1. Data Controller

FlixCard is operated by a private individual (non-commercial project). For data protection inquiries, contact:

As operator, you are the controller within the meaning of Art. 4(7) GDPR.

2. Data We Collect & Why

2a. Local Mode (no account)

When you use FlixCard without an account, no data leaves your device. All flashcards, decks, settings, and learning progress are stored exclusively in your browser (LocalStorage / file download). We have no access to this data whatsoever.

2b. Cloud Sync (optional account)

If you voluntarily create an account to enable cloud synchronisation, we collect the following minimum data:

3. Subprocessors & Third Parties

Cloud authentication and storage are handled by Supabase Inc., 770 E Main St #223, Lehi, UT 84043, USA. Supabase acts as a data processor under a Data Processing Agreement (DPA). Data transfers to the USA are safeguarded by EU Standard Contractual Clauses (SCCs) in accordance with Art. 46 GDPR.

We use no other third-party services. There are no advertising networks, analytics tools (e.g. Google Analytics), tracking pixels, or social media integrations.

CAPTCHA protection (Cloudflare Turnstile) is used during registration to prevent automated abuse. Cloudflare may process your IP address transiently for this purpose. See Cloudflare's Privacy Policy.

4. Data Security & Retention

• All data in transit is encrypted using TLS 1.2+.
• Your flashcard data is gzip-compressed before transmission.
• Passwords are stored as bcrypt hashes — never in plain text.
• Database access is restricted by Row Level Security (RLS): each user can only read and write their own row.
• Account data is retained until you delete your account. Deleting your account permanently removes all cloud data.

5. Your Rights

Under the GDPR (and equivalent laws), you have the following rights regarding your personal data:

To exercise any right, contact us at the email address in Section 1. We will respond within 30 days.

6. US Residents — CCPA / CPRA

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• We do not sell your personal information (ever, to anyone).
• We do not share your personal information for cross-context behavioral advertising.
• We do not use any third-party tracking, analytics, or ad networks.
• You have the right to know, delete, correct, and opt out of sale — none of which applies here as no sale occurs.

To exercise your CCPA rights, contact us at the address in Section 1.

7. Children's Privacy

FlixCard does not knowingly collect personal data from children under 13 (or under 16 in the EU/UK). If you believe a child has created an account, contact us immediately for deletion.

8. Changes to This Policy

We may update this policy to reflect changes in the app or applicable law. Material changes will be announced in the app's version log. Continued use of the cloud sync feature after changes constitutes acceptance.