Privacy Policy

1. Introduction

FlashPrep ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our AI-powered flashcard generation service (the "Service"). By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

A. Account Information

• Identity Data: Email address and name (if provided via Google Sign-In).
• Authentication Data: Secure tokens provided by Google OAuth, or a securely hashed password if you sign up with email and password. We never store plaintext passwords.

B. Usage & Content Data

• User Content: Text and PDF documents you submit for processing.
• Generated Content: The flashcard decks, study history, and edits you create.
• Technical Data: IP address, browser type, device information, and interaction logs.

C. Payment Information

We do not store your financial data (credit card numbers). All payments are securely processed by:

• PayPal: For credit card, debit card, and PayPal balance payments.
• LemonSqueezy: As our Merchant of Record for alternative payment methods.

We only receive transaction metadata (e.g., subscription status, plan type, and expiration date) to manage your access.

3. How We Use Your Information

We use your data for the following purposes:

• To provide the core functionality of generating flashcards from your uploaded content.
• To manage your account and synchronize your decks across devices.
• To track your study progress and calculate spaced repetition intervals.
• To communicate important service updates or security alerts.
• To prevent abuse and ensure the security of the Service.

4. AI Processing

When you submit content to FlashPrep, it is processed by OpenAI's API.

• No Training on Your Data: We utilize OpenAI's commercial API platform, which ensures that your submitted text and generated flashcards are not used to train OpenAI's models.
• Ephemeral Processing: Your data is sent to the AI solely for the purpose of generating the response.

5. Data Storage & Retention

A. Source Files (PDFs)

We do not permanently store your uploaded source files. When you upload a PDF:

• The text is extracted and sent to the AI for processing.
• The source file is immediately deleted from our temporary storage.
• We only retain the generated flashcard content in our database.

B. Account Data

We retain your generated decks and study progress as long as your account is active. If you delete your account via the settings page, all your personal data is permanently removed from our live databases.

C. Security

Your data is stored securely using Supabase (database) and Vercel (hosting), which utilize industry-standard encryption at rest and in transit (SSL/TLS).

6. Data Sharing

We do not sell your personal data. We only share data with the following third-party service providers required to operate the Service:

• OpenAI: For AI text generation.
• Supabase: For secure database hosting and authentication.
• PayPal: For payment processing. Subject to PayPal Privacy Policy.
• LemonSqueezy: For alternative payment processing and tax compliance.
• Vercel: For web hosting infrastructure.
• Sentry: For error monitoring and application performance. Sentry may receive your user ID, email address, and session replay data (anonymized DOM snapshots) when errors occur.
• Resend: For transactional and study reminder emails. Resend receives your email address to deliver notifications such as streak reminders and account alerts.
• Google Analytics: For understanding how users interact with our Service (see Section 6A below).

A. Analytics & Cookies

We use Google Analytics 4 to collect anonymous usage data to improve our Service. This includes:

• Pages visited and time spent on each page
• Device type, browser, and general geographic location (country/city level)
• How you arrived at our site (referral sources)

Google Analytics uses cookies to distinguish users. By continuing to use our Service, you consent to the use of these analytics cookies. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, or by adjusting your browser's cookie settings.

7. International Data Transfers

FlashPrep operates globally. Your information, including Personal Data, may be transferred to—and maintained on—computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ. By using the Service, you consent to this transfer.

8. Your Rights

Regardless of your location, we grant you the following rights:

• Access: You can view all your saved decks and data within the app.
• Portability: You can export your flashcards at any time via the "Export" feature.
• Deletion: You can delete your account and all associated data instantly via the Settings page.

For EU/EEA Residents (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR), including:

• Legal Basis: We process your data based on (a) your consent (e.g., when you sign up), (b) contractual necessity (e.g., to provide the Service), and (c) legitimate interest (e.g., to prevent fraud and improve the Service).
• Right to Rectification: You may request correction of inaccurate personal data.
• Right to Restriction: You may request that we restrict processing of your data in certain circumstances.
• Right to Object: You may object to processing based on legitimate interest.
• Right to Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

For California Residents (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request details about the personal information we collect and how it is used.
• Right to Delete: You may request deletion of your personal information (available via Settings).
• No Sale of Data: We do not sell your personal information to third parties.
• Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise any of these rights, contact us at support@flashprep.me.

9. Children's Privacy

FlashPrep is not intended for users under the age of 13. We do not knowingly collect personal data from children under 13. If you are a resident of a country where the age of digital consent is older than 13 (e.g., 16 in certain regions), you must meet that age requirement to use the Service. If we discover that a child has provided us with personal data in violation of this rule, we will delete it immediately.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date at the top of this policy.

11. Contact Us

If you have questions about this privacy policy or your data, please contact us at: support@flashprep.me