Privacy Policy

1. Introduction

FlashFetch ("we", "us", "our") respects your privacy. This policy explains what data we collect, how we use it, and your rights regarding that data. By using FlashFetch, you agree to the practices described here.

2. Data we collect

We collect the following information when you use FlashFetch:

• Account information: Your email address and authentication provider (Google or magic link), stored securely in our database via Supabase.
• User-generated content: URLs you submit, flashcard decks, individual cards (questions and answers), and review history. This data is stored in our Supabase database.
• Subscription and billing data: Your plan type and Stripe customer ID. Payment details (card numbers, billing addresses) are handled entirely by Stripe and never stored on our servers.
• Analytics data: We use PostHog to understand how people use FlashFetch. This includes page views, feature usage events (e.g. cards generated, reviews completed), and basic device information (browser type, screen size).

3. Cookies and tracking

FlashFetch uses cookies and similar technologies for the following purposes:

• Authentication cookies: Supabase sets cookies to maintain your login session. These are essential for the app to function.
• Analytics cookies: PostHog sets cookies to identify unique visitors and track usage patterns. These help us improve the product. PostHog data is hosted on EU servers (eu.posthog.com).
• Vercel Analytics: We use Vercel Analytics for basic performance monitoring. This collects anonymous, aggregated data with no personal identifiers.

You can disable non-essential cookies by declining them in the cookie banner. Essential authentication cookies cannot be disabled as they are required for the app to work.

4. How we use your data

• To provide and maintain the FlashFetch service (generating flashcards, scheduling reviews).
• To send transactional emails (welcome emails, daily review digests) via Resend.
• To process payments and manage subscriptions via Stripe.
• To analyse usage patterns and improve the product via PostHog.
• To extract content from URLs you submit, using third-party services (Firecrawl for articles, YouTube for video transcripts).

5. Data storage and security

Your data is stored in a Supabase-hosted PostgreSQL database with Row-Level Security (RLS) enabled, meaning each user can only access their own data. All connections are encrypted via TLS. Authentication is handled by Supabase Auth with industry-standard practices.

6. Third-party services

We share data with the following third-party services, only as necessary to provide the FlashFetch service:

• Supabase: Database and authentication hosting.
• Stripe: Payment processing and subscription management.
• PostHog (EU): Product analytics.
• Anthropic (Claude): AI-powered flashcard generation. Article and transcript content is sent to Claude to generate cards. No personal information is included in these requests.
• Resend: Transactional email delivery.
• Vercel: Application hosting and performance analytics.
• Firecrawl: Article content extraction from submitted URLs.

7. Data retention

Your account data, decks, and cards are retained for as long as your account is active. If you delete your account, all associated data will be permanently removed from our database. Analytics data in PostHog is retained for 12 months.

8. Your rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and all associated data.
• Object to processing of your data for analytics purposes.

To exercise any of these rights, contact us at support.flashfetch@proton.me.

9. Changes to this policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. Continued use of FlashFetch after changes constitutes acceptance of the updated policy.

10. Contact

If you have questions about this privacy policy or your data, contact us at support.flashfetch@proton.me.