Privacy notice

Flashcards Arabia is run by Softest, based in Dubai, United Arab Emirates. We’re the controller of the personal data described here, under the UAE’s data protection law (Federal Decree-Law No. 45 of 2021, the PDPL) and any other data protection law that applies to you. Questions or requests about your data: privacy@flashcardsarabia.com.

The app shows no ads and contains no third-party analytics, advertising or tracking tools. Nothing you or your child do in the app is sent to advertising or analytics companies, and we don’t sell data. We count how often each set is played, in daily totals that hold nothing about who played it.

• Using the app without an account: the app sends us no name or email address, and no device identifier that we keep.
• Error reports: when something goes wrong, the app sends us a report of the problem, with the app’s version and the type of device. The report holds nothing that identifies you or your child. You can switch error reports off in Grown-ups → Help & legal → Error reports.
• Technical data: our servers log each request the app makes, for security. The log includes the IP address, the app’s version and the type of device.
• Purchases: Google tells us about each purchase you make in the app, so we can unlock it: the product, the date and Google’s transaction number. Google handles the payment, and we never receive your card details. If you buy without an account, that’s all we hold about the purchase.
• If you sign in:
  • your email address;
  • your name, if you’ve given one;
  • a password, if you set one, stored only as a secure hash;
  • your sign-in sessions, with the IP address and type of device they record, for security.

  If you turn on notifications, the app also sends us a random installation ID, the notification token, the platform and app version, which we keep to send you notifications until you turn them off.

• Family cards (optional): the roles you add, the names your child uses for them, any photos, and the order you put everyone in, which we read as oldest first. For a cousin, also whether they’re a boy or a girl and whose child they are, and, once more than one of your children plays, whether each is a boy or a girl. We don’t ask for birthdays or ages. You add them only after confirming that you’re the child’s parent or guardian and that anyone else pictured has agreed. We keep a record of that confirmation.
• Progress: if you’re signed in, which cards are marked “I know it” or “Still learning”, how many times each card has been seen and when it was last seen (a card counts as seen once it’s been on screen for a moment, in any mode), and where you left off in each set (the play mode, the order of the cards, the card you reached and when), so you can carry on from another device. If you’ve agreed to family cards, we keep it separately for each child who plays, so you can see each child’s cards in Grown-ups → Progress.
• Notifications (optional): if you turn them on in Grown-ups, a random installation ID the app creates, the notification token, the platform and app version, and whether notifications are on, and whether you’ve asked for emails about new sets.
• Messages: what you write when you email or message us.

• For everyone:
  • the sets you download, with their pictures and audio;
  • your settings;
  • your child’s progress, including how many times each card has been seen, and where each set was left off;
  • which sets were played today, and plays waiting to be counted, with nothing about who played them.
• If you sign in, also:
  • your sign-in, in the device’s secure storage;
  • your family’s names, photos and details, for the family cards. The photos are left out of device backups.
  • which child is playing, chosen with the circle on the home screen, and each child’s progress;
• Signing out removes your sign-in, your family’s names, photos and details, which child is playing and each child’s progress from the device at once. Progress not yet saved to your account stays for up to 90 days, in case you sign in again.
• Deleting your account removes everything tied to it from the device.
• Age range: where the law requires it, the app asks Google for the age range of the device’s account. The answer is used on the device only, for that check. We never receive or store it.

• To provide the app: downloading and playing sets, unlocking and restoring purchases, signing in, saving progress to your account. (Legal basis: our contract with you.)
• To keep the app working and secure, and to fix errors. (Our legitimate interests.)
• To decide which sets to make, we count how sets are played, in totals that can’t identify anyone. (Our legitimate interests.)
• To help you when you contact us. (Contract, or our legitimate interests.)
• To keep financial records of purchases, as UAE law requires. (Legal obligation.)
• Family names, photos and details, only with your consent, and only to personalise your own cards. We never publish or share them, and never use them for anything else. You can withdraw at any time in Grown-ups → Family, which deletes them, and the progress on their cards.
• Each child’s progress, only with your consent to family cards, and only to carry on where each child left off, to show you which cards they’ve seen and know, and to pick out the ones they’ve seen least. We never share it or use it for advertising. Removing that child, or withdrawing in Grown-ups → Family, deletes it.
• To tell you about new sets and suggest sets to try, only if you ask: new sets by email, or by notification in our app, and suggestions by notification only. Every email has a one-click unsubscribe, and you can turn either off any time in your account or in the app’s grown-ups area. We use these choices and device details for nothing else. (Legal basis: your consent.)

• Google: Google Play processes your purchases and tells us about them, refunds included. If you’re signed in when you buy, or sign in later on the same device, we give Google a random code for your account, so the purchase can be added to it. The code isn’t your name or your email address.
• Our service providers, under contracts that require them to protect your data and use it only on our instructions:
  • hosting: our servers, database and files, family photos included, which stay private;
  • delivery and security: delivering the app’s content quickly and safely;
  • email: our emails with you, sign-in codes included;
  • app notifications: Google’s Firebase Cloud Messaging on Android delivers our app’s notifications. It receives the device’s notification token and the notification’s text, never your name, email address or family details.

We share nothing with anyone else unless the law requires it.

Our servers, database and files, family photos included, are hosted in the United States. Our service providers may also process data outside the UAE. When data moves between countries, we make sure that’s allowed by the data protection law that applies, for example because contractual safeguards are in place.

We keep personal data only as long as we need it for the purposes below, and delete it when it’s no longer needed. For data about your child, those purposes are showing your family cards, keeping your child’s place, showing you which cards each child has seen and knows, and picking out the ones they’ve seen least, and nothing else.

• Error reports and server logs: 30 days.
• Your account, family and progress: while your account is open. Deleting your account deletes them at once.
  • A child’s progress is deleted at once if you remove them, change their role, or withdraw your consent to family cards.
  • Earlier versions of family photos are deleted about 7 days later.
  • Backups that still hold any of it expire within 7 days.
• If your account isn’t used for 24 months, we delete your family’s names and photos and your progress. We email you a month before, and signing in keeps everything. Your account and the sets you’ve bought stay.
• Sign-in sessions: deleted once they expire, 30 days after you last use them.
• Your consent to family cards: we record when you agreed, the words you agreed to, and when you withdrew. We keep the record while your account is open and for 24 months after you delete it (without your name or email address), then delete it.
• Notification choices: while your account is open. We keep a record of each change while your account is open and for 24 months after you delete it, as evidence of your consent. A device we haven’t seen for 270 days, or whose notification token stops working, is deleted with its token. Records of each notification we send are deleted 12 months after it goes out.
• Purchase records: for as long as UAE tax and record-keeping rules require (generally at least five years), even after you delete your account.
• Google’s notices about purchases and refunds: 2 years.
• Emails you send us: up to two years after your conversation ends, unless we need them longer to resolve a dispute.

• Everything the app sends to our servers is encrypted.
• Family photos are checked against your account every time they load.
• Access to our systems is limited to people who need it.
• If a breach affects you, we’ll tell you and the authorities, as the law requires.

The app is made for young children to use with a grown-up. Buying, signing in, settings and help sit behind a grown-ups’ check. Children don’t create accounts, and the app never asks them for personal data. Notifications are for grown-ups: only a grown-up can turn them on, behind the grown-ups’ check, and they never speak to children or ask them to buy.

Family names, photos and details are added by a parent, with their recorded consent, and each child’s progress is kept only under that consent. About a day after you agree, we email you to confirm it.

What our servers see: like every internet service, our servers receive the device’s IP address with each request the app makes. We use it only to deliver the app’s content and keep the service secure, keep it in our logs for 30 days, and never use it to identify or contact anyone, build a profile, or for advertising.

As a parent, you can:

• see your family’s names, photos and details at any time in Grown-ups → Family, and each child’s progress in Grown-ups → Progress;
• have your child’s data deleted: remove your child, or withdraw, in Grown-ups → Family, delete your account, or email privacy@flashcardsarabia.com;
• stop us collecting more: withdrawing stops family cards and each child’s progress, and you can use the app without an account.

You can ask us:

• for a copy of your data, including in a commonly used format;
• to correct it or delete it;
• to restrict or stop some uses of it, or object to them.

You can also withdraw any consent you gave, at any time.

• To delete your account in the app: Grown-ups → Account → Delete account.
• Otherwise, email privacy@flashcardsarabia.com. We’ll reply within 30 days.

If you’re unhappy with how we handle your data, you can complain to the UAE Data Office, or to the data protection authority where you live.

When this notice changes, we change the date at the top.