Privacy policy
Last updated: August 10, 2026
Courtesy translation. In case of any discrepancy, the French version prevails.
What this policy covers
This policy covers both the flashkit.io website and the FlashKit mobile app (Android and iOS). They are described separately below, because they do not collect the same things: the site measures its audience, the app handles an account and your decks. The app is fully usable without an account. Until you sign in, your decks stay on your device and nothing is sent to our servers, apart from the usage measurement described below, which you can switch off.
Data controller
The controller of the data collected on the site and in the app is the publisher of FlashKit, whose identity and contact details appear in the legal notice. For any question about your data: contact@flashkit.io.
Data collected by the site
The site collects two kinds of data. (1) Audience measurement: page views, traffic source and clicks on the download button, via PostHog (hosted in the European Union), in order to understand which pages lead to app downloads; this measurement is configured without cookies or persistent identifiers. (2) Waitlist: if you submit your email address, we keep it in order to notify you at launch, via our email provider Loops. The site collects no health data.
Data collected by the app
(1) Account: if you create one, we keep your email address, the display name you choose, your app language and, for email sign-up, a hashed password we cannot read. Signing in with Google gives us your email address and name, never your Google password. (2) Deck backup: once you are signed in, your deck and card content, tags, review history and experience points are synced to our servers so they can be restored on a new device. Images and audio attached to your cards are not synced; they stay on your device. (3) Notifications: if you allow them, a push token is stored so we can reach your device, for instance when a generation has finished. (4) Usage measurement: the screens you open and the main actions you take (a session finished, a deck imported) are sent to PostHog under a random identifier that is never tied to your account. You can turn this off in Settings, under Privacy, and nothing is sent from then on.
AI card generation
When you ask FlashKit to write a deck, your prompt and any files you attach (PDFs or photos, five at most) are sent to our servers and then to Mistral (France), which writes the cards. Documents are converted to text on our servers before the model sees them. If you turn on web search, your request is also sent to our search provider (Serper, United States) to look up current sources. We never use your prompts or files to train a model. They are kept only long enough to produce the deck and are then deleted from our servers automatically within seventy-two hours. The resulting cards become an ordinary deck on your device and follow the same rules as your other decks.
Legal bases
The account, deck backup and card generation rest on performance of the contract: they are the services you are asking for by using them. Audience measurement on the site rests on our legitimate interest in improving the site; it is anonymous and exempt from consent. Usage measurement in the app rests on our legitimate interest in understanding what actually helps people study, and can be switched off at any time. Notifications and the waitlist rest on your consent, which you may withdraw at any time.
Retention periods
Your account data and backed-up decks are kept for as long as the account exists, and are erased when you delete it. Prompts and files sent for a generation are deleted within seventy-two hours. Push tokens are dropped when you sign out or as soon as they stop being valid. Measurement data, for both the site and the app, is retained for a maximum of 25 months. Your waitlist email address is kept until the app launches, and at the latest until you unsubscribe.
Recipients and processors
Your data is never sold and never used for advertising. It is processed by our technical processors: OVH (server and database hosting, France), Vercel (site hosting), PostHog (measurement, EU), Mistral (card generation, France), Serper (web search, United States), RevenueCat (subscription management, United States), Expo, Google and Apple (notification delivery), Apple and Google (payment processing for subscriptions), Google (sign-in with a Google account, if you use it) and Loops (email delivery). Some of these providers are established outside the European Union; where that is the case, transfers are governed by appropriate safeguards (standard contractual clauses).
Security
Traffic between the app and our servers is encrypted in transit (HTTPS). Passwords are never stored in the clear. Your session is held on your device in the secure storage the operating system provides. No system is infallible, so we undertake to inform you without delay of any data breach affecting you, as the GDPR requires.
Cookies and trackers
This site uses no advertising cookies and no tracking technologies. Our audience measurement tool sets neither cookies nor persistent identifiers, which lets us understand how the site is used without needing to collect your consent, in line with the recommendations of the CNIL (France's data protection authority). Only strictly technical session storage may be used to keep the site working. The app uses no advertising identifier, no ad network and no cross-app tracking.
Deleting your account
Deletion happens in the app: Settings, Account, then Danger zone. It is immediate and permanent, and it erases your account from the server along with everything backed up to it. The decks on your device are left alone: they are yours, and they outlive the online backup. Full instructions, including what to do if you no longer have the app, are on the dedicated page: flashkit.io/delete-account.
Children
FlashKit is not directed at children under 13 and we do not knowingly collect their data. In France, signing up a minor under 15 requires the authorisation of a holder of parental authority. If you become aware that an account was created by a child, write to us and we will delete it.
Your rights
Under the GDPR, you have rights of access, rectification, erasure, objection, restriction and portability over your data. Erasure is exercised directly in the app (see above); for the other rights, write to contact@flashkit.io. You may also lodge a complaint with the CNIL (cnil.fr).
Contact
For any question about your personal data: contact@flashkit.io.