What we keep, and what we don't.
FlashShare is run by two people in Malaysia. This policy describes exactly what the app stores, why it needs to, and how you get rid of it. We have tried to write it in plain language rather than the usual wall of defensive text.
The short version. We store your account details, your decks, and your study activity, because the app cannot work without them. We do not sell your data to anyone. It goes only to the services that run FlashShare, to your teacher if you are in their class, and to other students where you choose to share (friends, leaderboards, study rooms). We do publish and sell research about how Malaysian students revise, in the form of counts and averages across at least fifty students at a time — never your records, and you can opt out in one tap. We do not train AI on your decks without asking you first. You can delete everything from inside the app.
Who we are
FlashShare is operated by its two founders, Aufa Eizdihar and Rayyan Asyraf. For anything in this policy, including requests to access or delete your data, contact flashshare.my@gmail.com.
Data protection contact. Muhammad Aufa Eizdihar is responsible for how FlashShare handles personal data, and reads every message sent to flashshare.my@gmail.com about it.
What we collect
We only collect what the product needs. There is no advertising network, no third-party tracking pixel, and no data broker involved anywhere.
| What | Why we need it |
|---|---|
| Email address, and your name if you sign in with Google | To create your account, sign you back in, and sync your decks across devices. |
| Your decks and cards | So they survive a reinstall and appear on your other devices. |
| Card review history, meaning when you reviewed a card and how you rated it | The spaced repetition scheduler cannot decide when to show a card again without it. |
| Study and focus sessions, meaning subject, duration and time | Streaks, your heatmap, the weekly leaderboard, and study room presence. |
| A device ID, a random identifier generated in your browser | Lets the app remember guests who have not made an account, and powers the leaderboard. |
| Your level and preferences, for example SPM, language, theme | To personalise your home feed and remember your settings. |
| Notification subscription, if you turn notifications on | Required by your browser to deliver a push notification at all. Turning it off removes it. |
| Feedback you send us | To fix what you tell us is broken. |
| Your school, form, subjects and exam date, and any chapters you mark as strong or weak | To build your study plan, and to connect you to your class and teacher if you join one. |
| Quiz answers and results | For your score, what to revise next, and quizzes your teacher runs in class. |
| Learning estimates we calculate: your FlashMetrics score, mastery and recall for each chapter, your readiness, and the study sessions we recommend and whether they worked | This is what FlashShare shows you. It is a picture of your learning, and your teacher sees part of it if you are in their class (see below). |
| A profile photo and card pictures, if you upload them | To show them in the app. They are stored so that anyone who has a picture's link can open it, so do not upload anything private. |
| Reports and blocks you make | To act on reported content and keep people you block away from you. |
| Your IP address, briefly | To stop abuse, such as someone hammering the sign-in page. It is not stored with your account. |
| Basic usage events, for example which subjects are searched for | To decide what to build next. We read these in aggregate, not to build a profile of you. |
What we deliberately do not collect
- We do not collect your location.
- We do not access your contacts, camera roll, or files, other than a deck file or picture you choose to upload.
- We use your camera only while you scan a QR code, and nothing it sees is stored or sent to us.
- We do not read anything from other apps or sites.
- During the beta we do not collect card or bank details, because nothing is actually charged. See Terms.
Where your data lives
Your data is stored with Supabase, on servers in Singapore, and the app itself is hosted by Vercel, whose servers for FlashShare also run in Singapore. Both are established infrastructure providers, and both process data on our behalf under their own security commitments. If you sign in with Google, Google confirms your identity to us and tells us your email address and name, nothing more.
A few other services handle a small part of it: Upstash keeps short-lived counts by IP address to stop abuse; your browser's push service (run by Google, Apple or Mozilla, depending on your browser) delivers notifications if you turn them on; and when you pay for something, CHIP, our payment provider, receives your name, email address and the payment itself. We never see your card or bank details.
Because these providers operate internationally, your data may be processed outside Malaysia. We have chosen the Singapore region to keep it as close to you as we reasonably can.
We do not sell your data
We have never sold user data and we are not going to. We do not share it with advertisers or data brokers. The only parties who receive it are the services listed above, who need it to run FlashShare, and the people described in the next section: your teacher, if you are in their class, and other students, where you choose to share.
Beyond them, nobody receives your name, your email address, your decks, your scores, or any record that could be traced back to you. That is the promise, and the research section below does not weaken it.
What your teacher and other students can see
Your teacher sees your data only if a teacher at your school has an approved FlashShare account for your subject and you are in their class. Teachers anywhere else see nothing. Your teacher can see your name and school; your FlashMetrics score, accuracy, cards reviewed, days active and study time over the last fortnight; the homework they set you and whether you did it; and, after a live quiz in class, which questions you missed. They also see class averages and a count of students who may need a check-in, without names. They cannot see how you rated each card, what you got wrong in your own practice, your own decks, notes or friends, or where you are on any leaderboard. The same list is in the app, under Profile.
Other students see only what you use with them. Friends you add see your study hours and whether you are studying right now. Leaderboards show your username and FlashMetrics score to other students on the same board, including your school's. Study rooms show that you are there. In a live quiz, the class sees the name you enter and your score. A story or challenge you choose to share shows whatever is on that card.
Research about how Malaysians study
One of the reasons we built FlashShare is that nobody really knows how Malaysian students revise. Not the ministry, not the schools, and not the students themselves. We are in an unusual position to find out, and we intend to publish what we learn — including, potentially, to government bodies, universities, and researchers who pay for it.
What that means concretely. Research output is counts and averages across large groups of students. Findings look like this:
“Form 4 students studying Biology revise most heavily between 9pm and 11pm.”
“Chapter 5 of Form 4 Biology is forgotten faster than any other chapter.”
“Students who revise twenty minutes a day recall substantially more than students who revise only at weekends.”
What it never contains. No names. No email addresses. No usernames. No individual student's records, scores, hours, or decks — not under your name, not under a number, not under a code that could be matched back to you later. Nobody buying a report receives a database; they receive findings.
The size rule. No figure is published unless it covers at least fifty students. This matters more than it sounds: “the average study time at your school” stops being a statistic and starts being about a specific person once the group is small enough. If a group is smaller than fifty, that figure does not get published at all, however interesting it is.
Your school. Individual schools are not named in anything we publish or sell without that school's own written agreement. Aggregate figures may be grouped by state or by school type, because those groups are large enough to be genuinely anonymous.
Opting out. You can say no. In the app, under Profile, there is a switch that removes your activity from every future research dataset. Your account works exactly the same way with it off, you lose nothing, and we will not ask you again. If you would rather email, write to flashshare.my@gmail.com and we will do it for you.
On AI
We do not train AI models on your personal decks without your explicit, specific consent. If we ever want to, we will ask you clearly first, and no will be a perfectly acceptable answer that costs you nothing.
If you are under 18
Most of our users are secondary school students, and that is who we built this for. We collect the same minimal information from everyone regardless of age. When you create an account, you confirm that if you are under 18, a parent or guardian has read this policy and agrees to you using FlashShare. Please make sure they are comfortable with it, particularly before you pay for anything. If a parent or guardian wants a child's account and data deleted, email flashshare.my@gmail.com and we will do it, no argument.
The research described above applies to under-18s on exactly the same terms as everyone else, which is to say: counts and averages across fifty students or more, never an individual's records, and never anything naming a school without that school's agreement. A parent or guardian can opt their child out using the switch in Profile, or by emailing us, and we will confirm when it is done. We think research of this kind is worth doing precisely because it is about students as a group and not about any child in particular — but if you disagree, the switch is there and using it costs your child nothing.
Deleting your data
You can delete your account from inside the app, under Profile, and it takes effect immediately. All associated data is removed from our systems within 7 days: your account, decks, study history, quiz results, learning estimates, pictures and friends. There are no retention traps, no “are you sure” loops designed to wear you down, and no requirement to email us and wait.
Two things are kept, and we would rather say so. Records of any payment you made stay, because the law requires a business to keep its financial records, but your name, email address and device are removed from them. And copies held in our recovery backups are deleted when those backups are, within 30 days.
If you want a copy of your data instead, or you cannot reach the in-app option for any reason, email flashshare.my@gmail.com and we will sort it out.
Your rights under Malaysian law
Malaysia's Personal Data Protection Act 2010 gives you the right to access the personal data we hold about you, to correct it if it is wrong, to limit how we use it, and to take a copy of it with you. The quickest way to see and keep everything is in the app: Profile, then Download my data gives you every record we hold about your account as one file, whenever you like. Saved card tokens and notification keys are left out of that file because they are credentials, not information about you. For anything else, email flashshare.my@gmail.com. We will respond within 21 days, which is the period the Act allows.
Security, honestly stated
We take reasonable measures to protect your data: encrypted connections everywhere, access controls on our database, and secrets kept out of the app you download. We are also a two-person team and we are not going to pretend we have the security apparatus of a large company. If we ever discover a breach affecting your data, we will report it to the Personal Data Protection Commissioner within 72 hours, as the law requires, and tell you what happened, what data was involved and what to do, rather than hoping you do not notice.
Changes to this policy
If we change this policy in a way that materially affects you, we will say so in the app rather than silently updating this page. The date at the top always reflects the current version.