Thank you for choosing Flashcards AI Study - Moreo (the "App"). On a device the App may appear under the shorter name "Flashcards". The application id is com.ohmyapp.cards. This Privacy Policy describes how ULADZISLAU ZINCHANKA ("We," "Us," or "Our") collects, uses, and discloses information when You use the App on the Apple App Store or Google Play, and explains Your privacy rights. By using the App, You agree to this Privacy Policy. Our Terms of Use govern use of the Service.
Privacy at a glance. Decks, cards, card images, and study progress stay on Your Device unless You use an AI generation feature. AI generation sends the text needed to create cards (a topic, a YouTube transcript, or text extracted on the Device) to Our Firebase Cloud Functions, which call OpenAI. Photos and document files used for AI are read on the Device. We do not upload those photo or document files. We also use an anonymous Firebase user id for AI quotas, Mixpanel for product analytics, RevenueCat together with Apple or Google Play for purchases, Firebase for authentication, Cloud Functions, Storage, Crashlytics, and Remote Config, and optional local study reminders. We do not use an advertising network. We do not show Apple's App Tracking Transparency prompt. There is no email or password sign-up.
The App may ask for camera access, and may open the system photo picker or file picker, so You can:
The features We ship do not record the microphone and do not upload microphone audio. On iOS a microphone usage description may still appear because of audio libraries included in the build. On Android the App does not ask for a recording feature.
Stored on Your Device, and not uploaded as part of ordinary study:
If device backup is on, local App data may be included in an encrypted backup managed by the platform, such as iCloud Backup or Android backup to a Google account. We cannot read those backups. Uninstalling the App deletes Study Content from that Device. A platform backup may still hold an older copy under that platform's own rules.
We do not ask You to register with a name, email, or password. If You email dev.ohmyapp@gmail.com, We receive the address You write from, the message, and any attachment, and We use them to answer and to keep a record of the request.
When the App needs to call a Cloud Function, it signs in anonymously with Firebase Authentication and receives a random user id (a UID). There is no sign-up screen, no password, and the UID is not Your name or email. We use it to authorize those calls and to store an AI quota record in Cloud Firestore. That record is counters and dates (how many generations have been used, and when they reset). It does not contain Your card text.
This is not an account You create. You can still ask Us to delete the UID and the quota record. See Section 7.
Premium is sold as an auto-renewing subscription. The plan, price, period, and any trial are shown in the App at checkout. We do not list them in this Policy because they change. There is no one-time "lifetime" product.
The Store charges You. We do not receive Your card number, bank number, or Google or Apple account password. Apple or Google processes the payment under that company's terms and privacy policy.
RevenueCat processes purchase records for Us. Depending on the Store, that includes:
The App does not turn on RevenueCat's optional collection of advertising identifiers. We do not use the iOS Identifier for Advertisers (IDFA) or the Android advertising ID to advertise, or to track You across other companies' apps and websites.
When You generate cards, the App sends a request to Firebase Cloud Functions in the United States (us-central1). The function sends the prompt to OpenAI and returns the generated cards to the Device. The cards are then stored locally. We do not use Your Study Content to train a model of Our own.
A request includes only what that mode needs:
Cloud Logging for those functions stores technical details of the call (formats, counts, language, tier, the anonymous UID, video id, transcript length, and, for a photo or file, a short preview of the extracted text and the optional file name). The full topic, transcript, or extracted text is in the request that is sent to OpenAI. We do not copy that full text into the Firestore quota record. OpenAI processes the prompt under OpenAI's terms and privacy policy, including whatever retention OpenAI applies to API abuse monitoring.
When the App starts, it starts Mixpanel in JavaScript mode. Automatic native tracking is off. iOS and Android use the same Mixpanel project. Events can include:
Mixpanel receives the request from Your Device, so Mixpanel can see Your IP address. Mixpanel may estimate a country or region from that IP address. We use this for product analytics. We do not use Mixpanel for cross-app advertising, and We do not sell Usage Data.
The App loads feature flags and limits from Firebase Remote Config (for example free deck, card, and AI caps, YouTube and source features, and paywall behavior). Firebase may receive an installation id, app version, and locale. Remote Config does not receive Your card text or images. We do not use Firebase Analytics as Our product-analytics tool. Product analytics are the Mixpanel events in Section 2.2.6.
If the App crashes, Crashlytics may receive a stack trace, device and app metadata (such as OS version, device model, and app version), and a crash identifier, so We can fix bugs. Crash reports are not a copy of Your decks.
Downloading a predefined deck fetches public deck content and images from Firebase. The request can show which library deck You opened. Your study progress on that deck stays on the Device.
If You allow notifications, the App schedules local reminders on the Device. The schedule stays on the Device. Reminder text can include how many cards are due, and a later reminder can include the name of a deck You created. We do not register a push token with Our servers, and We do not run remote marketing pushes.
On Android, reminders use a notification channel named for study reminders. On Android 13 and later, the system asks for notification permission before those reminders can appear. You can turn reminders off in the App and in system settings. Turning them off does not cancel a subscription.
Before some network features, the App may request a public address that returns an empty response (currently a generate_204 address operated by Google) to see if the Device is online. We use that request only as a yes-or-no connectivity check.
We do not sell Study Content. Text You submit for AI generation is disclosed to Google Firebase and to OpenAI so the function can return cards.
| Provider | Purpose | Data | Privacy policy |
|---|---|---|---|
| Google LLC - Firebase Authentication, Cloud Functions, Firestore, Storage, Crashlytics, Remote Config | Anonymous id, AI proxy, quota counters, predefined decks, crash reports, feature flags | Anonymous UID; AI request payloads; quota counters; crash diagnostics; installation id, app version, and locale; library downloads | firebase.google.com/support/privacy |
| OpenAI (through Firebase Functions) | AI flashcard generation | Topic, transcript, or extracted text, and generation settings | openai.com/policies/privacy-policy |
| Mixpanel, Inc. | Pseudonymous product analytics | Distinct id; event names and properties (Section 2.2.6); technical data; IP address and any approximate location Mixpanel derives from it | mixpanel.com/legal/privacy-policy |
| RevenueCat, Inc. | Purchase and entitlement status | Anonymous app-user id; product id; receipt or purchase token; order id; trial, renewal, and expiry status | revenuecat.com/privacy |
| Apple Inc. (App Store), if You use the iOS App | Distribution, payment, and system notifications | Payment and purchase data handled by Apple; local notifications on the Device | apple.com/legal/privacy |
| Google LLC (Google Play), if You use the Android App | Distribution, Google Play Billing, and system notifications | Payment and purchase data handled by Google, including the purchase token and order id; local notifications on the Device | policies.google.com/privacy |
| YouTube (Google), when You use YouTube to cards | Caption fetch started on Your Device | The Device requests captions for the URL You provide. YouTube's terms apply to that request. | policies.google.com/privacy |
A connectivity check may contact a Google address only to see whether the Device is online.
Service Providers may process data in the United States and in other countries. Cloud Functions for this App run in us-central1. Where We transfer Personal Data from the European Economic Area, the United Kingdom, or Switzerland, We use an appropriate safeguard, such as Standard Contractual Clauses, an adequacy decision, or the provider's own transfer mechanism.
If You are in the EEA or the United Kingdom, the controller is:
ULADZISLAU ZINCHANKA
Email: dev.ohmyapp@gmail.com
You may also complain to the authority where You live. A list of EEA authorities is at edpb.europa.eu.
Depending on where You live, You may have rights to access, correct, delete, restrict, or receive a copy of Personal Data, to object, and to withdraw consent. California and other U.S. state rights are in Sections 12 and 13.
There is no sign-up account and no in-app account screen. Uninstalling does not by itself delete the Firebase quota record, and it does not cancel a subscription. Store purchase records may be kept by Apple or Google under their rules and under tax and accounting law. This section is the web page where You can request deletion of the anonymous app identifier and the data We hold with it.
We respond within one month, or later where the law allows an extension. We may ask for information to confirm the request. You may complain to a supervisory authority.
Traffic to Service Providers uses HTTPS. Study Content stays in the App's private storage, protected by the Device. No method of storage or transmission is perfectly secure.
If a Personal Data breach is likely to risk Your rights, We will notify the competent authority without undue delay and, where feasible, within 72 hours, and We will notify You when the law requires it. Write to dev.ohmyapp@gmail.com if You believe there has been an incident.
The App is a general-audience study tool. It is not directed to children, and it is not part of Google Play's Families program. A store content rating, including a low age rating, describes the absence of restricted content. It does not mean We design the App as a children's service.
We do not ask for a child's name, email, or phone number. An age band chosen in onboarding can be sent to Mixpanel as described in Section 2.2.6. Pseudonymous analytics, the anonymous Firebase id, crash reports, and purchase processing can still occur on a Device a parent lets a child use.
Where consent is the legal basis, the person must meet the digital-consent age in their country, often 16 in the EEA, or a parent must consent. In the United States, We do not knowingly collect Personal Data from a child under 13 in a way that requires verifiable parental consent under COPPA beyond the processing described in this Policy.
Premium must be bought by a person who is at least 18, or by a parent or guardian using their own Store account.
A parent may email dev.ohmyapp@gmail.com to ask Us to delete identifiers related to a child's use, where We can find them.
Links to Apple, Google, YouTube, OpenAI, RevenueCat, Mixpanel, and Firebase are governed by those companies. We do not control them.
We may update this Policy by posting a new version at this URL. Where the law requires notice in the App or on the store listing, We will provide it. If You do not agree to a material change, stop using the App. Where the law allows, continued use after the update means You accept the update.
This section applies to California residents. Words defined in the CCPA or CPRA have the same meaning here.
Categories that may have been collected in the last 12 months include: identifiers (Mixpanel id, RevenueCat id, Firebase UID and installation id, IP address); commercial and purchase information; internet or app activity (analytics events, including onboarding choices); and the AI prompt content You submit (topic, transcript, or extracted text). Sources: the Device, the Store, and the Service Providers in Section 4. Purposes: Section 2.3. We do not use Personal Data for cross-context behavioral advertising. Precise GPS location is not collected. Mixpanel may estimate a country or region from IP.
We disclose those categories to Service Providers for the business purposes in Section 4. We do not sell Personal Data for money. We do not share Personal Data for cross-context behavioral advertising. Some laws treat an analytics disclosure as a "sale" even when no money changes hands. Disclosure of Usage Data to Mixpanel may fall under that broad meaning. You can opt out by emailing dev.ohmyapp@gmail.com with the subject "CCPA Opt-Out". We do not knowingly sell or share the Personal Data of consumers under 16.
You may request to know, delete, and correct Personal Data, subject to verification and legal exceptions. Email the same address. We aim to respond within 45 days, or later where the law allows an extension. We will not discriminate against You for a request.
Residents of states with consumer privacy laws, including Virginia, Colorado, Connecticut, Utah, and others, may have rights to access, correct, delete, and obtain a copy of Personal Data, and to opt out of sale, targeted advertising, or certain profiling. We do not use Personal Data for targeted advertising. To use these rights, email dev.ohmyapp@gmail.com.
Apple's App Privacy labels and Google Play's Data safety form are short summaries. This Policy is the full description. For a normal install, data that leaves the Device includes:
Photos, document files, and card images are not collected by Us. There is no sign-up account. Transmission to Service Providers uses HTTPS. Deletion requests are in Section 7.
ULADZISLAU ZINCHANKA
Email: dev.ohmyapp@gmail.com