Privacy Policy

When FlashFlow is deployed by a school, the school acts as the data controller and FlashFlow acts as the data processor. If you are a student, your teacher or school administrator can help you exercise your data rights. For general enquiries, contact us.

To provide the service, we collect only the data the platform needs to function:

• Account details — your email address and name, used to identify you.
• Role — whether your account is a teacher or student, so the right features are shown.
• Content you create — flashcard decks and cards, folders, and (for teachers) classrooms, members, and assignments.
• Study activity — sessions, cards studied, and scores, so you can track progress and teachers can monitor assignments.
• Classroom membership & assignment progress — which classes you belong to and your completion of assigned work.
• Device-trust flag — stored only in your own browser to remember that you've confirmed this device at sign-in.

We do not collect location data, biometric data, or browsing history.

If you sign in with Google, we request only the minimum profile information needed to create and identify your account: your name and email address.

We do not request access to your Google contacts, photos, calendars, Drive files, emails, or any other Google data, and we do not store anything beyond your name and email from that sign-in. Any extra fields returned by Google are discarded and never written to our database.

We use your data only to run the platform:

• To show you your decks, cards, classes, and assignments.
• To record study progress and assignment completion.
• To send a one-time confirmation code to your email when you sign in from a new device.
• To let teachers manage classrooms and monitor assigned work.

We do not sell your data, and we do not share it with third parties for advertising.

Passwords are never stored in plain text. Access to records is restricted so that one user cannot read or edit another user's private data. Sign-in from a new device or browser is confirmed with an emailed code, and trusted devices are remembered only on that browser.

You have the right to access, export, correct, and delete your personal data. You can export or erase all data tied to an account — including decks, cards, classes, assignments, and study history — at any time.

Teachers and school administrators can perform export and erasure on behalf of a user through the internal Data Privacy tools. When data is erased, it is permanently removed from the platform and cannot be recovered.

To request export or deletion of your data, ask your school administrator or contact us.

We may update this policy as the platform evolves. The effective date above reflects the most recent revision. Continued use of FlashFlow after a change means you accept the updated policy.