This policy explains what happens to your information when you use the Audio Flashcards apps for iPhone, iPad, Mac and Android, the website at audio-flashcards.com, the help site at docs.audio-flashcards.com, and Shared Cards (together, the "Services").

The short version

  • Your library stays with you. Your cards, recordings, text, review history and settings are stored on your device, or in your own iCloud Drive if you use iCloud. We do not receive them unless you publish a collection to Shared Cards.
  • You do not need an account to make cards, review, see statistics, sync with iCloud or make backups. An account is only needed for Shared Cards.
  • We use a few services to run the app: analytics to understand how the app is used, crash reports to fix bugs, ads to keep the app free, and a purchases service for subscriptions. They are listed below.
  • We do not sell your personal information.
  • You can delete your Shared Cards account and everything you published from inside the app at any time.

Who we are

The Services are provided by Audio Flashcards ("we", "us"), based in Australia. We are responsible for the personal information described in this policy (in the European Union and the United Kingdom, we are the "controller").

Contact us about privacy at [email protected].

What stays on your device

The following is stored on your device and, depending on your settings, in your own iCloud Drive (on Apple devices) or your device's backups. We cannot see it.

  • Your folders, cards, recordings, text, transcripts, flags, tags and review history.
  • Your settings, review sessions and voices.
  • The access keys for any cloud voice service you add, which are kept in your device's secure storage.
  • Backup files you create, which are encrypted, and files you share with other people.

iCloud is provided by Apple under Apple's privacy policy. On Android, the system may include the app's data in your device's backup to your Google account, depending on your device settings.

What we collect, and why

Shared Cards account

If you create a Shared Cards account, we collect:

  • Sign-in details: your email address, and the account identifier Apple or Google gives us if you sign in with them. Apple or Google may also share your name and profile picture. We use these only to run your account and never show them publicly.
  • Sign-in sessions: the IP address and device or browser type of each signed-in session, to keep your account secure.
  • Email sign-in codes: a one-time code we email to you, and a scrambled (hashed) record of the address it was sent to, which we use to limit abuse.

Your profile

Your display name, photo, biography and whether your profile is public. When your profile is public, these are shown with your public collections. New profiles are private until you set them up.

What you publish

When you publish a collection, we store and share what it contains: its title, description, languages, the cards' text, recordings, generated audio, transcripts and author tags. We also store your invitation links, who has joined through them, and anyone you have blocked. Published collections never include your review history, grades, flags or study progress.

To stop people publishing other people's recordings as their own, we keep a fingerprint (a hash) of the audio in every published collection. A fingerprint cannot be turned back into audio.

Reports, moderation and security

If you report a collection, we store your report and your account. We keep records of account actions and moderation decisions, including any account suspensions, to keep Shared Cards safe and to meet our legal obligations.

Marketplace

If you used Marketplace, the service Shared Cards replaced, we keep your Marketplace account details and published collections in a read-only database. Older versions of the app still read the Marketplace catalogue from it, and we use your email address to let you claim your collections in Shared Cards.

Purchases

Subscriptions and lifetime purchases are made through the App Store or Google Play, which handle your payment details. We do not receive your card details. Our purchases service, RevenueCat, receives a random app user ID and your purchase receipts, so the app can tell whether you have ad-free access across your devices.

Analytics

The apps use Google Analytics for Firebase to understand how the app is used, such as which screens and features are opened, along with device model, operating system, app version, approximate location (country or region) and an app-specific identifier. We use this to improve the app, not to identify you.

Crash reports and performance

The apps use Sentry to report crashes and errors and to measure performance on a sample of app sessions. A report includes the device model, operating system, app version, what the app was doing when the problem happened, and technical details of the error. Sentry may process your IP address when it receives a report.

Advertising

The free version of the apps shows ads through Google AdMob. To show an ad and count views, Google receives your IP address, device information and how you interact with the ad.

  • On iPhone and iPad, ads are not personalised unless you allow tracking in Apple's tracking prompt. We do not show that prompt, so the ads you see are not based on your activity in other apps.
  • On Android, Google may use your device's advertising ID to personalise ads. You can reset or delete your advertising ID in your device's settings.

Buying ad-free access removes the ads.

Voice commands and transcription

When you use voice commands, the app listens for commands only while a review session with voice commands is running. Speech is recognised on your device where your device supports it. If it does not, your speech is processed by Apple's speech service (on Apple devices) or your device's speech service, usually Google's (on Android), under their privacy policies. We do not receive or keep recordings of your voice commands.

Transcribing your recordings, so their words show on the card and in search, happens on your device.

Text-to-speech

Your device's built-in voices and Kokoro voices make audio on your device. If you add an Amazon Polly or OpenAI voice, the text you ask it to read is sent from your device directly to that company under your own account with them, and their privacy policy applies. We do not receive that text.

Downloads

Speech models and Kokoro voices are downloaded from Hugging Face, which receives your IP address and the files you download. Shared Cards collections are downloaded from our servers.

The websites

audio-flashcards.com is hosted by Vercel, and both it and the help site, docs.audio-flashcards.com, are served through Cloudflare. Like most websites, they record basic request information, such as your IP address, browser type and the pages you visit, to run the sites and keep them secure. Neither site uses cookies, analytics or advertising trackers. Previews of public collections stream their audio through our servers.

When you contact us

If you email us, we receive your email address and your message. Feedback sent from the app also includes your app version and operating system version so we can help.

We use your information to:

  • Provide the Services, including your account, Shared Cards and purchases. Legal basis: to perform our contract with you.
  • Keep the Services safe, including preventing abuse, moderating content, detecting copied recordings and protecting accounts. Legal basis: our legitimate interest in running a safe service, and our legal obligations.
  • Fix problems and improve the apps, using crash reports and analytics. Legal basis: our legitimate interest in a reliable, useful app.
  • Show ads that pay for the free version. Legal basis: our legitimate interest for non-personalised ads, and your consent for personalised ads where the law requires it.
  • Reply to you when you contact us. Legal basis: our legitimate interest in helping you.
  • Meet legal obligations, such as responding to lawful requests and handling reports of illegal content.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Shared Cards does use some automatic checks, described in our Terms and Conditions.

Who we share it with

We share information only as described here:

  • People you share with. Public collections and public profiles can be seen by anyone, including on the website. Private collections can be opened by anyone who has one of your invitation links.
  • Service providers who run parts of the Services for us, under contracts that limit how they use your information:
    • Cloudflare — hosts Shared Cards, stores published collections, and serves the websites.
    • Google — sends sign-in emails (Gmail), Sign in with Google, analytics (Firebase) and ads (AdMob).
    • Apple — Sign in with Apple.
    • Vercel — hosts audio-flashcards.com.
    • MongoDB — hosts the read-only Marketplace database.
    • RevenueCat — manages purchases.
    • Sentry — crash and error reporting.
  • When the law requires it, or to protect people's safety, our rights, or the security of the Services.
  • If the business changes hands, to a buyer or successor, who must protect your information as this policy describes.

We do not sell your personal information. Where the law treats personalised advertising as "sharing" personal information, it applies only on Android, and you can turn it off as described above.

International transfers

We are based in Australia, and our service providers process information in other countries, including the United States and countries in the European Union. When information from the EU, UK or Switzerland is transferred, we rely on adequacy decisions or the standard contractual clauses in our providers' data processing terms.

How long we keep it

  • Your library stays on your device and in your iCloud until you delete it.
  • Your Shared Cards account and profile are kept until you delete your account.
  • Deleting your account permanently deletes your account, your profile and every collection you published. Removed collections are deleted from our servers about 30 days later.
  • A collection you remove is deleted from our servers about 30 days later.
  • Audio fingerprints may be kept after a collection is removed, so copies cannot be published as originals.
  • Sign-in sessions are kept until you sign out or they expire. Records of sign-in emails are deleted after 24 hours.
  • Security and moderation records are deleted after 90 days, except reports, suspensions and decisions we need to keep longer to handle repeat abuse or legal claims.
  • Analytics data is kept for up to 14 months, and crash reports for up to 90 days.
  • Emails are kept for as long as we need them to help you.

Your choices and rights

  • Delete your account in the app: open your Shared Cards profile and choose Delete Account and Data.
  • Edit or hide your profile, and unpublish or remove your collections, at any time in the app.
  • Limit ad tracking in your device settings, as described under Advertising.
  • Stop voice commands by turning them off in a review session.

Depending on where you live, including in the EU, the UK, Australia and some US states, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy in a portable form, object to or restrict how we use it, and withdraw any consent you have given. To use these rights, email [email protected]. We will reply within one month, and we may need to confirm it is you first. We will not treat you differently for using your rights.

If you are unhappy with how we have handled your information, please contact us first. You can also complain to your data protection authority: in Australia, the Office of the Australian Information Commissioner (oaic.gov.au); in the UK, the Information Commissioner's Office (ico.org.uk); and in the EU, the authority in your country.

Children

The Services are not directed at children under 13, and we do not knowingly collect personal information from them. You must be at least 13, or the minimum age to consent to data processing in your country if that is higher, to create a Shared Cards account. If you believe a child has given us personal information, contact us and we will delete it.

Security

We protect your information with encryption in transit, secure storage for account keys, and access limited to the people and services that need it. Backup files you create are encrypted. No system is completely secure, so please keep your devices and accounts protected.

Changes to this policy

We will update this policy when the Services change. The date at the top shows when it last changed. If we make a significant change, we will tell you in the app or by email before it takes effect.

Contact us

Audio Flashcards, Australia. Email [email protected].