Privacy Policy

Publisher: Alireza Farhadizadeh · Contact: [email protected]

1. Using the app without an account

You can use Swedish Flashcards entirely as a guest. In guest mode everything — your words, review progress, settings and game scores — is stored only on your device and is never transmitted anywhere. Uninstalling the app deletes it.

2. What is collected if you create an account

Signing in is optional and enables cloud backup and multi-device sync.

Account details

• Email address (or your Google account identifier, if you sign in with Google)
• Display name and username you choose
• The built-in avatar you pick (a choice from a fixed set, not an uploaded image)

Your learning content

• Swedish words and their translations that you save
• Topic tags, CEFR level, part of speech, and any book or chapter you record
• Review progress: which box a word is in, when it is next due, and whether you marked it as a favorite
• Learning stats: your points total, current and best streak, and your daily-goal choice

Friends features, if you use them

• Connections between your account and other users you add
• Pre-written phrase and emoji messages you send. These are sent as codes from a fixed built-in list, not as free text — the app has no free-text messaging.
• A history of when friendships were accepted or removed

Playing online, if you use it

The app can show your friends a small indicator while you have it open, and lets you play a live Memory game against a friend, against a stranger from a public pool, or against Ronicka. If you use these features we also store:

• When you last had the app open — a timestamp refreshed about once a minute while the app is in the foreground. It is shown only to friends you have accepted, and only while the “Show when I'm online” switch in Settings is on. Turning it off hides yours and hides theirs from you.
• Games you play — that two accounts played each other, when, every tile that was turned, the scores and the winner. Games against friends are kept as the record between you and shown to both of you; games from the pool are kept but never linked to a name.
• The pool — while you wait in the public pool, other signed-in users see only a name you picked from a fixed built-in list and your built-in avatar. Your display name, username, email and account are never shown to a stranger, and nobody can find your account from a pool game. You can mark a player as someone you never want to be matched with again; that choice is stored against your account.

The pool never shows anything you typed. There is still no free-text messaging anywhere in the app.

Notifications

Your reminder time preference. Reminders are generated on your device; no notification content is sent to a server.

3. Your camera and scanned photos

The app uses your camera so you can photograph Swedish text and turn it into flashcards.

Text recognition runs entirely on your device, using Google's ML Kit on-device text recognition. Photos you scan are not uploaded, not stored on any server, and not retained by the app after the text has been read from them. Only the words you then choose to save are kept.

Camera access is used solely for this. The app does not access your photo library except when you deliberately pick a picture to scan; that picture is read on your device in the same way and is not uploaded.

4. Third parties that receive data

The app is deliberately built with very few external dependencies. There is no advertising SDK and no analytics SDK. The one diagnostic service, Firebase Crashlytics, is described below.

• Supabase — hosts the database, authentication and file storage that make sync work. Your account details and learning content are stored there. The project is hosted in the EU (Frankfurt).
• MyMemory Translated — used to look up translations. When an online lookup happens, the word being looked up is sent to that service. Your identity, email and account are not sent with it. Please note that MyMemory contributes submitted text to a shared, publicly searchable translation memory, so avoid looking up text you consider private. The app also has an offline dictionary and does not need this service to function.
• Google Play Services / ML Kit — text recognition runs locally, but Google may collect standard diagnostic information about the ML Kit component itself, governed by Google's Privacy Policy.
• Firebase Crashlytics — if the app crashes, a report is sent to Google's Crashlytics service so the crash can be found and fixed. The report contains the technical details of the failure — where in the code it happened, your device model, and the Android version — along with an identifier for the app installation. It does not contain your name, email address, saved words or anything you have typed. Governed by Firebase's privacy documentation.
• Google Play Billing — the app contains no purchases today. If key packs are sold in future, payment is processed by Google Play: we never receive or store your card or payment details, and the app receives only a purchase token, checked against Google's servers.

5. Avatars are a fixed set, not your photos

You cannot upload a profile picture. The app offers a set of built-in avatars and stores only which one you chose — a short text label, not an image. Friends see that same built-in avatar. No photograph of you is uploaded, stored or shared at any point.

6. Why this data is processed (GDPR legal bases)

For users in the EU/EEA and the UK:

• Performance of a contract — account details, saved words and sync. Without them there is no account or backup.
• Consent — camera access, notifications, and the friends features. All optional, all revocable.
• Legitimate interests — keeping the service secure and preventing abuse, and receiving crash reports so faults can be fixed.
• Legal obligation — retaining any purchase and tax records where required.

7. How long data is kept

• Guest data — on your device only, until you uninstall or delete it.
• Account data — kept while your account exists.
• After you delete your account — your profile, words, tags, friendships, online indicator, game records and pool entries are permanently deleted. This is immediate and not recoverable. See Delete your account.
• Purchase records — retained as long as tax and accounting law requires.

8. Your rights

• Access and export your data. Everything you add is visible in the app. For a copy of the data held in your account, in a standard file format, email [email protected].
• Correct it. Words, translations, tags and profile details are all editable in the app.
• Delete your account and all associated data, from within the app — see Delete your account.
• Withdraw consent — revoke camera or notification permission in Android settings, or remove friends.
• Object, restrict, or request portability under GDPR.
• Complain to a supervisory authority. In Sweden that is IMY.

9. Security

Data in transit is encrypted with HTTPS/TLS. Database access is protected by row-level security so one account cannot read another's words, tags or profile details. Passwords are handled by Supabase Auth and are never visible to the app or its developer.

No system is perfectly secure, and this is an independently developed app. It is not intended for confidential or sensitive information.

10. Children

The app is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has created an account, contact [email protected] and it will be removed.

11. International transfers

Data is stored in the EU. Some third parties named in section 4 may process data outside the EU/EEA under appropriate safeguards such as the EU Standard Contractual Clauses.

12. Changes

If this policy changes materially, the "Last updated" date will change and, for significant changes, notice will be given in the app before the change takes effect.

13. Contact

Questions, requests or complaints: [email protected]