Privacy Policy

FlashLingo is an iPhone app for learning vocabulary with flashcards. This policy explains which data the app and the website flashlingo.io process, why, who else receives it, how long it is kept and what your rights are.

In short

• Your sets, cards and learning progress are stored in your FlashLingo account, so that they sync between your devices and are not lost.
• You can use FlashLingo as a guest, without an email address. If you create an account, we store your email address and username.
• Usage statistics and error reports are tied to a random account ID, never to your name or email address.
• We show no ads, don't use the advertising identifier (IDFA), don't track you across other companies' apps or websites, and never sell data.
• You can delete your account and all of its data at any time in the app.

1. Who is responsible

The controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) is:

We are not required to appoint a data protection officer. Please send any privacy question or request to the address above.

2. Your account

When you first open FlashLingo, the app signs you in as a guest. The guest account has only a random account ID and holds no email address or name. You can turn it into a full account later, or sign in to an existing one:

• Email and password. We store your email address and whether it is verified. Your password is stored by Firebase Authentication as a salted hash, so we never see it.
• Sign in with Apple. Apple gives us your email address, or a private relay address if you choose to hide yours, and, the first time only, the name you choose to share.

Every account has a username, which the app generates and you can change. When you create an account or continue as a guest, we record which version of the Terms of Service and of this Privacy Policy you accepted, and when.

To verify your email address, reset your password or confirm a new email address, we send you an email. These emails are sent through Resend (see section 9). Each kind of email is limited to a few per hour. To enforce that limit, we store a counter under a hash of your account ID, or of your email address for password resets, and delete it after the limit's window has passed.

Legal basis: Art. 6(1)(b) GDPR, to provide the account you asked for. The consent record is kept on the basis of Art. 6(1)(c) and (f) GDPR, to be able to show what you agreed to.

3. Your learning data

FlashLingo stores what you create and how you learn in your account, in Cloud Firestore in Frankfurt, Germany:

• the languages you speak and learn, your sets, and your cards with their front and back text, tags, pins and flags
• your practice history: when you practiced each card, how well you knew it and when it is due again, your streak and your daily practice time
• your settings, such as your daily goal, how many new cards to learn and your reminder times
• your answers in the introduction, such as your daily goal and whether you want reminders

Only you can read this data. Our database rules allow every request only for the account it belongs to. Please don't put sensitive personal information on your cards. Read-aloud uses Apple's speech synthesis on your device, so the text is not sent to us.

Legal basis: Art. 6(1)(b) GDPR, to provide FlashLingo's features.

4. Devices and reminders

To send you practice and streak reminders, and to stop a reminder once you have already practiced on another device, the app stores some details about each device you use with your account: the device type, model and name, the iOS and app version, the language and region settings, the time zone, an identifier the app gets from iOS (identifier for vendor), whether notifications are allowed and a push token. The push token is created by Firebase Cloud Messaging, through Apple's Push Notification service, and is used only to deliver FlashLingo's notifications.

You can turn reminders off in the app, and notifications off in the iOS Settings app, at any time. Legal basis: Art. 6(1)(b) GDPR.

5. Usage statistics: PostHog

In builds from the App Store, FlashLingo sends usage statistics to PostHog. They record which features are used: for example when the introduction is completed, when a set or card is created, edited or deleted, when a practice session starts and ends and how it went, which settings are changed, when you sign up, sign in or out, and when the app is opened, updated or moved to the background. They also record the languages you learn and speak, your current streak and whether you use a guest account. Each event carries the device model, the iOS and app version, the language and the time zone.

The events are tied to your random account ID, never to your name or email address, and never contain the text of your cards. The project is set to discard your IP address. FlashLingo doesn't record your screen and doesn't collect taps automatically. We use the statistics to understand which parts of FlashLingo are used and where people get stuck, so we can improve it. We don't use them to make decisions about you.

Provider: PostHog, Inc. Our data is stored in PostHog's EU region in Frankfurt, Germany, and kept for up to 7 years, so that we can compare how FlashLingo is used over time. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in improving FlashLingo. You can object to this at any time (Art. 21 GDPR) by writing to us.

6. Crash and error reports: Sentry

In builds from the App Store, Sentry receives a report when the app crashes or runs into an unexpected error. It contains the technical stack trace, the device model, the iOS and app version, free memory and disk space, and technical breadcrumbs of the last steps in the app. The app is configured not to send personal information. We use these reports only to find and fix errors.

Provider: Functional Software, Inc. (Sentry). Our data is stored in Sentry's EU region in Frankfurt, Germany. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a stable app.

7. App integrity: Firebase App Check

Firebase App Check lets our servers check that requests come from an unmodified copy of FlashLingo, which protects your data and our servers from abuse. For this, the app uses Apple's App Attest and DeviceCheck services, which confirm the app's integrity without telling us anything about you. Provider: Google, with Apple providing the attestation. Legal basis: Art. 6(1)(f) GDPR.

8. Feedback

When you shake your iPhone, FlashLingo offers to send us feedback. If you send it, we receive your message, any screenshots or images you attach, and the device model and the iOS and app version, so that we can follow up on it. Nothing is sent unless you send it. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in answering feedback.

9. Recipients and transfers outside the EU

We use these service providers. Each acts as our processor under a data processing agreement (Art. 28 GDPR):

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for Firebase: Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging, App Check and Hosting. Firestore is located in Frankfurt, Germany, and Cloud Functions in Belgium. Firebase privacy information
• PostHog, Inc., San Francisco, USA, with data stored in the EU. PostHog privacy policy
• Functional Software, Inc. (Sentry), San Francisco, USA, with data stored in the EU. Sentry privacy policy
• Resend (Plus Five Five, Inc.), San Francisco, USA, for sending account emails. Resend privacy policy

Apple delivers push notifications and provides Sign in with Apple under its own privacy policy. These providers or their affiliates may process data in the United States. Where the recipient is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Otherwise it is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We don't sell or rent data, and we never pass it to advertisers or data brokers.

10. The website

flashlingo.io is hosted on Firebase Hosting. When you visit, your browser sends the technical data needed to deliver the page: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. Google processes this to deliver the website and protect it from attacks. Legal basis: Art. 6(1)(f) GDPR.

The website sets no cookies and loads no analytics or tracking scripts.

11. When you contact us

When you email us, we process your email address, your name if you give it, and the content of your message, in order to answer you. Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR if your message concerns your account. We delete the correspondence once your request has been dealt with, unless we have to keep it longer to defend legal claims, for at most three years.

12. How long we keep data

Deleting your account. You can delete your account at any time in the app's settings. Your sign-in is deleted right away, and your sets, cards, progress, devices and settings are deleted from our database within about a day. A guest account stays on our servers until you delete it, even if you delete the app, because the app cannot tell whether you plan to come back. If you delete the app without deleting your guest account first, write to us and we will delete it.

13. Children

FlashLingo is intended for people aged 14 and over. We don't knowingly process data about younger children. If you believe a child has given us data, please contact us and we will delete it.

14. Security

All connections between the app, the website and our services are encrypted with TLS. Our database rules let every account read and write only its own data, and our servers only accept requests from genuine copies of the app. Access to our cloud accounts is limited to the people who run FlashLingo.

15. Your rights

Under the GDPR you have the right to:

• access your data (Art. 15)
• have it corrected (Art. 16) or deleted (Art. 17)
• restrict its processing (Art. 18)
• receive it in a portable format (Art. 20)
• object to processing based on our legitimate interests (Art. 21)

To use these rights, email us at the address in section 1. Please include your username, so that we can find your account.

You also have the right to lodge a complaint with a supervisory authority. In Austria that is the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at. You can also contact the authority in the EU country where you live or work.

16. Changes to this policy

We update this policy when FlashLingo or the services behind it change. The version number and date at the top show the current version. When we make significant changes, we point them out in the app.

See also our Terms of Service and Imprint.