Privacy policy

Last updated 2026-09-28

Who is responsible

Flashcard is run by the person named in the Impressum (see /impressum). You can reach us at the email address given there.

Your account: name, email address, profile picture, and — if you use a password — a secure hash of it, never the password itself.
Your learning data: the notes and documents you import or upload, your topics and cards, your answers and progress, and your conversations with the tutor.
Google Drive: an encrypted access token and the files you pick in Google's window. Since September 2026 Flashcard can only open files you picked; accounts that connected Drive earlier granted read access to the whole Drive until they reconnect or disconnect it in Settings. Google's own sign-in tokens are not stored.
AI assistants you connect (Claude, ChatGPT): the assistant's name, access tokens stored only as secure hashes, and when it was last used.
Your settings (theme, sounds) are stored in your own browser; your interface language, time zone and daily goal are also stored with your account.

To provide the learning service you signed up for (Art. 6(1)(b) GDPR), to send password-reset emails you request, and to keep the service secure.

Vercel: hosting the website.
Neon: database (EU region).
Google: sign-in with Google, Google Drive import, and the AI model that grades answers and powers the tutor (Gemini).
Render: hosting our AI service in Frankfurt, which passes answers and tutor messages to the AI model.
Resend: sending emails: password resets, sign-in notices and premium-trial notices.
Telegram: notifying the site owner of premium requests (your name, email and what you entered in the request).
Text you send for grading or to the tutor is passed to the AI model to produce the answer. We use Google's Gemini API on its free tier, where Google may use prompts and answers to improve its products, including human review. Please don't write personal details into answers or tutor messages.
Some of these providers (Vercel, Google, Resend, Telegram) are based outside the EU, mainly in the USA. Transfers rely on the EU–US Data Privacy Framework or the EU standard contractual clauses these providers offer.

We use only essential cookies needed for signing in (session, security and sign-in redirect cookies). There are no advertising or analytics cookies.

As long as your account exists. To delete your account and all its data, email us at the address in the Impressum; we delete it within 30 days.
You can disconnect Google Drive or an AI assistant at any time in Settings.

You have the right to access, correct, delete, restrict and export your data, to object to processing, and to complain to a data-protection authority. Contact us at the email address in the Impressum.