Legal

Privacy policy

Last updated: August 31, 2026

This policy describes how OCTO Flashcards (“the app,” “we,” “us”) handles information when you use the OCTO Flashcards app and this website. It is a practical description of current product behavior, not legal advice.

Who we are

OCTO Flashcards is an independent study app for creating handwritten or drawn flashcards, organizing them into folders and sets, and reviewing them in study sessions. This website hosts product information, this privacy policy, and the terms of use.

Questions: support@octoflashcards.com.

What we collect

Account data

To create and sign in to an account, we collect:

• Email address
• Password, if you sign up with email (stored hashed by our auth provider; we do not see your password in plaintext)
• Optional display name
• If you sign in with Google or Apple: the identity token from that provider, plus any name and email the provider shares with us (Apple may give a private relay address instead of your personal email)
• Sign-in metadata such as last sign-in time and whether your email is confirmed

Email sign-up requires you to confirm your address before you can use the app.

Study content you create

We store the content needed to sync your library across devices:

• Folder and set names, highlight colors, and archive status
• Flashcards, including handwritten or drawn sides (Apple Pencil / PencilKit on iPad, or drawing strokes on other platforms), any text you add on a card, and preview images
• Study progress for each card (unseen, learning, or mastered, plus last reviewed time)

Cards and collections are private to your account. The app does not currently offer sharing, public links, or collaboration.

Product analytics (app only)

The app uses PostHog (US Cloud) so we can understand how the product is used and fix problems. After you sign in, we associate analytics with your account ID and send your email and display name as person properties.

Events we record include:

• Account actions: sign in, sign up, password reset, log out, display name edits, and taps on settings options
• Collection actions: creating, editing, opening, sorting, filtering, refreshing, and deleting (archiving) folders or sets, including IDs, highlight color, and name length — not the name itself on these events
• Flashcard actions: creating, editing, deleting, filtering, view toggles, and drawing actions such as switching or clearing a side (not the drawing itself)
• Study session activity: starting, flipping cards, marking learning/mastered, and ending a session, including counts and statuses
• Screens you open, including route parameters. Edit screens put folder or set names in the URL, so those titles can appear in analytics
• Device and app metadata that the PostHog SDK typically attaches (such as app version and device/OS information)
• Error messages from failed actions (for example, a failed save)

We do not send to PostHog:

• Passwords or authentication tokens
• Handwriting, drawings, or card preview images
• Search query text (only that a search ended or was cleared, and the query length)

Email and password fields are marked so they are excluded from PostHog capture. Signing out resets the analytics identity on that device.

This marketing site does not run PostHog or another analytics product.

On your device

The app keeps some data locally so it can stay signed in and recover work in progress, including session tokens, in-progress card drafts, and editor preferences such as pen color.

This website

The site is hosted on GitHub Pages, which may log standard request data such as IP address, browser type, and pages requested as part of hosting.

How we use it

We use this information to:

• Create and secure your account, including email verification and password reset
• Store, sync, and display your folders, sets, cards, and study progress
• Understand product usage and improve the app
• Respond if you email support

We do not sell your personal information. We do not show ads in the app.

Who processes it

We use other companies to run the service. They process data on our behalf according to their own policies:

• Supabase — accounts, database, and private file storage for card drawings and previews
• PostHog — product analytics (US Cloud)
• Google — if you choose Sign in with Google
• Apple — if you choose Sign in with Apple, and as the App Store distributor
• GitHub Pages — hosting this website

Retention and deletion

We keep account and flashcard data while your account exists. Signing out clears the local session; it does not delete your library on our servers.

Deleting a folder or set in the app currently archives it rather than permanently erasing it. Deleting an individual flashcard removes it from your library.

You can delete your account from Settings. That permanently deletes your user account (email, sign-in credentials, and display name). You will not be able to sign back in to that account. Your folders and sets are archived rather than permanently erased, along with the flashcards in them — the same archive behavior as deleting a folder or set while signed in. If you cannot use the app, email support@octoflashcards.com from the address on the account and we will delete the account the same way. Analytics records already sent to PostHog may remain until those systems’ normal retention cycles complete.

There is currently no in-app export of your data.

Children

The app is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact support@octoflashcards.com and we will delete it.

Changes

If this policy changes in a material way, we will update the date above and post the new version at this URL.