Privacy Policy / Datenschutzerklärung

Last Updated: August 2026 | Stand: August 2026

This Global Privacy Policy explains how FlixCard ("we", "us", or "the App") collects, uses, and protects your personal data when you use our application worldwide. FlixCard is provided as a free, non-commercial application.

---

1. Data Controller & Contact Information / Verantwortlicher

The Data Controller responsible for data processing under international privacy laws (including GDPR, UK GDPR, CCPA, and PIPEDA) is:

[Dein Name / Name des Projekts]
Contact Email: [Deine E-Mail-Adresse]
Address/Location: [Dein Land, z.B. Germany / Deutschland]

2. Local-First Storage (Offline Mode)

By default, FlixCard operates on a local-first architecture. All flashcards, decks, settings, and learning progress created by you are stored exclusively on your local device using browser storage (IndexedDB / LocalStorage).

• No local content is automatically transmitted to any server.
• You maintain full control and ownership of your locally stored data.

3. Cloud Synchronization & Account Services (Supabase)

If you voluntarily register an account to enable cross-device cloud synchronization, we collect and process the following minimal personal data:

• Account Data: Your email address and an encrypted password hash.
• Sync Data: Your flashcards, decks, study stats, and settings payload (compressed end-to-end in transit).
• Technical Identifiers: IP address, device/browser header, and access timestamps (for security and session management).

Infrastructure Provider: Cloud synchronization and user authentication are hosted using Supabase Inc. (770 E Main St #223, Lehi, UT 84043, USA). Data transfers are secured using TLS encryption. Where applicable, data transfers comply with EU Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework.

4. Legal Bases for Processing (GDPR / UK GDPR)

• Consent (Art. 6(1)(a) GDPR): By creating an account, you consent to storing your data in the cloud.
• Contract Performance (Art. 6(1)(b) GDPR): Account data processing is necessary to deliver the cross-device sync functionality you requested.
• Legitimate Interests (Art. 6(1)(f) GDPR): Technical logging for IT security and abuse prevention.

5. US State Privacy Rights (CCPA / CPRA - California & US Residents)

Under the California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), and related US state laws:

• We DO NOT sell your personal information.
• We DO NOT share or cross-contextualize your personal data for targeted advertising or commercial marketing.
• No Commercial Tracking: We do not use third-party tracking pixels, ad networks, or analytics tools (such as Google Analytics, Facebook Pixel, or ad tracking).

6. Data Security & Retention

We enforce industry-standard security measures, including HTTPS/TLS encryption and encrypted database storage. Your data is retained only as long as your account remains active.

7. Your International Rights & Data Control

Regardless of your jurisdiction, you hold the following rights regarding your personal data:

• Right of Access & Portability: You can export or inspect your flashcard data at any time directly in the app.
• Right to Erasure ("Right to be Forgotten"): You can permanently delete your account and all associated cloud data via the App Settings ("Delete Account") or by emailing us.
• Right to Rectification: You can edit or update your data directly within the app.
• Right to Withdraw Consent: You can stop cloud synchronization at any time by logging out or deleting your account.

8. Children's Privacy

FlixCard does not knowingly collect personal information from children under the age of 13 (or 16 in the EU/UK). If you believe a child has provided us with personal information, please contact us for immediate account and data deletion.

9. German Summary / Kurzfassung auf Deutsch