FlashShare is run by two people in Malaysia. This policy describes exactly what the app stores, why it needs to, and how you get rid of it. We have tried to write it in plain language rather than the usual wall of defensive text.
The short version. We store your account details, your decks, and your study activity, because the app cannot work without them. We do not sell your data to anyone, and nothing that could identify you ever leaves FlashShare. We do publish and sell research about how Malaysian students revise, in the form of counts and averages across at least fifty students at a time — never your records, and you can opt out in one tap. We do not train AI on your decks without asking you first. You can delete everything from inside the app.
FlashShare is operated by its two founders, Aufa Eizdihar and Rayyan Asyraf. For anything in this policy, including requests to access or delete your data, contact hello@flashshare.net.
We only collect what the product needs. There is no advertising network, no third-party tracking pixel, and no data broker involved anywhere.
| What | Why we need it |
|---|---|
| Email address, and your name if you sign in with Google | To create your account, sign you back in, and sync your decks across devices. |
| Your decks and cards | So they survive a reinstall and appear on your other devices. |
| Card review history, meaning when you reviewed a card and how you rated it | The spaced repetition scheduler cannot decide when to show a card again without it. |
| Study and focus sessions, meaning subject, duration and time | Streaks, your heatmap, the weekly leaderboard, and study room presence. |
| A device ID, a random identifier generated in your browser | Lets the app remember guests who have not made an account, and powers the leaderboard. |
| Your level and preferences, for example SPM, language, theme | To personalise your home feed and remember your settings. |
| Notification subscription, if you turn notifications on | Required by your browser to deliver a push notification at all. Turning it off removes it. |
| Feedback you send us | To fix what you tell us is broken. |
| Basic usage events, for example which subjects are searched for | To decide what to build next. This is aggregate product analytics, not a profile of you. |
Your data is stored with Supabase, on servers in Singapore, and the app itself is hosted by Vercel. Both are established infrastructure providers, and both process data on our behalf under their own security commitments. If you sign in with Google, Google confirms your identity to us and tells us your email address and name, nothing more.
Because these providers operate internationally, your data may be processed outside Malaysia. We have chosen the Singapore region to keep it as close to you as we reasonably can.
We have never sold user data and we are not going to. We do not share it with advertisers or data brokers. The only parties who touch it are the infrastructure providers listed above, who need it to run the service, and, in future, a payment provider when you choose to pay for something.
Nobody outside FlashShare receives your name, your email address, your decks, your scores, or any record that could be traced back to you. That is the promise, and the section below does not weaken it.
One of the reasons we built FlashShare is that nobody really knows how Malaysian students revise. Not the ministry, not the schools, and not the students themselves. We are in an unusual position to find out, and we intend to publish what we learn — including, potentially, to government bodies, universities, and researchers who pay for it.
What that means concretely. Research output is counts and averages across large groups of students. Findings look like this:
“Form 4 students studying Biology revise most heavily between 9pm and 11pm.”
“Chapter 5 of Form 4 Biology is forgotten faster than any other chapter.”
“Students who revise twenty minutes a day recall substantially more than students who revise only at weekends.”
What it never contains.No names. No email addresses. No usernames. No individual student's records, scores, hours, or decks — not under your name, not under a number, not under a code that could be matched back to you later. Nobody buying a report receives a database; they receive findings.
The size rule.No figure is published unless it covers at least fifty students. This matters more than it sounds: “the average study time at your school” stops being a statistic and starts being about a specific person once the group is small enough. If a group is smaller than fifty, that figure does not get published at all, however interesting it is.
Your school.Individual schools are not named in anything we publish or sell without that school's own written agreement. Aggregate figures may be grouped by state or by school type, because those groups are large enough to be genuinely anonymous.
Opting out. You can say no. In the app, under Profile, there is a switch that removes your activity from every future research dataset. Your account works exactly the same way with it off, you lose nothing, and we will not ask you again. If you would rather email, write to hello@flashshare.net and we will do it for you.
We do not train AI models on your personal decks without your explicit, specific consent. If we ever want to, we will ask you clearly first, and no will be a perfectly acceptable answer that costs you nothing.
Most of our users are secondary school students, and that is who we built this for. We collect the same minimal information from everyone regardless of age. If you are under 18, please make sure a parent or guardian is comfortable with you using FlashShare, particularly before you pay for anything. If a parent or guardian wants a child's account and data deleted, email hello@flashshare.net and we will do it, no argument.
The research described above applies to under-18s on exactly the same terms as everyone else, which is to say: counts and averages across fifty students or more, never an individual's records, and never anything naming a school without that school's agreement. A parent or guardian can opt their child out using the switch in Profile, or by emailing us, and we will confirm when it is done. We think research of this kind is worth doing precisely because it is about students as a group and not about any child in particular — but if you disagree, the switch is there and using it costs your child nothing.
You can delete your account from inside the app, under Profile, and it takes effect immediately. All associated data is removed from our systems within 7 days. There are no retention traps, no "are you sure" loops designed to wear you down, and no requirement to email us and wait.
If you want a copy of your data instead, or you cannot reach the in-app option for any reason, email hello@flashshare.net and we will sort it out.
Malaysia's Personal Data Protection Act 2010 gives you the right to access the personal data we hold about you, to correct it if it is wrong, and to limit how we use it. To exercise any of these, email hello@flashshare.net. We will respond within 21 days, which is the period the Act allows.
We take reasonable measures to protect your data: encrypted connections everywhere, access controls on our database, and secrets kept out of the app you download. We are also a two-person team and we are not going to pretend we have the security apparatus of a large company. If we ever discover a breach affecting your data, we will tell you what happened and when, rather than quietly hoping you do not notice.
If we change this policy in a way that materially affects you, we will say so in the app rather than silently updating this page. The date at the top always reflects the current version.