Privacy policy — Flash Feed

Last updated: 14 October 2026

The short version

Flash Feed doesn't ask for your name, email or any account, and has no analytics or ads. Your decks, cards and progress stay on your iPhone. If your phone can't make cards itself, or you choose the server, the text of the page you're making cards from is sent to our server, turned into cards, and not stored or logged. To keep fair use fair, the app sends a random install code — not your name, your Apple ID or your device's advertising ID. Because page counts are kept against it, Apple's privacy label lists it as an identifier linked to your copy of the app. We keep a daily and monthly page count against it for up to 40 days. To check that a request really comes from the Flash Feed app, the server also keeps a public key that Apple's App Attest created for your copy of the app (for up to 60 days after you last make cards), and it holds no name or account. Our server runs on Cloudflare, which sees your IP address to deliver the request.

What stays on your device

• The text you scan or paste. Photographs of pages are read on your phone and are not kept after the cards are made. The text is stored on your phone; whether it is also sent to our server is described under How cards are made.
• The cards and decks you make or import, and your review history.
• Your streak, XP, level and badges.
• Your settings, including reminder preferences and quiet hours.
• If you use the Apple Watch app, your next cards (up to 30, with the question, the answer and the deck's name) are copied to your watch over Apple's own phone-to-watch connection, and your answers come back the same way. Nothing goes through us.

All of it lives in the app's own storage on your iPhone. Deleting the app deletes all of it, apart from two small Keychain entries that iOS keeps on that phone: this month's page count (below) and the install code (below), which stays the same if you reinstall the app on the same phone.

How cards are made

There are two ways, and the app asks you before it uses the second.

• On your iPhone, with the AI model built into it (Apple Intelligence), on an iPhone that supports it. The text never leaves the device.
• On our server, when your phone can't do it or you say yes to "Use the server". The first time, a screen explains this and asks. You can turn it off at any time in Settings, and cards you have already made keep working. Writing cards by hand needs neither.

What reaches our server — only if you use it

• The text of the page you are making cards from (read from your photo on your phone first — photos are never sent). It is passed to an AI model to write the cards and is not stored or logged by us.
• A random install code, made by the app the first time it needs the server. It isn't your name, your Apple ID or your device's advertising ID, and it contains nothing about you; because page counts are kept against it, Apple's privacy label lists it as an identifier linked to your copy of the app. We keep a count of pages made against it, per day (2 days) and per month (40 days), so that nobody can run up the bill — that is all it is used for.
• An App Attest key, so the server can tell that a request comes from the real Flash Feed app on a real iPhone rather than from a script. The private half stays in your iPhone's Secure Enclave and never leaves it; the server keeps only the public half and a counter, next to your install code, until 60 days after you last made cards. It says nothing about you and is not an account.
• Your IP address, which any request to any website reveals. Our server runs on Cloudflare (Workers and Workers AI), which handles the request on our behalf and sees it; our code doesn't read or keep it. What Cloudflare does as our provider is governed by its own terms.

Never sent: your photos, your decks and cards, your review history, your streak, your name, email or location.

Notifications

Reminders are scheduled by the app on your device. Nothing about them is sent anywhere. The app only asks for notification permission when you turn reminders on, and you can turn them off at any time in Settings.

The purchase

Flash Feed is free to use. Studying is always free, and so are importing a deck (from a file or a friend) and writing cards by hand. Making cards from a page — a photo, a PDF or pasted text — is free for one page each calendar month, however many cards it makes. Two subscriptions, monthly and annual (the annual with a 7-day free trial), remove the one-page limit. Purchases are handled by Apple: we never see your payment details, and we receive only what Apple tells us about whether a subscription is active. The app keeps a count of the pages you have turned into cards this month on your own device (in the Keychain, so that deleting the app does not reset it); that count is never sent to us (the server's own fair-use count, above, is a separate one).

Sharing

If you use "Share my streak", the app renders an image of your own numbers — streak, level, cards reviewed, best combo — and hands it to the iOS share sheet. It contains no deck names and no card text. If you share a deck's progress, the image or PDF holds counts and percentages and, unless you switch it off, the deck's name — never a card's words. If you share a deck with a friend, the file contains the deck's cards, because that is what you are sending. In every case the app hands the result to the iOS share sheet, and where it goes from there is entirely your choice.

Children

Flash Feed is made for a general audience and is rated 4+. It is not placed in the App Store's Kids Category. There is no account to create, no profile, no messaging and no way for anyone to contact you through the app, and it does not ask for your age or your name.

Whoever makes cards on our server is asked, in the app, to leave out personal details such as names, addresses and phone numbers; the text of the page is sent to be turned into cards and is not stored (see above). If you are a parent and think your child has sent us personal information, write to support@flashfeed.app and we will look into it and delete anything we hold.

Sending feedback

Send feedback in Settings works the same way as Report a problem: it opens an email addressed to us in your own mail app, with the app version, the iOS version, your phone model and your language and region setting filled in, and nothing from your decks. Nothing is sent unless you press send.

Reporting a problem with a card

Report a problem on a card opens an email to us in your own mail app, with the card's question, answer, source quote and deck name filled in so we can see what you saw, and a line with the app version, the iOS version and your language and region setting. Nothing is sent until you press send, you can edit or delete any of it first, and what we receive is what you send, together with your email address.

Who is responsible, and your rights

Flash Feed is published by Etkin Ciftci, Istanbul, Türkiye, as an individual developer (not a company). That person is responsible (the "controller") for the data described in this policy. Write to support@flashfeed.app.

Why the data may be used (the legal basis). The text of a page is used to do what you asked: turn it into cards. The install code, its page counts and the App Attest key are used to keep the service available and its cost under control, which is our legitimate interest, and they are kept only as long as that needs (above).

Your rights. Under the GDPR (the EU and the UK), Türkiye's data-protection law (KVKK) and Brazil's LGPD you may ask what we hold about you, ask us to correct or delete it, and object to its use. Your decks and progress are only on your phone, where you can delete them yourself. The install code is a random number that cannot be tied to a person, so our server cannot look up one person's data; it, and the page counts under it, expire by themselves (page counts after at most 40 days, the App Attest key 60 days after you last make cards). Write to support@flashfeed.app with any request, and we will answer it.

Where it is processed. Our server runs on Cloudflare (Workers and Workers AI), which may handle a request in a data centre outside your country, including outside the EU, the EEA and the UK. Cloudflare's own data-processing terms, which include standard contractual clauses for such transfers, apply to that.

Complaints. You may complain to your data-protection authority: in the EU and EEA, the authority of your country; in the UK, the Information Commissioner's Office; in Türkiye, the Personal Data Protection Authority (KVKK); in Brazil, the ANPD.

Changes

If a future version sends more off the device than is described above, this policy will be updated and the app will ask before doing it.

Contact

Etkin Ciftci, Istanbul. Write to support@flashfeed.app.