Who is responsible

The controller of the personal data described here is Klaudia Klubińska, who runs Flipsy (flipsy.pro) as a private person in Poland, in the European Union. For any privacy question or request, write to flipsy.admin@gmail.com. Full details are in the Operator section at the bottom of this page.

What we collect

Account

Your email address and a securely hashed password, or, if you sign in with Google, your name, email address and profile picture from Google.
The name you enter in Flipsy, your interface language and your time zone (used to schedule reviews and reminders on your local day).

What you create

Your folders, sets, flashcards, verbs and any text you import into them. Imported PDFs are read in your browser; we store only the cards made from them.
Whether a set is public or private.

How you study

Your reviews and answers, study sessions, streaks, goals and the scheduling state of each card.
A personal memory model calculated from your reviews, so cards come back at the right time for you.
Which features you use (for example importing or exporting a set) and when you were last active, so we know what to improve.

Reminders

Your reminder settings and a record of which reminder emails we sent you.

Pro subscription

Your plan, the subscription status and renewal date, and the customer and subscription IDs from our payment provider Creem, plus the payment events Creem sends us. We never receive or store your card details.

Technical data

Our hosting provider keeps short-lived server logs with your IP address, browser and the pages requested, for security and to fix errors.
Page view statistics from Vercel Web Analytics, which counts visits without cookies and without identifying you.

You need an email address (or a Google account) to create an account; without it we cannot provide Flipsy to you. Everything else you add is up to you.

Why we use it and on what legal basis

To provide Flipsy to you (your account, saving and showing your sets, scheduling reviews, Pro): this is necessary for our agreement with you (GDPR Art. 6(1)(b)).
To send study reminders: a short daily email if you have not studied yet. Reminders are on by default for new accounts; you can switch them off when you sign up, at any time in Settings, or with the link in every reminder. They are about your own studying, never marketing. Basis: our legitimate interest in helping you keep your study habit (Art. 6(1)(f)).
To keep Flipsy secure, prevent abuse and improve it (logs, rate limits, feature usage, anonymous visit counts, backups): our legitimate interest in running a safe, working service (Art. 6(1)(f)).
To keep payment and tax records: a legal obligation (Art. 6(1)(c)). Creem, as merchant of record, keeps most of these.
To answer your messages: our legitimate interest in helping you, or our agreement with you when it is about your account.

We do not use your data for advertising, we do not sell or rent it, and we do not make automated decisions about you that have legal effects. We send no marketing emails unless you turn them on in Settings.

Public sets

Your sets are private by default. If you make a set public, its title and cards can be seen by anyone (your name and email are not shown), may be copied by other users and may be indexed by search engines. You can make it private again at any time.

Who processes your data for us

We use a few service providers. Each one only gets the data it needs to do its job for us:

Supabase: database, sign-in and account emails (such as confirming your address or resetting your password).
Vercel: hosting, server logs and cookieless visit statistics.
Resend: sending study reminder emails.
Creem: payments for Pro. Creem is the merchant of record and processes your payment and billing details under its own privacy policy.
GitHub: storage of encrypted database backups. Only the operator holds the key to decrypt them.
Google: sign-in with Google, if you choose it (the Google sign-in button is loaded from Google on the sign-in screens, so Google receives your IP address there). Short texts such as numbers are also sent from our server, not your browser, to Google to read them aloud. If you add a custom font from Google Fonts, it is loaded from Google, which receives your IP address.
MyMemory (Translated, Italy): when you use automatic translation in the set editor, the word or phrase is sent from our server to get a translation.

Some of these providers process data outside the European Economic Area, for example in the United States. Where they do, the transfer is protected by the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

We may also disclose data when the law requires it, for example to answer a valid request from a court or authority.

Cookies and local storage

Flipsy uses only what it needs to work. There are no advertising or tracking cookies, so we do not show a cookie banner.

Sign-in cookies that keep you logged in.
A language cookie that remembers your interface language.
Local storage in your browser for preferences such as custom fonts and unfinished actions.
On the sign-in screens, Google's sign-in button may set Google's own cookies, under Google's privacy policy.

How long we keep it

Your account data, content and study history: while your account exists.
When you ask us to delete your account, we delete it within 30 days.
Backups: daily encrypted backups are kept for 30 days; a weekly encrypted backup is kept longer as a disaster-recovery archive. Backups are never used for anything else. If we ever have to restore one, we delete again every account that was deleted after the backup was made.
Server logs: kept for a short period by our hosting provider, then deleted automatically.
Payment records: kept by Creem, and by us where needed, for as long as tax and accounting law requires.

Your rights

You have the right to:

get a copy of your data and receive it in a machine-readable format,
correct data that is wrong,
have your data and account deleted,
restrict or object to how we use your data, in particular where we rely on legitimate interests (for example reminders),
withdraw a choice you made at any time.

To use any of these rights, write to flipsy.admin@gmail.com from the email address of your account, so we know the request is really from you. We reply within one month. Most things, like your name, reminders and public sets, you can also change yourself in Settings.

You can also complain to a data protection authority, in particular in the EU country where you live or work. In Poland that is the President of the Personal Data Protection Office (UODO, uodo.gov.pl).

Children

Flipsy accounts are for people aged 13 and over. If you are under 16, or under the age of digital consent in your country, a parent or guardian needs to agree to you using Flipsy. If you believe a child under 13 has created an account, write to flipsy.admin@gmail.com and we will delete it.

Security

Your data is sent over encrypted connections, each account can only read its own private data, and passwords are stored hashed. No system is perfectly secure; if a breach ever puts your data at risk, we will tell you and the authorities as the law requires.

Changes to this policy

When we change how we use your data, we update this page and the date at the top. For an important change we will also tell you by email or in the app. See also our Terms of Service.

Operator

Flipsy is run by Klaudia Klubińska, a private person in Poland (unregistered activity under Art. 5(1) of the Polish Entrepreneurs' Law). Email for everything, including complaints, refunds, withdrawal and privacy requests: flipsy.admin@gmail.com. A postal address for letters and formal notices is available on request at the same email.