Privacy policy

FlashLingo is a language-learning app where you speak your answers and get graded on meaning and pronunciation. That means we handle your voice, so this page is written to be read. It explains what we collect, why, who else touches it, and how to get rid of it.

The data controller is Adam Tweedie, trading as FlashLingo, London, United Kingdom. Contact: hello@flashlingo.app.

What we collect

• Account details. Your email address, a username, and optionally an avatar image. If you sign in with Google we receive your email and display name from Google.
• Study data. The decks and cards you create or subscribe to, every answer you give, the scores it receives, and the scheduling state that decides when you see a card next.
• Voice recordings. The audio you record when answering a card or practising pronunciation. Recordings exist only to be graded: each one is deleted as soon as grading finishes, and a scheduled sweep removes anything left over within 48 hours.
• Payment status. If you subscribe to Pro, Stripe handles the payment. We store your Stripe customer reference and the date your Pro access runs to. We never see or store card numbers.
• Technical data. Your IP address and request metadata, used for rate limiting, abuse prevention and error logs. We do not run analytics or advertising trackers.

Why we use it

To run the product you signed up for: grading your answers, scheduling your reviews, showing your progress, and billing Pro subscriptions. The legal basis is performance of our contract with you, and our legitimate interest in keeping the service secure and abuse-free. We do not sell your data or use it for advertising.

Who processes it

We use a small number of providers, each for one job. They act on our instructions and cannot use your data for their own purposes.

• Supabase (authentication, database, file storage). Holds your account, study data, avatar and in-flight recordings.
• netcup (hosting, Austria). Runs the server that serves this app and grades your recordings. Audio is held in memory only while a grade is computed.
• Microsoft Azure (speech services). Pronunciation assessment sends your recording to Azure Speech in the United States to produce a score; Microsoft does not retain the audio. Azure also generates the spoken audio for cards from their text.
• Stripe (payments). Processes Pro subscriptions and stores your card details under its own privacy policy.
• DeepSeek (AI deck generation). When you ask the app to generate a deck, we send the topic and example text you typed to DeepSeek, a provider based in China. We never send your voice, email, name or study history there.
• Resend (email, EU region). Sends sign-up confirmations and password resets.
• Upstash (job queue). Carries short-lived job references while a recording is being graded; no audio or personal details pass through it.

Some of these providers operate outside the UK and EEA. Where they do, transfers are covered by the provider's standard contractual clauses or an adequacy decision.

How long we keep it

• Voice recordings: until grading completes, and at most 48 hours.
• Account and study data: for as long as your account exists.
• Error logs and rate-limit counters: a few days, then discarded.

Deleting your account

Open Settings in the app and choose Delete account. This permanently removes your account, decks, study history, recordings and avatar, and cancels any Pro subscription. It takes effect immediately and cannot be undone. If you have lost access to your account, email us and we will verify and delete it for you.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to restrict it. Email hello@flashlingo.app and we will respond within a month. You can also complain to the Information Commissioner's Office at ico.org.uk.

Cookies and local storage

The app stores your sign-in session and your theme preference in your browser. That is all. No third-party cookies, no tracking pixels.

Children

FlashLingo is not directed at children under 13, and we do not knowingly collect their data.

Changes

If this policy changes in a way that matters, we will update the date at the top and, for significant changes, tell you in the app or by email. See also our terms of service.