What Flash stores, and who touches it.
Your name, email address, passkey public keys, your decks/cards/tags, and your review history (needed for scheduling). Sessions and tokens are stored only as SHA-256 hashes. There is no advertising and no tracking. We count page views and signups in aggregate on our own server to understand what's working — no cookies, no IP addresses, no visitor profiles, no third parties.
Resend sends account emails (verification links). Stripe is the merchant of record for Pro subscriptions (Managed Payments) — it processes payment details and handles sales tax; we never see your card number. Cloudflare proxies traffic to our server. Backups are replicated off-site in encrypted form.
If you connect an AI assistant (Claude, ChatGPT, Grok, or another MCP client), that assistant reads your due cards and submits your grades through an OAuth-scoped connection you can revoke at any time. Your conversations with the assistant happen on that assistant's platform under its own privacy policy.
We keep your account and study data for as long as your account exists. When you delete your account, it is removed from the live database immediately; encrypted off-site backups age out within 30 days. Aggregate counters (page views, signups) and the billing audit log (event names and numeric ids only) contain nothing that identifies you and are kept indefinitely.
Export everything (Anki .apkg or CSV) whenever you like. Delete your account yourself from Settings → Delete account: it removes your cards, review history, media, passkeys, sessions, and connected AIs at once, and cancels an active Pro subscription so nothing bills again. Prefer a human? Email [email protected] and we'll do it for you.