Privacy Policy

The data controller responsible for your personal data is:

• Contract performance (Art. 6(1)(b) GDPR): Account registration, authentication, flashcard storage, and study features are necessary to provide the service.
• Legitimate interest (Art. 6(1)(f) GDPR): IP logging for fraud prevention, abuse detection, and platform security.
• Legal obligation (Art. 6(1)(c) GDPR): Retaining moderation records, IP addresses, and user identity data as required by EU DSA (Regulation (EU) 2022/2065), German NetzDG (Netzwerkdurchsetzungsgesetz), and other applicable law, including cooperation with law enforcement authorities.
• Consent (Art. 6(1)(a) GDPR): Phone number collection — provided voluntarily and removable at any time.

We share data with the following processors solely to operate the service:

Transfers to US-based processors are carried out under Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR Chapter V.

• Account data (name, email, username, bio): retained until you delete your account.
• Flashcard content and study data: retained until account deletion.
• IP addresses (registration IP and last known IP): retained as part of your account record until account deletion, or longer if required by law.
• Phone number: retained until you remove it in settings or delete your account.
• Content reports: retained for 2 years from submission for audit and legal compliance purposes.
• Moderation records (warnings, bans, ban history): retained for 3 years from the date of action, in accordance with EU DSA Art. 17 record-keeping obligations.
• Email verification and 2FA codes: expire after 10 minutes and are deleted after use.

FlashcardAI operates a content moderation system for public decks in compliance with the EU Digital Services Act (DSA, Regulation (EU) 2022/2065) and German NetzDG.

• Reporting: Any registered user may report a public deck for illegal content, copyright violation, hate speech, misinformation, spam, violence, or other policy violations.
• Review: Reports are reviewed by our moderation team within 24 hours.
• Actions: We may issue warnings, remove content (set decks to private), or suspend/ban accounts. Account bans are logged permanently for legal compliance.
• Auto-escalation: Accounts that receive 3 or more warnings within a rolling 90-day period are automatically suspended pending review, in line with EU DSA Art. 23 obligations regarding repeat infringers.
• Appeals: You may appeal any moderation decision by contacting privacy@flashcardai.app. We respond within 14 days.

We may be required by law to disclose personal data to law enforcement, courts, or regulatory authorities. Data that may be disclosed includes: account information, IP addresses (registration and last known), phone number (if provided), flashcard content, and moderation history.

We will notify you of such a request unless we are legally prohibited from doing so (e.g. by a court order or gag order). Disclosures under German NetzDG are made without prior user notification where the law requires.

Depending on your location, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure ("Right to be Forgotten"): Request deletion of your account and all associated data.
• Portability: Receive your data in a structured, machine-readable format.
• Restriction: Request that we limit processing of your data.
• Objection: Object to processing based on legitimate interest.
• Withdraw consent: Where processing is based on consent, withdraw it at any time.
• California (CCPA): Right to know, delete, and opt out of sale of personal information. We do not sell personal data.
• Canada (PIPEDA): Right to access and challenge accuracy of your personal information.

To exercise any right, email privacy@flashcardai.app. We respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority. In Germany: Bundesbeauftragte für den Datenschutz (BfDI).

We use only essential cookies required to operate the service (authentication tokens). We do not use tracking, analytics, or advertising cookies. See our Cookie Policy for details.

FlashcardAI is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact privacy@flashcardai.app.

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. Continued use of the service after changes constitutes acceptance.

For any privacy-related questions or data requests:
privacy@flashcardai.app