Privacy policy

What Flashcard Factory does with your personal data, why, and what you can ask of us. We collect what the service needs to work and nothing more: there is no advertising, and we measure visits with Google Analytics, which you can turn off at any time (see section 8).

1. Controller

AnemoLabs GbR, Robert Kelm & Finn Glück
Fabriciusstraße 30, 10589 Berlin, Germany
Email: info@anemolabs.de

We have not appointed a data protection officer, as we are not required to.

2. Visiting the website

Each time a page is requested, our server records the IP address, the date and time, the requested address, the HTTP status and the browser's user-agent string in its log. We need this to deliver the pages, to keep the service secure and to find faults. Logs are kept only as long as that requires and are not combined with other data. IP addresses are also counted briefly in memory to limit repeated sign-in and email attempts.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a secure, working service.

3. Your account

To use Flashcard Factory you need an account. We store your username, your email address, your password (only as a salted hash, never in plain text), the invite code you signed up with, and your settings. We send you email only to confirm your address and to reset your password.

Legal basis: Art. 6(1)(b) GDPR — providing the service you signed up for.

4. Your content

We store the slide PDFs you upload, the images rendered from them, the flashcards you and the AI write, and the decks you export. They are visible only to you and to the people you explicitly share a project with. Records of AI usage — which model, how many tokens, what it cost — are kept so your usage and any budget can be shown to you.

Cards you delete stay in the trash for 14 days and are then removed. Exported .apkg files are deleted after 7 days. When you delete your account, your projects and everything in them are deleted with it. Deleted data may survive in our backups until they are rotated out.

Lecture slides may contain personal data of third parties (for example a lecturer's name). Please upload only material you are entitled to use.

Legal basis: Art. 6(1)(b) GDPR.

5. AI providers

When you ask Flashcard Factory to write or improve cards, the text of the slides concerned — and for some features an image of the slide — is sent to the provider of the AI model you have chosen, together with your instruction. Depending on that choice this is Google (Gemini), OpenAI or Anthropic. Your name and email address are not sent. Nothing is sent until you start an AI action yourself.

These providers may process data in the United States. Transfers take place on the basis of the EU–US Data Privacy Framework or the European Commission's standard contractual clauses (Art. 45 and 46 GDPR). We use the providers' paid API access, under which, according to their terms, submitted data is not used to train their models.

Legal basis: Art. 6(1)(b) GDPR — the AI features are part of the service you request.

6. Hosting and email

The service runs on servers rented from a hosting provider, and email is delivered through an email provider. Both process data only on our instructions, under a data processing agreement (Art. 28 GDPR).

7. Content delivery networks

Our pages load script libraries from jsDelivr (cdn.jsdelivr.net) and the Tailwind CSS CDN (cdn.tailwindcss.com). Fonts are served from our own server. When your browser fetches these files the provider receives your IP address and the usual browser information; it may process them outside the EU. They are used so the pages display and work correctly.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a working, consistently displayed site.

8. Cookies, local storage and analytics

We set only cookies that the service needs to function:

• sessionid — keeps you signed in;
• csrftoken — protects your forms against cross-site request forgery;
• fcf_ws — remembers the deck and card you last had open in the workspace.
• fcf_consent — remembers for one year whether Google Analytics is on or turned off, so we do not ask on every page.

Your browser's local storage additionally keeps display preferences, such as pane sizes and zoom. None of these are used for tracking, and none are shared with third parties. As they are strictly necessary, no consent is required (§ 25(2) no. 2 TDDDG).

Google Analytics. We use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, from your first visit until you turn it off under Cookie settings. It sets cookies (_ga and _ga_…, kept for up to two years) to recognise your browser on later visits, and sends Google information about how you use our pages: which pages you open and for how long, the page you came from, your browser, device and screen size, and an approximate location derived from your IP address. Google Analytics 4 does not store IP addresses. Google signals and advertising features are switched off. Google deletes the data after the retention period set for our property (two months). Google may process the data on servers in the USA; Google LLC is certified under the EU–US Data Privacy Framework, which the European Commission has found to provide adequate protection (Art. 45 GDPR).

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in knowing how the site is used. You can object at any time (Art. 21 GDPR) by turning it off under Cookie settings — also at the foot of the public pages and in the account menu. We then delete the Google Analytics cookies on our domain.

9. Your rights

You have the right to

• access the personal data we hold about you (Art. 15 GDPR);
• have it corrected (Art. 16) or erased (Art. 17);
• restrict its processing (Art. 18);
• receive it in a portable format (Art. 20);
• object to processing based on our legitimate interests (Art. 21).

Write to us at info@anemolabs.de. You can also delete your account yourself on your account page at any time.

You may also lodge a complaint with a supervisory authority, for example the one responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.

10. Changes

We will update this policy when the service changes. The current version is always available on this page.