Flanky Privacy Policy
Flanky (“the App”, “we”) is a language-learning flashcard app for iOS, operated by Sergey Shalnov (“the operator”). This policy explains what data the App collects, why, where it goes, and what rights you have.
Contact for anything privacy-related: support@flanky.app.
What we collect
Account data. When you sign in with Apple, we receive and store your email address (or Apple's private relay address if you chose “Hide My Email”) and, if shared, your name. We create an account identifier (a random UUID) that links your data.
Your learning content. The decks, words, phrases, and translations you create are stored on our servers so they sync across your devices and survive reinstalls.
Purchase data. If you subscribe, the purchase is processed entirely by Apple. We receive subscription status (plan, active/expired, trial state) — never your payment details. We have no access to your card or bank information.
Usage analytics. We collect events about how the App is used (screens viewed, features used, subscription funnel steps, error events), tied to your account identifier. We use this to understand what works and fix what doesn't. We do not collect advertising identifiers (IDFA), we do not track you across other apps or websites, and we show no ads.
Support messages. If you send feedback through the App, we receive the message text, your account identifier and email, basic app and device info (app version, OS, device model, locale, network type), and — only if you choose to attach it — an app log file.
Notifications. Study reminders are scheduled locally on your device. We store your reminder preferences; we do not read your notification content.
What we do NOT collect
No location data, no contacts, no photos, no microphone audio, no health data, no browsing history, no advertising identifiers, no data from other apps.
Why we process it (legal bases under GDPR)
| Data | Purpose | Legal basis |
|---|---|---|
| Account data | Sign-in, sync, account management | Contract (providing the service) |
| Learning content | Core app functionality, sync | Contract |
| Subscription status | Unlocking paid features, support | Contract |
| Analytics events | Improving the App, fixing errors | Legitimate interest |
| Support messages | Answering you | Contract / legitimate interest |
Who processes it for us
We use a small number of service providers (“processors”). Each receives only what its job requires:
| Provider | What it does | What it receives |
|---|---|---|
| Cloud hosting provider (US) | Hosts our servers and database | All server-side data above |
| Apple | Sign-in, payments, App Store | Handled under Apple's own terms |
| Subscription management platform (US) | Subscription management | Account identifier, subscription status |
| Analytics service (US) | Analytics | Account identifier, usage events |
| AI translation provider (US) | Generates translations via AI models | The words/phrases you ask to translate (not your identity) |
| Speech synthesis provider (US) | Generates pronunciation audio | The words/phrases to voice (not your identity) |
| Messaging service | Delivers support messages to our team | Your feedback text, email, account identifier, app/device info, and the log file if you attach one |
We do not sell your data. We do not share it with anyone beyond this list, except if legally required. The identity of any specific provider is available on request via the contact above.
International transfers. Our servers are in the United States. If you use the App from the EU/EEA or UK, your data is transferred to the US; our providers rely on standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.
How long we keep it
Your data is kept while your account exists. Decks and words you delete are immediately hidden from your library and excluded from sync; they are permanently erased when you delete your account. Server backups expire on a rolling basis within 7 days.
Deleting your data
You can delete your account directly in the App: Settings → Delete Account. This permanently erases your account, learning content, and personal data from our systems, and instructs our processors to do the same where applicable. Analytics events are unlinked or deleted. This is irreversible.
You can also email us at the address above to request deletion, a copy of your data (access/portability), or correction of inaccurate data. We respond within 30 days. EU/EEA users additionally have the right to object to legitimate-interest processing and to lodge a complaint with their local supervisory authority.
Children
The App is not directed at children under 13 (or the higher minimum age in your country), and we do not knowingly collect data from them. Contact us if you believe a child has created an account.
Changes to this policy
If we change this policy in a way that matters, we will note it in the App and update the date at the top. Continued use after changes means acceptance.