Privacy policy

The operator of Flashbao determines how and why account and study data is processed and is the data controller for that processing. Privacy questions and requests can be sent to privacy@flashbao.com. Creem separately acts as a controller for the checkout, sale, invoice and payment data it processes as merchant of record.

Account: your email address, a salted hash of your password (never the password itself), your time zone, your study- and display-script choices, review-grading preference, account-terms version and acceptance time. We use your email to create and secure the account, sign you in, send verification and password-reset messages, respond to you, and provide it to Creem when you start checkout. We don't send marketing email.

Study activity: which words you study, your per-card scheduling state, and a log of your reviews (rating and time). The review log lets the spaced-repetition scheduler adapt to you.

Account security: hashed sign-in, email-verification and password-reset tokens. We also process the IP address and other technical request information needed for rate limiting, security, troubleshooting and operational logging.

Subscription: trial dates and Creem customer, checkout, subscription, event and transaction references. Creem separately collects the name, billing address and payment details needed to complete the sale, issue invoices, prevent fraud and handle applicable taxes.

Messages: if you contact us, we process your address and message so we can respond and handle a request or complaint.

We process account, study, session and subscription-status data where necessary to create and perform your contract with Flashbao (GDPR Art. 6(1)(b)). We process limited technical and security data for our legitimate interests in protecting, diagnosing and operating the service (Art. 6(1)(f)). Where a record must be kept to comply with law, the basis is legal obligation (Art. 6(1)(c)). We do not rely on consent for these core activities.

Flashbao automatically uses your review history to calculate when cards should be shown again. This is learning personalization, but it does not make decisions that produce legal or similarly significant effects. We do not use it for advertising, pricing, eligibility or marketing.

Flashbao uses one cookie, fb_refresh: an HttpOnly, SameSite=Strict sign-in token scoped to the authentication API. Its maximum age is the configured sign-in period, normally 30 days, and it is replaced during session refresh and removed on logout.

Local storage holds a content-free session marker, your cached profile and device-only preferences for theme and review-audio autoplay. IndexedDB holds upcoming cards, reviews awaiting sync and cache metadata so study works offline. Session storage holds the current review-session summary for up to 15 minutes or until the tab closes. Logging out or deleting the account removes that account's cached profile, offline study data and review summary; the non-account device preferences remain.

This storage is used only to authenticate you, remember your choices and provide the service, not to track activity across sites. Because it is strictly necessary, Flashbao does not request cookie consent. If analytics, advertising or other non-essential storage is added, this policy and the consent controls will be updated first.

Account and study data is stored in Flashbao's application database using hosting and database infrastructure providers acting on our behalf. Our email-delivery provider receives the destination email address and verification, reset or service message it delivers. Those providers may also process limited technical logs needed to operate and secure their systems.

When you start checkout, Creem receives your account email and an internal user and checkout reference. Creem then processes purchase, billing, fraud-prevention, invoice and tax data as merchant of record. See the Creem privacy notice.

Pronunciation audio is generated in advance through Microsoft Azure during an operator-run corpus build. Flashbao sends only the public course text needed to create that audio, not your account identifier, email or review history. Listening reads the stored audio and does not contact Azure. We do not sell personal data or disclose it for third-party marketing.

Account preferences, study activity, active billing projections and account-terms acceptance are kept while the account exists. Password-reset links expire after one hour and email-verification links after seven days. Their hashes, and expired refresh-token hashes, are deleted after a seven-day security grace period.

Account deletion removes the account link, profile, study history and active billing projection from the application database. De-linked Creem transaction and processed-event references may remain only while needed for reconciliation, fraud prevention, disputes or a legal obligation. Creem retains its own sale and accounting records under the periods in its privacy notice. Copies in disaster-recovery backups, if enabled, remain isolated until overwritten under the provider's backup schedule.

Security and operational request data is kept only for the period needed to diagnose an incident, protect the service or meet a hosting-provider requirement, then deleted or aggregated. Messages are kept while needed to resolve the request and any related claim.

In Settings, you can download an account-data export, change your email or password, and delete your account. Depending on the circumstances, you may also request access, rectification, erasure, restriction or portability, and object to processing based on legitimate interests. These rights can have legal exceptions; we will explain if one applies.

For a question, complaint or right you can't exercise in the app, email privacy@flashbao.com. You may also lodge a complaint with your local data-protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens.

Flashbao is not directed at children or offered to minors. You must be at least 18 to create an account. If we learn that a minor created an account, we will delete it and the associated personal data, except where retention is legally required.