Privacy Policy

Last updated: 15 October 2026

The short version: Flash it! has no analytics, no ads and no tracking. Your decks, cards and progress are stored on your device. Accounts are optional and only needed for Flash it Cloud (AI card generation). When you use it, the text of your source passes through our server to OpenAI to write your cards, and we keep only basic usage records, never your content. Videos and audio recordings are transcribed on your device and never uploaded.

1. Who we are

Flash it! ("the App") is an iOS application published by the developer of Flash it! ("we", "us"). This policy explains what information the App handles and why. If you have questions, email support@flashit.cc.

2. What the App stores on your device

Everything you create in the App is stored locally on your iPhone or iPad, in the App's private storage, and is never uploaded to us:

Sources and cards: the links, files and text you add, the flashcards generated from them, and any edits you make.
Study progress: ratings, review schedules, XP, level, streaks and badges.
Settings: sound and reminder preferences, and your reminder time.
Sign-in session (optional): if you sign in to Flash it Cloud, a session token is stored in the iOS Keychain on your device.
Videos and recordings: a video or audio file you add is transcribed on your device by Apple's speech recognition (iOS 26 or later). The App keeps the transcript with the deck; the recording itself is not kept, and it is never sent to us or anyone else. The first transcription in a language downloads a speech model from Apple, which iOS manages.
Shared content: when you use the Share sheet to send a link or text to Flash it!, it is placed in a private container that only the App can read, then imported as a source.

None of this is uploaded to us. Deleting the App deletes all of it. If you use iCloud device backups, Apple may include the App's data in your backup under Apple's own privacy terms.

3. When content leaves your device

These features send data over the internet, and all of them are initiated by you:

Fetching a link. When you paste a web address, the App downloads that page directly from the website you chose so it can extract the text. That website will see the request as it would from any browser.
AI card generation (Flash it Cloud). When you generate cards with Flash it Cloud, the extracted text of your source (for a video or recording, its transcript), its title, and your chosen card count and style are sent over HTTPS to our server at api.flashit.cc, which forwards them to OpenAI's API to write the questions and answers and streams the cards back to your device. When you import a web page while signed in, short previews of its paragraphs are also sent the same way so the AI can tell article text from menus and buttons; nothing is rewritten. Our server does not store the text, the previews or the cards. OpenAI processes the request as our service provider under its API terms and privacy policy. We ask OpenAI not to store the request; it does not use API content to train its models and deletes any copy kept for abuse monitoring after a limited retention period. If you use the offline generator instead, nothing is sent anywhere.

Please avoid adding sources that contain other people's personal or confidential information unless you are allowed to process it in this way.

4. Flash it Cloud accounts

You only need an account to use Flash it Cloud. You sign in with Apple, and we never see your Apple ID password. When you sign in, our server stores:

Your account: a stable identifier Apple provides for Flash it!, and the email address Apple shares with us (which can be a private relay address if you choose "Hide My Email").
Usage records: for each generation, the time, source type (for example link, PDF or video), the length of the text in characters, the number of cards requested and returned, the card style, the AI model used, the tokens used and the cost, and whether it succeeded. These records never contain the text of your source or your cards.

We use this information only to run Flash it Cloud: to sign you in, apply the monthly fair-use limit, prevent abuse and understand our costs. We keep it for as long as your account exists.

You can delete your account at any time in the App under Settings, Flash it Cloud, Delete account. This deletes your account, usage records and sign-in sessions from our server and revokes the App's access to your Apple ID.

Our server is hosted by Railway (railway.com) as our infrastructure provider. Web traffic to our domain passes through Cloudflare's DNS.

5. Notifications

If you turn on daily reminders, the App schedules local notifications on your device. These are not push notifications: no notification service, token or server is involved, and you can turn them off at any time in the App's settings or in iOS Settings.

6. What we do not do

We do not require an account to use the App, and we never collect passwords.
We do not use analytics, crash reporting SDKs, advertising SDKs or any third-party tracking.
We do not sell, rent or share personal data with anyone.
We do not track you across apps or websites, and the App does not request permission to do so.

7. App Store and Apple

When you download the App, Apple may collect information such as download and crash statistics under Apple's own privacy policy. Any aggregate statistics we see in App Store Connect cannot be used to identify you.

8. Children

The App is not directed at children under 13 (or the minimum age for digital consent in your country). We do not knowingly collect personal data from children. If you believe a child has created a Flash it Cloud account, contact us and we will delete it.

9. Your rights

Your decks, cards and progress live only on your device, so you control them directly: you can edit or delete any deck, card or setting in the App, and you can remove everything by deleting the App. You can delete your Flash it Cloud account and its data in the App at any time. Depending on where you live, you may have legal rights to access, correct, delete or port personal data. To make a request, or with any question, contact us at support@flashit.cc with any request or question.

10. Security

The App relies on iOS protections: sandboxed storage, the Keychain for your sign-in session, and encrypted connections (HTTPS) for every network request it makes. Our server stores sign-in tokens only as one-way hashes and keeps no source content.

11. Changes to this policy

If we change how the App handles data, we will update this page and the date at the top. Material changes will also be noted in the App's release notes.

12. Contact

Email support@flashit.cc.