Last updated: 25 September 2026
This Privacy Policy describes how SayFlash (“we”, “us”) handles information when you use the SayFlash iOS app and related support pages on sayflash.app.
Controller: Johan Leduc, operating SayFlash (contact: support@sayflash.app). We are based in the European Union. Where GDPR applies, that contact is also the point for privacy requests.
1. What SayFlash does
SayFlash helps you capture vocabulary with your voice while you study and review cards with spaced repetition. The app requires an account (Sign in with Apple or Google).
2. Information we collect
Account
- Identifiers from Sign in with Apple or Google (such as a user ID and, depending on the provider and your choices, name and email).
- Authentication session data needed to keep you signed in and to authorize API requests.
Learning content you create
- Flashcards (front/back text, language direction, related metadata).
- Review progress and scheduling data (e.g. due dates, ease factors used by spaced repetition).
- App settings tied to your account.
Voice and transcripts
- Microphone audio while you use capture (with your permission).
- Live or fallback transcripts of what you said, used to propose a card.
- A short local audio backup may be kept temporarily on device to retry transcription if needed; it is not used for advertising.
Purchases
- Subscription status for SayFlash Pro is handled by Apple through StoreKit / App Store. We receive entitlement signals (e.g. active trial or subscription), not your full payment card details.
Diagnostics
- We may process limited technical logs from our backends (timestamps, request success/failure, coarse error reasons) to keep the service reliable. We do not sell personal data.
We do not use third-party advertising trackers in the app, and we do not use your microphone audio for ads.
3. How we use information
- Provide account access, sync your cards and review state, and operate spaced repetition.
- Turn speech into text and suggest card wording/translations.
- Enforce free-tier limits and Pro entitlements.
- Respond to support requests and improve reliability/safety.
- Comply with law and protect the service against abuse.
Legal bases under GDPR typically include: performance of the contract (providing the app), legitimate interests (security, reliability, product improvement in a limited way), and consent where required (e.g. microphone access on iOS).
4. Processors and subprocessors
We use service providers who process data on our instructions:
- Supabase — authentication, database, and Edge Functions that power sync and server-side features.
- OpenAI — speech-to-text / realtime transcription and card-suggestion models, invoked via our backend (provider API keys stay on the server).
- Google — if you choose Google sign-in (identity).
- Apple — if you choose Sign in with Apple; App Store commerce; on-device permissions (microphone).
These providers may process data in the United States or other countries. Where required, we rely on appropriate transfer mechanisms offered by those providers (such as Standard Contractual Clauses).
5. Retention
- Account, cards, and review data: kept while your account remains active.
- Voice/transcripts used for a capture: processed to create the card; we do not keep microphone recordings as a long-term library for unrelated uses.
- Support emails: kept as long as needed to resolve your request and for basic records.
- After account deletion requests, we delete or anonymize personal data in our systems within a reasonable period, except where we must retain something for legal or security reasons.
6. Sharing
We do not sell your personal information. We share it only with processors listed above, with Apple for purchases/sign-in, if you ask us to (support), or if required by law.
7. Your rights (EU/EEA and similar)
Depending on where you live, you may have rights to access, correct, delete, restrict, or export your data, and to object to certain processing. To exercise these, email support@sayflash.app. You may also lodge a complaint with your local supervisory authority.
On iOS you can revoke microphone access in System Settings at any time (capture will stop working until re-enabled).
8. Children
SayFlash is not directed at children under 13 (or the minimum age required in your country). We do not knowingly collect personal data from children.
9. Changes
We may update this policy as the product evolves. We will change the “Last updated” date above and, for material changes, provide additional notice where appropriate.
10. Contact
Privacy & support: support@sayflash.app
Website: https://sayflash.app