technical logs and provider records: retained according to the configured service settings and provider policies; no single retention period applies to all services.

Cookies and browser storage

Clerk uses cookies and browser storage for sign-in and session security. Flashcade stores preferences such as theme, sound and music settings, and guest learning progress in your browser. You can clear this storage in your browser settings; doing so can sign you out or remove local progress. Flashcade does not use advertising cookies. The game analytics described above are sent to our servers separately.

Your rights

Depending on the law that applies, you may request access to your personal data, correction, erasure, a portable copy, or restriction of processing, and may object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. We may need to verify your identity and may retain records required by law. Requests are handled within the applicable legal deadlines.

You can also complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), or the authority in the EU or UK country where you live.

Children

Flashcade is not intended for children under 13. If you are under 18, a parent or guardian must approve your use and any paid subscription. Any higher minimum age or parental-consent requirement under local law also applies. If we learn that a child provided personal data without required permission, we will take steps to remove it.

Security

We use HTTPS, access controls and authenticated services to protect data. Cloudflare hosts our database and file storage, and Clerk handles sign-in, so Flashcade does not store your passwords. Authorised administrators and service providers may access data as needed for their roles. No system can guarantee complete security.

Changes

If we change this policy, we update the date at the top. If a change matters, we tell signed-in users in the app or by email before it takes effect.