Privacy Policy

Flashside is an app and website built and operated by CQUELLE GmbH, Erdkampsweg 70a, 22335 Hamburg, Germany ("we"). This policy explains what personal data we process when you use Flashside, why, and what your rights are.

Flashside is offline-first: your collections, cards and study history live on your device. We only receive data when you choose to create an account, synchronise, share a collection, send feedback, or when the app reports an error.

Controller

CQUELLE GmbH, Erdkampsweg 70a, 22335 Hamburg, Germany. Managing director: Eugen Yamamoto. Email: welcome@cquelle.com.

What we process and why

Account data

If you create an account we process your email address and a hashed password in order to provide the account, synchronisation and sharing (Art. 6(1)(b) GDPR, performance of a contract). You can delete your account at any time from the app or the website; this removes your account data and the collections stored with it.

Content you synchronise or share

Collections, cards, pictures and audio clips you synchronise with your account or share with others are stored on our servers so that they can be delivered to your other devices and to the people you share them with (Art. 6(1)(b) GDPR). Content you keep only on your device never leaves it.

Anonymous device identifier

The app creates a random identifier on installation so that shared collections and feedback can be attributed to a device without an account. It is not linked to your name or email address unless you sign in (Art. 6(1)(f) GDPR, our legitimate interest in operating the Service without requiring an account).

App version and platform

The app tells our servers which platform (iOS, Android or web) and which version it is running, together with the date it was last active. We use this to keep older versions working, to decide which versions we still need to support, and to see which platforms our learners use (Art. 6(1)(f) GDPR, our legitimate interest in maintaining the Service). These figures are only ever viewed in aggregate.

Consent records

For a signed-in account we record which version of the Terms of Service and this Privacy Policy you accepted and when, and your choice about marketing emails together with the date of the choice and the client it was made on. We keep these records to be able to demonstrate that consent was given (Art. 6(1)(c) and Art. 7(1) GDPR).

Emails

Service emails - registration confirmation, password reset, security notices and notice of material changes to the terms or this policy - are sent to your account's email address because they are needed to operate the Service (Art. 6(1)(b) GDPR).

Marketing emails about new features, learning tips and offers are sent only with your consent (Art. 6(1)(a) GDPR). You give or withhold it when you register or sign in, and you can change your mind at any time in the app under Account → Email preferences, in your profile on the website, or through the unsubscribe link in every marketing email. Withdrawing consent does not affect the lawfulness of processing before the withdrawal, and it never affects your use of Flashside.

Feedback

Feedback you send from the app is stored together with your account or device identifier so that we can act on it (Art. 6(1)(f) GDPR).

Log data

When an error occurs in the app, or when our servers handle a request, we may collect log data such as your device's IP address, device name, operating system version, the configuration of the app at the time, and the time and date of the request. We use it to diagnose faults and to keep the Service secure (Art. 6(1)(f) GDPR).

Service providers

We use hosting and email delivery providers acting on our instructions and under data processing agreements. They receive only the data needed to perform their task and may not use it for any other purpose. Where a provider processes data outside the European Economic Area, the transfer is covered by the European Commission's standard contractual clauses or an adequacy decision.

reCAPTCHA

The sign-in and registration pages on the website use Google reCAPTCHA v3 to tell a person apart from an automated script. This keeps someone else from signing your address up and stops our sign-up mail being used to reach people who never asked for it (Art. 6(1)(f) GDPR). When you open one of those two pages, Google receives your IP address and information about your browser and how you interact with the page, and returns a score we use only to decide whether to accept the submission. reCAPTCHA is loaded on no other page, and not at all in the mobile app. What Google does with that data is described in the Google Privacy Policy and the Google Terms of Service.

Retention

• Account data and synchronised content: until you delete your account.
• Consent records: for as long as we need to be able to demonstrate that consent was given, and no longer than three years after the account is deleted or the consent is withdrawn.
• App version and platform: for as long as the device record exists.
• Log data: at most 90 days, unless needed to investigate a security incident.

Security

We value your trust in providing us your personal data and use commercially reasonable technical and organisational measures to protect it. Remember that no method of transmission over the internet, or method of electronic storage, is completely secure, and we cannot guarantee absolute security.

Links to other sites

Flashside may contain links to other sites. If you follow a third-party link, you will be directed to that site. These external sites are not operated by us, so we advise you to review their privacy policies. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Children's privacy

Flashside accounts are not intended for anyone under the age of 16. We do not knowingly collect personal data from children under 16. If we learn that a child under 16 has provided us with personal data, we delete it from our servers. If you are a parent or guardian and are aware that your child has provided us with personal data, please contact us.

Your rights

You have the right to access the personal data we hold about you, to have it rectified or erased, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interests. Where processing is based on consent, you may withdraw it at any time. To exercise these rights, contact us at welcome@cquelle.com. You also have the right to lodge a complaint with a supervisory authority; the authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit).

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When a change is material we announce it in the app and ask signed-in users to review and accept the new version. The current version is always available in the app and at flashside.app/privacy-policy.

Contact us

If you have any questions or suggestions about this Privacy Policy, do not hesitate to contact us.

CQUELLE GmbH
Erdkampsweg 70a
22335 Hamburg
Germany

Email: welcome@cquelle.com
Website: www.cquelle.com

Version history