Privacy Policy
Diese Rechtstexte gibt es nur auf Englisch; die englische Fassung ist verbindlich.
1. Who we are
The controller of your personal data is:
Mindflow Labs, s.r.o. Registered office: Plzeňská 3352/156, Smíchov, 150 00 Praha 5, Czech Republic IČO: 24996726 DIČ: Společnost není plátcem DPH Commercial register: Městský soud v Praze, oddíl C, vložka 447201
Privacy contact: legal@flashcardly.io
We are the controller for all personal data processed through the Flashcardly mobile app (“the app”) and the flashcardly.io website (“the site”). Together, we call these “Flashcardly” or “the service.”
2. What we collect
2.1 Account data
When you create an account: your email address, a display name, and — if you use Apple Sign-In or Google Sign-In — an authentication provider identifier. We do not receive your password if you use a social login.
2.2 Learning data
As you use the app: which lessons and decks you open, which words you mark known / study-more, your XP, streaks, achievements, Leitner box state for each word, language preferences, custom decks you create, and completion timestamps.
2.3 Device data
Platform (iOS or Android), OS version, app version, device model, approximate locale. No advertising identifiers.
2.4 Payment data
If you subscribe to Pro, we receive a purchase token and your entitlement status from Apple or Google. We do not see your card number, billing address, or any other payment credential. Apple and Google handle those directly.
2.5 Support data
Anything you voluntarily send us — support emails, bug reports, in-app “Report word” submissions.
2.6 Website analytics
We use PostHog EU on the website in cookieless mode to count page views and understand which sections convert. No cookies are set, no personally identifying information is collected, and your IP is not stored. See our Cookie Policy for details.
2.7 Launch waitlist
Before the app launched (25 July 2026), this website offered a “get notified at launch” form. That form is no longer in use. If you used it, we stored your address for one purpose only: to send you a single notification when the app went live. This is separate from having an account, and we send no other marketing. Legal basis is your consent (Art. 6(1)(a)), which you can withdraw at any time by emailing legal@flashcardly.io. These signups are processed through Resend (see §4). To protect these forms from automated abuse we use Cloudflare Turnstile, a privacy-preserving, cookieless bot check.
3. Why we process it (legal basis)
Under Article 6 of the GDPR, every processing activity needs a lawful basis. Ours:
| Purpose | Legal basis |
|---|---|
| Create and maintain your account | Contract performance (Art. 6(1)(b)) |
| Operate lessons, practice, reviews, streaks, XP, custom decks | Contract performance |
| Bill and manage your subscription | Contract performance |
| Respond to your support requests | Contract performance + legitimate interest |
| Detect abuse, prevent fraud, keep the service secure | Legitimate interest (Art. 6(1)(f)) |
| Crash reporting and error tracking | Legitimate interest |
| Transactional email (receipts, password resets, account notifications) | Contract performance |
| Product analytics (anonymous, aggregated) | Legitimate interest — cookieless and non-identifying |
| Generative AI content delivery (pre-generated content) | Contract performance |
| Optional product-update email (if you explicitly opt in) | Consent (Art. 6(1)(a)) |
Where we rely on legitimate interest, we’ve done a balancing test and concluded our interest does not override your rights. You can object at any time — see §7.
4. Who we share it with
We use a small number of processors to run the service. Each has a data processing agreement with us.
| Processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Supabase, Inc. | Database, auth, file storage | EU (Frankfurt region) | EU-hosted |
| RevenueCat, Inc. | Subscription entitlement | United States | Standard Contractual Clauses (SCCs) |
| PostHog, Inc. | Cookieless website + app analytics | EU (Frankfurt region) | EU-hosted |
| Resend, Inc. | Transactional + contact-form email | United States | SCCs |
| Hetzner Online GmbH | Website hosting | Germany (EU) | EU-hosted |
| Cloudflare, Inc. | CDN, DNS, DDoS protection, bot protection (Turnstile) on website forms | United States / global edge | SCCs |
| Apple Inc. | App Store billing, Apple Sign-In | Global | Apple’s processor terms |
| Google LLC / Google Ireland Ltd. | Google Play billing, Google Sign-In, Cloud Infrastructure, Pre-generated AI content (Gemini) | Global | SCCs |
We do not sell or rent your data to anyone. We disclose to third parties only when required by law — for example, a Czech court order or a binding regulator request — and only to the extent required.
5. International transfers
Some of our processors (RevenueCat, Resend, Cloudflare, Google, Apple) are based outside the European Economic Area. For every such transfer we rely on the European Commission’s Standard Contractual Clauses (decision 2021/914) and apply supplementary measures including encryption in transit, encryption at rest, and strict access controls.
You can request a copy of the applicable SCCs and supplementary measures analysis by emailing legal@flashcardly.io.
6. How long we keep it
Concrete retention, not “as long as necessary”:
| Data type | Retention period |
|---|---|
| Active account and learning data | Until you delete your account |
| Deleted account data (production) | Erased immediately on deletion |
| Deleted account data (backups) | Rotated out within 90 days |
| Website analytics events | 14 months |
| Launch-waitlist email (pre-account) | Until launch + 30 days, or until you ask us to remove it |
| Support emails | 24 months from last reply |
| Crash reports | 90 days |
| Accounting records (invoices, subscription records) | 10 years (required by Czech accounting law — Zákon č. 563/1991 Sb., §31) |
| Legal holds (if litigation or regulator investigation) | Duration of hold |
7. Your rights
Under the GDPR and Czech Act No. 110/2019 Coll. on the Processing of Personal Data, you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure — delete your account and personal data. The fastest way is in-app (Profile → Settings → Danger Zone → Delete Account & Data); see also our Delete-account page
- Portability — receive your data in a machine-readable format (JSON)
- Restriction — ask us to pause processing while a dispute is resolved
- Objection — object to any processing based on legitimate interest
- Withdraw consent — for any consent-based processing, at any time
- Lodge a complaint — with the Czech supervisory authority:
Úřad pro ochranu osobních údajů (ÚOOÚ) Pplk. Sochora 27, 170 00 Praha 7, Czech Republic https://www.uoou.cz
To exercise any right, email legal@flashcardly.io from the email address on your Flashcardly account. We respond within 30 days (extendable by 60 days for complex requests, per Art. 12(3) GDPR).
Exercising your rights is free. If requests are manifestly unfounded or excessive, we may charge a reasonable fee or refuse — this is rare in practice.
8. US State Privacy Rights
If you reside in the United States (including California, Virginia, Colorado, Connecticut, Utah, and Texas), consumer privacy laws provide you with specific rights regarding your personal information.
No Sale or Sharing of Personal Information: We do not “sell” or “share” your personal information for cross-context behavioral advertising, as those terms are defined under the California Privacy Rights Act (CPRA) and similar state laws. We do not use third-party marketing or tracking pixels.
9. Children
Flashcardly is intended for users aged 16 and older. We do not knowingly collect data from children under 16.
If you believe a child under 16 has created an account, email legal@flashcardly.io and we will delete it promptly. Parents and guardians who wish to verify whether a child has an account may also contact us.
10. Cookies and local storage
The website uses the minimum cookies necessary to function (theme preference, consent memory). Website analytics are cookieless. The mobile app uses device storage to cache lessons, audio, and your learning state — this is local to your device and not shared with us unless it’s normal account sync.
See Cookie Policy for specifics.
11. Security
We take reasonable and appropriate technical and organisational measures to protect your data:
- TLS 1.2+ encryption in transit
- Encryption at rest for production databases
- Multi-factor authentication required for team access to production systems
- Principle of least privilege on internal tooling
- Regular dependency updates and vulnerability scanning
No system is perfect. If you notice a security issue, please report it responsibly to legal@flashcardly.io. We don’t have a formal bug-bounty program yet, but we respond quickly and credit responsible disclosures.
12. Changes to this policy
We may update this policy from time to time. For material changes, we will notify you:
- in-app when you next open the service, and
- by email to the address on your account, at least 30 days before the change takes effect
The effective date at the top of this page always reflects the current version. Previous versions are archived and available on request.
13. Contact
General privacy questions and requests:
Postal:
Mindflow Labs, s.r.o. Attn: Privacy Plzeňská 3352/156, Smíchov 150 00 Praha 5 Czech Republic
