Privacy policy
Last updated: 11 November 2026
Draft. FlashNudge is in beta testing. This document is a working draft and the fields marked for completion will be filled in before the public release.
This policy explains what personal data FlashNudge processes, why, and what choices you have. FlashNudge is an iPhone app for studying flashcards, with an optional service that delivers flashcards prepared in ChatGPT or Claude to your phone.
1. Who is responsible
The controller of your personal data is [operator: full name or company, address — to be completed]. For any privacy question or request, write to [contact e-mail — to be completed].
2. What stays on your iPhone
Your library is stored on your iPhone, not on our servers. This covers your decks and cards, your ratings and study history, your study reminders and your Study Nudge rules. The apps you choose for Study Nudge are handled by Apple's Screen Time system; FlashNudge never learns which apps they are and never sees your app usage.
Deleting the app deletes this data. You can export a copy of your library in Settings.
3. What we process on our servers
| Data | Why | How long |
|---|---|---|
| Account identifier. We store a one-way hash of the identifier issued by the sign-in provider, not your e-mail address. | To recognise your account. | Until you delete your account. |
| Sign-in details: your e-mail address and, depending on the method, a password or your Apple sign-in. These are held by our sign-in provider, Microsoft Entra External ID. | To let you sign in. | Until your account is deleted. |
| Your installed apps: a random device identifier, a device label, and the names of your decks. | So your chat can show your decks and send cards to the right app. | Until you delete your account. |
| Flashcards sent from a chat: deck name, card text and source links. | To deliver them to your phone. | The content is removed as soon as your phone confirms receipt, and after 30 days at the latest if it was never received. A receipt without content is kept to prevent duplicates. |
| Connected chat apps: the name of each connected client, its permissions, and hashed access tokens. | To let you see and remove connections. | Until the connection expires, you remove it, or you delete your account. |
| Only if you turn on “Let chats edit and delete cards”: a copy of the text of your cards, and the edits requested from a chat. | So a connected chat can find, edit or trash cards you ask it to. Study history is never copied. | The copy is deleted when you turn the setting off. Edit requests expire after 30 days. |
| Technical data: salted hashes of IP addresses in short-lived rate-limit counters, and server logs. | To protect the service from abuse and to fix faults. | Rate-limit counters for up to one hour; logs for up to 30 days. |
We do not use analytics or advertising tools, we do not track you across apps or websites, and we do not sell personal data.
4. Legal bases
- Providing the account and card delivery: performance of the contract with you (Art. 6(1)(b) GDPR).
- Security, abuse prevention and fault diagnosis: our legitimate interest (Art. 6(1)(f) GDPR).
- The copy of your card text for chat editing: your request, made by turning the setting on, which you can withdraw at any time by turning it off (Art. 6(1)(b) GDPR).
5. Who receives your data
- Microsoft — hosting of the service in the Azure West Europe region (the Netherlands) and sign-in through Microsoft Entra External ID.
- Apple — if you choose Sign in with Apple, and for distributing the app.
- Cloudflare — delivery of this website.
These providers act on our behalf under data processing terms. Where they process data outside the European Economic Area, they rely on the EU–US Data Privacy Framework or standard contractual clauses.
The chat app you connect (for example ChatGPT or Claude) is a service you use under its own terms and privacy policy. When you connect it, it can see your deck names and send cards; with chat editing turned on it can also read and change card text. What you write in that chat is handled by its provider, not by us.
6. Deleting your account
In the app, open Settings → Chats & account → Delete account. This permanently deletes your account and everything listed in section 3 that is stored on our servers, and ends all chat connections. Cards on your iPhone are kept until you delete them or the app. To also remove your sign-in details from the sign-in provider, write to [contact e-mail — to be completed] and we will delete them within 30 days.
7. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to processing, and to receive your data in a portable form. To use these rights, write to [contact e-mail — to be completed]. You also have the right to lodge a complaint with a supervisory authority; in Poland this is the President of the Personal Data Protection Office (UODO).
8. Children
FlashNudge is not directed at children under 16. If you believe a child has created an account, contact us and we will delete it.
9. Automated decisions
We do not make decisions about you by automated means and we do not profile you.
10. Changes
If we change this policy in a meaningful way, we will update this page and tell you in the app before the change takes effect.