Privacy policy

Flashcards Arabia (flashcardsarabia.com) is operated by Softest, based in Dubai, United Arab Emirates. We are the controller of the personal data described in this policy, which is written to meet the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).

Questions or requests about your data: privacy@flashcardsarabia.com.

You give us

• Account details: your name and email address, and a password if you choose to set one (stored only as a secure hash). If you sign in to our app with Apple, we ask Apple only for your email address, which may be a private relay address that forwards to you, and Apple also gives us an id for your Apple Account and a token, which we keep encrypted.
• Family profile (optional): the roles you add (such as Mum or Grandma), the names your child uses for them, any photos you upload, and the order you put everyone in, which we read as oldest first. For a cousin, also whether they’re a boy or a girl and whose child they are, and, once more than one of your children plays, whether each is a boy or a girl. We don’t ask for birthdays or ages.
• Messages: what you write when you email or message us.
• Schools and organisations (optional): if you register interest, your name, work email, job title and, if you give it, phone number, with your school’s or organisation’s name, country, city, how many students you have in mind, and your message. Only our team sees it.
• Set suggestions (optional): your suggestion and any details, languages and age range, and, only if you’d like a reply, your name and email address. Only our team sees it.
• Other forms (optional): what you enter when you fill in one of our forms, such as your name, email address and message. Only our team sees it.
• Notification choices (optional): whether you’ve asked for emails about new sets, and when and where you said so. In our app, if you turn on notifications on a device: a random installation ID our app creates, the notification token your device gives us, the platform and app version, and whether notifications are on.
• Emails about our sets (optional): whether you’ve asked, in our app, for emails about Flashcards Arabia and our sets, and when.
• How you heard about us (optional): after buying, you can tell us where you heard about us by choosing from a short list. We keep your answer with your order.

From other people

• Gift invitations: when our team gives someone sets as a gift, we store that person’s email address, the sets, the occasion, when the invitation expires and a note only our staff can see. The invitation link is stored only in a scrambled (hashed) form. Invitation pages are kept out of search engines, load no analytics or advertising tags and never pass their link on to other websites, and our error reports blank out invitation links.

Created when you use the service

• Orders: which sets you bought, prices, discount, order number, the email used at checkout, payment status and a link to the payment receipt. We never receive your full card number.
• Purchases in our app: if you’re signed in when you buy in our app, or sign in later on that device, Apple or Google tells us about the purchase, and later about any refund, so we can add it to your account: the product, the date and their transaction number. We give them a random code for your account, which isn’t your name or email address. They handle the payment, and we never receive your card details. Our app has its own privacy notice.
• Free access in our app: if you take it, when it started and ended, and a scrambled id for the device, so each account and each device has it only once.
• Learning progress: which cards you’ve marked “I know it” or “Still learning”, how many times each card has been seen and when it was last seen (a card counts as seen once it’s been on screen for a moment, in any mode), and where you left off in each set (the play mode, the order of the cards, the card you reached and when), so you can carry on from any device. If you’ve agreed to family cards, we keep it separately for each child who plays, so you can see what each child has seen and knows.
• Play counts: when a set is played in our player or app, we add one to that set’s count for the day, by platform, card language and play mode. The count holds nothing about who played it, and no cookie is used.
• How you found us: which ad, campaign or website brought you to our shop, and the page you landed on. It’s kept in a cookie until you close your browser and holds nothing that identifies you. When you check out, we save these campaign details with your order, with the partner website that sent you (if one did) and your country, which our network provider works out from your connection.
• Technical data: sign-in sessions (including IP address and browser type, used for security) and standard server logs.

Only with your consent

If you allow analytics or advertising cookies (see Cookies and device storage), we and our partners also collect, on our shop pages only:

• Analytics: a random id for your browser, which shop pages you visit and what you do there (such as viewing a set, trying its free preview, adding sets to your cart and checking out), the first and latest ad or link that brought you, and your IP address and browser type.
• Advertising: the ids in advertising cookies, the ad identifier added to the link you used to reach us (for example gclid or fbclid), and your IP address and browser type.
• Saved with your order: when you check out, we keep the random browser id and the first ad or link that brought you (with analytics consent), and the ad identifiers, your IP address and browser type (with advertising consent), so a purchase can be matched to the ad that led to it. We also keep which choices you had made, so we only use what you allowed.
• Your purchase, for measuring our ads: with advertising consent, a scrambled (hashed) copy of your email address, kept with our record of the purchase (the order number, what you bought and paid, and whether it was your first order). Never the address itself.

Kept on your device

Your cart, player settings (such as card language, and which child is playing when more than one plays) and the card you reached in each set are saved in your browser’s local storage. They aren’t sent to us, apart from your cart when you check out, the card you reached when you’re signed in (see “Learning progress” above), and the “Only show my family” setting, which a small cookie also sends so your library counts the same cards. Which child is playing stays in your browser as a setting, but the progress we save says which child it’s for.

• To provide what you bought — creating your account, taking payment, giving access to your sets, personalising family cards and saving progress. (Legal basis: performing our contract with you.)
• To send service emails — sign-in links, password resets and order confirmations. (Contract.)
• To tell you about new sets and suggest sets to try, only if you ask: new sets by email, or by notification in our app, and suggestions by notification only. Every email has a one-click unsubscribe, and you can turn either off any time in your account or in the app’s grown-ups area. We use these choices and device details for nothing else. (Legal basis: your consent.)
• To email you about our sets, only if you ask in our app. Every one has a one-click unsubscribe, and you can also turn them off in our app’s Grown-ups → Account. Your email address isn’t shared with anyone for this. (Legal basis: your consent.)
• To deliver gifts and offers — emailing the invitation to the person our team chose, and adding sets to a library when an invitation is accepted or an offer is used. (Our legitimate interests.)
• To keep financial records of orders, as UAE law requires. (Legal obligation.)
• To keep the service secure and prevent fraud or misuse. (Our legitimate interests.)
• To help you when you contact us. (Contract, or our legitimate interests.)
• To reply to schools and organisations, and discuss providing our sets. We don’t add you to any mailing list. (Steps you ask for before a contract, and our legitimate interests.)
• To plan new sets from your suggestions, and reply if you ask. (Our legitimate interests.)
• To answer what you send us through our forms, and act on it, for example by sending you an invitation. (Our legitimate interests.)
• To stop automated spam on our forms, a security check looks at your browser and IP address before a form is sent. (Our legitimate interests: security.)
• To see which ads and websites bring people to us — using campaign details that don’t identify you, so we know which ads work and can pay partner websites fairly. (Our legitimate interests.)
• To decide which sets to make, we count how sets are played, in totals that can’t identify anyone. (Our legitimate interests.)
• To measure and improve the shop — with Google Analytics, only if you allow analytics cookies. (Consent.)
• To measure our ads on Google, Meta (Instagram and Facebook), TikTok and Snapchat, and to help those platforms show our ads to people likely to want them, which may include you. Only if you allow advertising cookies, and you can withdraw at any time. (Consent.)
• Family photos, names and details are processed only because you choose to add them, with your consent as the child’s parent or guardian, and only to personalise your own cards. You can withdraw consent at any time in My family, which deletes them.
• Each child’s progress is kept only with your consent to family cards, and only to carry on where each child left off, to show you which cards they’ve seen and know, and to pick out the ones they’ve seen least. Removing that child, or withdrawing consent in My family, deletes it.

We don’t sell your data and there are no ads on Flashcards Arabia. Our advertising partners receive only limited data, to measure our own ads and show them on their platforms. We don’t make automated decisions about you that have legal or similarly significant effects.

We know family photos and children’s names are precious. Here is exactly how we handle them:

• You can add names and photos once you’ve confirmed your email address, so we know the account is yours. You don’t need to buy a family set first; they appear on the family sets you own.
• Before you add any names or photos, you confirm once that you’re the child’s parent or guardian and that anyone else pictured has agreed, and we keep a record of it. If you added some before we kept these records, we ask you to agree in My family.
• About a day after you agree, we email you to confirm it.
• Before upload, photos are cropped and resized in your browser and saved as a new image, which removes hidden data such as the location where the photo was taken.
• Photos are stored privately and can only be loaded by your own signed-in account. They have no public link.
• We never publish, share or sell them, we never look at your photos, and we never use them for anything else.
• Some languages have different words for an older and a younger brother, or for each kind of cousin. We use the details you give for this (whose child a cousin is, whether someone is a boy or a girl, and your list’s order, oldest first) only to choose the word on each card.
• Each child’s progress is kept separately, only under your consent to family cards. Like names and photos, it stays private to your account.
• We never send anything from My family, the player, your learning progress or your family photos to analytics or advertising companies. Their tags never load on the player, library, My family or account pages.
• You can delete any photo or name at any time, or all your family details in one step, in My family. Deleting your account deletes them too.

The service is meant for adults to use with children. Children don’t create accounts and don’t give us personal data themselves: what we keep about a child, on family cards and in their progress, is kept in a parent’s account with the parent’s consent. If you think a child has given us personal data, contact privacy@flashcardsarabia.com and we will delete it.

Cookies are small files a website keeps in your browser. We use three kinds: essential cookies, which are always on, and analytics and advertising cookies, which we only use if you say yes. Our staff and reviewers also get a few preference cookies in our admin tools, listed last.

Nothing except essential cookies is set until you choose. On our shop pages, a banner lets you accept all, reject all or choose which to allow. You can change your mind at any time with “Cookie settings”, in the footer at the bottom of our pages, or right here:

Analytics and advertising cookies are only ever used on our shop pages, never in the player, your library, My family or your account. Meta, TikTok and Snap don’t run on the sign-in and sign-up pages either.

Essential (always on)

Analytics (only with your consent)

Advertising (only with your consent)

Our staff and reviewers only (preferences)

Google, Meta, TikTok and Snap may also use related cookies of their own for the same purposes, including on their own websites’ domains. Their privacy policies explain these.

Before you choose, and if you say no

Google Tag Manager, which runs these tags, loads on our shop pages for everyone. Until you allow analytics or advertising cookies, Google’s tags set no cookies and use no ad identifiers. They only send Google basic signals, such as which shop page was viewed or that a set went into a cart or was bought, along with your IP address and browser type, which come with every web request. Google uses these signals to estimate, in total, how our shop and ads are doing. We rely on our legitimate interests for this. Meta, TikTok and Snap receive nothing unless you allow advertising cookies.

If you change your mind

If you withdraw consent in Cookie settings, we delete the analytics and advertising cookies stored on our domain, including our own attribution cookies. We can’t recall data that was already sent.

Storage on your device

Your cart, player settings and the card you reached in each set are kept in your browser’s local storage. To count each set once a day in our play counts, your browser also notes which sets it played today. The note resets each day and isn’t sent to us. Clearing your browser’s data for our site removes them from your device. When you’re signed in, where you left off is also saved to your account.

We share personal data only with the kinds of companies below, and only what each one needs.

Service providers

These companies help us run flashcardsarabia.com, under contracts that require them to protect your data and use it only on our instructions:

• Payments — our payment provider takes your card details directly and handles them under its own privacy policy.
• Apple and Google — when you buy in our app, the App Store or Google Play processes the payment and tells us about purchases and refunds, under their own privacy policies. If you sign in to our app with Apple, Apple tells us your email address and an id for your Apple Account, and when you delete your account we ask Apple to cancel our access.
• Email — our email providers send our emails, such as sign-in links, order confirmations, gift invitations and, if you ask for them, emails about new sets and about our sets, hold the emails you send us, and pass what you send through our forms to our team.
• App notifications — Apple’s push service on iPhone and iPad, and Google’s Firebase Cloud Messaging on Android, deliver our app’s notifications. They receive the device’s notification token and the notification’s text, never your name, email address or family details.
• Messaging — when you message us through a messaging app, that app processes the messages.
• Hosting — hosting for the website, our database and our file storage, including family photos, which stay private.
• Delivery and security — our domain’s DNS, delivering the website to you quickly and securely, and checking that our forms are sent by people, not bots.
• Speech — text-to-speech services make the audio for the words on our cards. They receive card words only, never anything about you or your family.
• Translation — an AI service helps us draft translations of our card words. It receives catalogue words only, never customer or child data.

Analytics and advertising partners

These companies receive data from our shop pages only, never from the player, your library, My family or your account, and only as your cookie choices allow:

• Google — Google Analytics (if you allow analytics cookies), Google Ads (if you allow advertising cookies), and Google Tag Manager, which runs these tags on our shop pages (see Cookies and device storage).
• Meta (Instagram and Facebook), TikTok and Snap (Snapchat) — only if you allow advertising cookies.

Depending on what you allow, they receive:

• which of our shop pages you view and what you do there: viewing a set, trying its free preview, adding sets to your cart and checking out;
• when you buy: the order number, what you bought, what you paid and whether it was your first order;
• your IP address and browser type;
• their cookie ids, and the ad identifier from the link you used to reach us;
• Google only, when you buy with advertising cookies allowed: a scrambled (hashed) copy of your email address, so Google Ads can match the purchase to an ad you saw (“enhanced conversions”). We never send the address itself.

They use this data to measure our ads and to show our ads on their own platforms, and they also handle it under their own privacy policies. From us, they never receive your name, your family’s names or photos, or anything from the player or your library.

We may also disclose data if the law requires it, or to protect the rights and safety of our customers or ourselves.

Our website, database and files, including family photos, are hosted in the United States. Our service providers and our analytics and advertising partners may also process data outside the UAE, in the US and elsewhere.

When data leaves the UAE, we make sure the transfer is allowed under the PDPL — for example because the destination has adequate data protection, or because contractual safeguards are in place.

We keep personal data only as long as we need it for the purposes below, and delete it when it’s no longer needed.

• Account, progress and family profile: for as long as your account is open. A child’s progress is deleted at once if you remove them from My family, change their role, or withdraw your consent to family cards.
• If your account isn’t used for 24 months, we delete your family’s names and photos and your progress. We email you a month before, and signing in to the website or the app keeps everything. Your account and the sets you’ve bought stay.
• Family photos and names you remove: they’re removed from your account at once. When you replace or delete a photo, our file storage deletes its earlier version about 7 days later, and an upload that never finished is removed after 7 days. Backups that still hold them expire within 7 days (see “Backups” below).
• When you delete your account: if you haven’t confirmed your email address yet, we first ask you to confirm it, with a link we email you, so only the person who reads that inbox can delete the account. Your family photos and names, learning progress, sessions and sign-in details are then removed from your account at once, and we remove your name and email from your account record. We also delete the identifiers saved with your orders: the random browser id, ad identifiers, IP address, browser type, country, the id of your cookie choices and the scrambled copy of your email address, and we take your address, and its hash, off our list of addresses not to email. Earlier versions of your photos are deleted about 7 days later, and backups that still hold your data expire within 7 days (see “Backups” below). The record of your consent to family cards stays, without your name or email address, as “Your consent to family cards” below says. A record that a device had free access in our app stays, without your name or email address, as “Free access in our app” below says.
• If we stop offering the service: we use your email address and order history to send you a copy of the sets you bought (see our terms), then delete your account data as if you had deleted your account.
• Orders: kept for as long as UAE tax and commercial record-keeping rules require (generally at least five years), even after you delete your account. The same applies to the records of purchases in our app, and Apple’s and Google’s notices about them are kept for 2 years.
• Unpaid orders: if you start a checkout but don’t pay, the order’s email address is removed after 90 days; we keep the order itself, without it, for our counts.
• How you found us, and the attribution cookies (the visitor id and the ads or links that brought you): in your browser, for as long as the cookie table shows. The campaign details saved with an order, and your answer to “How did you hear about us?”, are kept with the order.
• Identifiers saved with an order (the random browser id, ad identifiers, IP address, browser type and the id of your cookie choices): for 90 days after you pay, or for 30 days if the checkout wasn’t paid, and never after you delete your account. Your country stays with the order’s campaign details until you delete your account. The record of your purchase for measuring our ads keeps its scrambled email address, IP address, browser type and ad identifiers for at most 30 days.
• Gift invitations: if nobody accepts one, the email address and the staff note are anonymised 90 days after the invitation expires or is withdrawn. An accepted invitation’s address is removed when that account is deleted.
• Your cookie choices: in the fc_consent cookie on your device, for 6 months (then we ask again), or until you change them or clear your browser’s data. So we can show what you chose, we also keep a record of each choice for 24 months: which kinds of cookies you allowed, when, whether you chose in the banner or in Cookie settings, and the random id from the cookie. The record holds nothing that identifies you: no IP address and no account.
• Your consent to family cards: we record when you agreed, the words you agreed to, and when you withdrew. We keep the record while your account is open and for 24 months after you delete it (without your name or email address), then delete it. Withdrawing deletes your family’s names and photos, the progress on their cards, and each child’s progress.
• Notification choices: while your account is open. We keep a record of each change while your account is open and for 24 months after you delete it, as evidence of your consent. A device we haven’t seen for 270 days, or whose notification token stops working, is deleted with its token. Records of each notification we send are deleted 12 months after it goes out.
• Free access in our app: while your account is open. When you delete your account, we keep only the scrambled device id and a date, not linked to you, for up to 24 months, so that device can’t have free access again.
• Your choice about emails about our sets: we record when you agreed, the words you agreed to, and when you stopped. We keep the record while your account is open and for 24 months after you delete it (without your name or email address), then delete it.
• Emails you send us: for up to two years after your conversation ends, unless we need them longer to resolve a dispute.
• School and organisation enquiries, set suggestions and other forms: for as long as we need them to reply to you and to follow up, and we delete them sooner if you ask.
• Email that doesn’t arrive: if an email to you bounces or you mark it as spam, we keep a note so we don’t send non-essential email to that address. 12 months after the last bounce or spam complaint, we keep only a hash of the address. A hash can still be matched to the address, so it’s pseudonymous rather than anonymous. Sign-in links and receipts still go, and a bounce stops counting once our email reaches the address again. If you delete your account, we remove your address from this list too.
• Sign-in sessions and links: sign-in sessions, with the IP address and device they record, are deleted once they expire, 30 days after you last use them, and signing out deletes that browser’s session at once. Sign-in and password-reset links are deleted a day after they expire.
• Server logs: 30 days.
• Backups: database backups are kept for 7 days; if the service’s database is ever retired, a final copy may be kept.
• Our staff and reviewers: see Reviewers and our team.

All traffic to flashcardsarabia.com is encrypted (HTTPS). Passwords are stored only as secure hashes, family photos are checked against your account every time they load, and access to our systems is limited to people who need it. No system is perfectly secure, but we take care to protect your data and will tell you and the authorities if a breach affects you, as the law requires.

Under the PDPL you can ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is wrong or incomplete;
• delete your data (subject to what we must keep by law);
• restrict or stop certain processing, or object to it;
• send your data to you or another provider in a commonly used format;
• withdraw consent you gave (for example, for family photos or cookies) at any time.

You can withdraw your cookie consent at any time in Cookie settings.

If you ask us to delete your data, we delete what we hold and stop sending anything further about you to our analytics and advertising partners. We can’t recall what was already sent to them, but you can also ask them directly, under their own privacy policies.

Many of these you can do yourself in Orders & account and My family. Otherwise, email privacy@flashcardsarabia.com. We’ll reply within 30 days. If you’re unhappy with how we handle your data, you can complain to the UAE Data Office.

Our staff, and the reviewers who check the words, recordings and pictures on our cards, sign in to our admin tools with accounts of their own. For these accounts we keep:

• their name, email address and role;
• their sign-in activity;
• an activity log of the actions taken in our admin tools;
• reviewers’ verdicts, such as whether a word or a recording is right.

We use this to run the shop and to review the quality of our catalogue. (Legal basis: our legitimate interests, and for our staff, their working relationship with us.)

Activity-log entries are deleted 24 months after they were written. If nobody accepts an invitation to join our staff or to review, the invitee’s email address is removed 90 days after the invitation expired or was withdrawn.

We’ll update the “last updated” date whenever this policy changes, and email you before any important change takes effect. If we start using new cookies that need your consent, we’ll ask you again.