1. Overview
This Privacy Policy explains how Flipkall ("we," "us") collects, uses, and shares information when you use our flashcard and study application (the "Service").
2. Information we collect
Account information
When you register, we collect information such as your name, email address, birthdate (where provided), password (stored in hashed form via our auth provider), and profile details including an optional avatar image.
Study content
We store notes, decks, flashcards, study progress, trash/restore data, and related metadata you create in the Service.
Payment information
Subscriptions are handled by Stripe. We receive billing status, subscription identifiers, and limited payment metadata—not your full card number.
Usage and device data
We may collect log data, device/browser type, IP address, and analytics events to secure and improve the Service.
3. How we use information
- Provide, maintain, and personalize the Service
- Authenticate you and prevent fraud or abuse
- Process subscriptions and support requests
- Generate flashcards from your notes when you request AI features
- Send service-related communications (e.g., email verification)
- Comply with legal obligations
4. AI processing
When you use note-to-deck generation, relevant note content is sent to OpenAI (or similar providers we configure) to produce flashcards. Do not submit sensitive personal data you do not want processed by AI vendors. We configure providers to process data for our instructions; review their policies for additional detail.
5. How we share information
We share information with service providers that help us operate:
- Supabase — authentication, database, and file storage
- Resend — transactional email delivery (e.g. account verification, password reset, and service notifications)
- Stripe — payments and subscription management
- Google — OAuth sign-in (if you choose it)
- OpenAI — AI deck generation at your request
- Cloudflare Turnstile — bot protection on signup
- PostHog — product analytics hosted in the United States (where enabled after consent). We send product events, device/browser metadata, and a pseudonymous user id. Session replay is not enabled in the initial rollout. See PostHog's privacy policy for how they process data as a sub-processor.
- CookieYes — cookie consent management
We may also disclose information if required by law or to protect rights, safety, and security.
6. Retention
We retain information while your account is active and as needed to provide the Service, resolve disputes, and meet legal obligations. When you delete your account, we delete or anonymize associated data within a reasonable period, subject to backups and legal holds.
7. Your choices and rights
You may update your profile, change your email, change or set a password, and delete your account in settings. Depending on your location, you may have rights to access, correct, delete, or port personal data, or to object to certain processing. Contact legal@flipkall.com to exercise these rights. We do not currently offer a self-service data export; you may request a copy by email.
8. Security
We use administrative, technical, and organizational measures designed to protect information. No method of transmission or storage is 100% secure.
9. Children
The Service is not directed to children under 13 (or the minimum age in your jurisdiction). If you believe a child has provided personal data without appropriate consent, contact us to request deletion.
10. International transfers
We and our processors may process data in the United States and other countries. Where required, we use appropriate safeguards for cross-border transfers.
11. Changes
We may update this Privacy Policy. Material changes will be reflected by updating the "Last updated" date.
12. Contact
Privacy questions: legal@flipkall.com