Windyloop LLC (“Windyloop,” “we,” “us,” or “our”) operates FlashLoop, a language-learning and flashcard application. This Privacy Policy explains what information FlashLoop processes, why we process it, when we share it, and the choices available to you.
1. Information we process
We process the information you provide and the information created as you use FlashLoop. The categories below describe the current Service.
•
Account information: your email address, a one-way hash of your password (not the password itself) if you set one, account creation date, and security credentials used to keep you signed in.
•
Google sign-in information: if you choose Sign in with Google, the email address of your Google Account and Google’s identifier for that account, as described in Section 3.
•
Learning profile: your native language, the language you are learning, and the CEFR level you select.
•
Learning content: board names and contexts; words or phrases, translations and contexts; and examples generated for your cards.
•
Learning activity: review ratings and dates, review duration when available, scheduling data, progress, and related history.
•
Written answers and answer analysis: when you type or dictate an answer on a review card and ask FlashLoop to check it, we store your answer, the prompt sentence and reference answer it was checked against, when you answered, the feedback you were shown, and an analysis of which skills—such as grammar, sentence structure, vocabulary, and naturalness—you used correctly or incorrectly, including the quoted part of your answer that contained a mistake and its correction.
•
Analysis reports: the reports you generate on the Analysis screen, including the statistics, quoted examples, and AI-written summary shown to you.
•
Reports about AI content: the reason you choose when you report AI-generated content and a copy of the reported content, as described in Section 4.
•
Reminder settings and device tokens: whether the daily reminder is on, the time you chose, your device’s offset from UTC, the date the last reminder was sent, and, for each device on which you turn reminders on, a push token and whether the device runs Android or iOS.
•
Technical and security information: our systems and infrastructure providers may process an IP address, request time, app or device information, and diagnostic or security logs needed to deliver, protect, and troubleshoot the Service.
2. Microphone and speech recognition
Dictation is optional. FlashLoop requests microphone access only when you choose to answer a card out loud. On supported devices, your operating system or selected speech-recognition provider converts the audio into text. Windyloop receives the resulting transcript, not the raw audio, and does not store a recording of your voice.
The operating-system or speech-recognition provider may process audio under its own privacy terms. When you ask FlashLoop to check a dictated answer, the transcript is handled in the same way as an answer you typed: it is stored with your account and sent to our AI provider as described in Section 4.
3. Sign in with Google
Sign in with Google is optional; you can use an email address and password instead. When you choose it, Google confirms your identity and gives FlashLoop a signed identity token. On Android, the Google sign-in screen is provided by Google Play services on your device. On the web, Google’s sign-in script is loaded from accounts.google.com on the sign-in, sign-up, and account screens that show the Google button.
The token Google returns may include your name and profile picture, but our server uses only your email address, Google’s confirmation that the address is verified, and Google’s identifier for your account. We store the email address and that identifier with your FlashLoop account and do not store the token itself. We never receive your Google password, and FlashLoop does not request access to Gmail, Google Drive, your contacts, or other Google Account data.
If a FlashLoop account already uses the same email address, signing in with Google connects Google to that account. You can also connect Google in Settings → Account and sign-in, where the Google Account must use the same email address as your FlashLoop account. When Google is connected, you can confirm account deletion with Google instead of a password.
FlashLoop does not currently offer an in-app option to disconnect Google from an account; email us to remove the connection. You can review or remove FlashLoop in the third-party connections section of your Google Account, which does not delete your FlashLoop account or its data. Google processes sign-in information under its own terms and privacy policy.
4. AI features and your answers
FlashLoop uses OpenAI’s API to generate learning examples, check the answers you submit, analyze them for recurring mistakes, and write analysis reports. Depending on the feature, we send the minimum relevant parts of a card and learning profile, which may include a word or phrase, translation, board or word context, languages, level, prompt sentence, reference answer, and the answer you submitted. We do not send your email address or account identifier to OpenAI.
Answering a review card is optional. When you ask FlashLoop to check an answer, we save it to your account before sending it to OpenAI, so that the answer is not lost if checking fails. The same request produces the feedback you see and the skill analysis described in Section 1; if the analysis does not complete, our server retries it automatically a limited number of times. Stored answers and their analysis are used for the Analysis screen and do not change how your cards are scheduled.
When you generate an analysis report, we send OpenAI aggregated statistics about the skills in your analyzed answers for the period you selected, a small number of short quoted mistakes with their corrections (currently no more than three for each skill the report leads with), and your languages and level. The finished report is saved to your account so that you can open it again later.
You can report an AI-generated example, answer feedback, or analysis report with the Report link shown under it in the app. A report stores the reason you choose and a copy of the reported content as it was shown to you—the sentence pair for an example; the prompt sentence, your answer, and the feedback for answer feedback; or the AI-written summary for an analysis report—so that we can review the report and improve the Service.
Our OpenAI API requests set store to false, so response state is not kept for later retrieval through the API. Under OpenAI’s current API data controls, API data is not used to train OpenAI models by default unless the API customer opts in. OpenAI may retain inputs and outputs in abuse-monitoring logs for up to 30 days, subject to its policies and legal or security exceptions.
Do not put sensitive personal information in board contexts, word contexts, or answers if it is not needed for learning.
5. Push notifications
The daily review reminder is optional and stays off until you turn it on. When you turn it on, FlashLoop asks for notification permission if your device requires it, such as on Android 13 and later.
A reminder is sent at most once a day, at the time you chose, and only when a card is due. It shows the word or phrase at the front of your review queue and a sentence in your native language from that card. Depending on your device settings, this text may be visible on your lock screen.
To deliver a reminder, our server sends the reminder text and your device’s push token to Expo’s push notification service, which passes it to Firebase Cloud Messaging on Android or Apple Push Notification service on iOS. These providers process notifications under their own terms.
You can turn the reminder off in Settings → Daily review reminder or in your device settings. Turning it off in FlashLoop removes that device’s push token from our database, and deleting your account removes all of your push tokens. We also remove a token when Expo reports that the device is no longer registered, for example after the app is uninstalled.
6. How we use information
•
Provide accounts, authentication (including Sign in with Google when you choose it), synchronization, flashcards, reviews, progress, and support.
•
Generate examples, check your answers, analyze recurring mistakes, and write analysis reports at your request.
•
Send the daily review reminder when you turn it on.
•
Review reports about AI-generated content and improve the quality and safety of the Service.
•
Maintain security, prevent abuse, diagnose failures, and improve reliability.
•
Communicate with you about support, security, or material changes to the Service.
•
Comply with law and enforce our Terms of Service.
7. Pronunciation videos
FlashLoop can show real-world pronunciation examples for expressions from your recent reviews on the Home screen through an embedded YouGlish widget, which uses YouTube. The widget is not loaded when you open the Home screen. It is loaded only when you tap Watch on an expression after FlashLoop tells you what will be shared.
When you tap Watch, FlashLoop sends YouGlish only the expression shown and your learning language or accent. If no clip is found with that accent, the player may search again without an accent restriction. FlashLoop does not send the sentence context, translation, answer, review history, email address, or account identifier to YouGlish. YouGlish, YouTube, and Google may receive technical information and may store or access cookies or similar information on your device under their own policies.
8. Legal bases for processing
Where data-protection law requires a legal basis, we process information as needed to perform our contract with you and provide FlashLoop; for our legitimate interests in securing, maintaining, and improving the Service; with your consent where requested, including device permissions; and to comply with legal obligations. You may withdraw consent for a device permission in your device settings without affecting earlier processing.
9. When we share information
We do not sell personal information, and FlashLoop does not serve targeted advertising. We share information only as needed with service providers acting for us, including:
•
Turso/libSQL for application database storage.
•
Render for hosting the FlashLoop API and website.
•
OpenAI for AI-generated examples, answer feedback, answer analysis, and analysis reports.
•
Google for Sign in with Google, when you choose it.
•
Expo’s push notification service, Firebase Cloud Messaging, and Apple Push Notification service to deliver reminders you turn on.
•
YouGlish and YouTube only when you choose to load pronunciation videos.
•
Expo/EAS for application delivery and updates.
•
Hosting, network, security, and technical-support providers used to operate the Service.
10. Other disclosures
We may disclose information if reasonably necessary to comply with law, protect the rights or safety of users or others, investigate fraud or abuse, or respond to a valid legal request. If Windyloop is involved in a merger, financing, acquisition, reorganization, or sale of assets, information may transfer as part of that transaction subject to applicable law and appropriate confidentiality protections.
11. Retention and account deletion
We keep account and learning information, including written answers, their analysis, analysis reports, and reports about AI content, while your account is active. Deleting a word also deletes the written answers and analysis recorded for that word. Analysis reports are saved as they were generated, including any quoted mistakes, and remain until you delete your account; reports about AI content keep their copy of the reported content until you delete your account or we delete the report. Push tokens are kept while the reminder is on for that device.
You can delete your account in FlashLoop under Settings → Account and sign-in → Delete account. After you confirm with your password, or with Google if Google is connected, FlashLoop deletes the account, active sessions, profile, boards, vocabulary, saved generated examples, review history, written answers and their analysis, analysis reports, reports about AI content, reminder settings and push tokens, the Google sign-in connection, and progress data from the active application database. This cannot be undone.
If you cannot access the app, email us from the address associated with the account and use the subject “FlashLoop account deletion request.” We may ask for information needed to verify that the account belongs to you. Limited security logs, provider backups, or records required by law may remain for only as long as needed for those purposes. Notifications already delivered stay on your device until you dismiss them. OpenAI’s abuse-monitoring retention is described in Section 4.
Request account deletion by email
12. Your choices and privacy rights
You can review or update your learning profile and reminder settings in Settings, see your analyzed answers and reports on the Analysis screen, and delete learning content in the app. Depending on where you live, you may also have rights to access, correct, delete, receive a copy of, restrict, or object to certain processing of personal information. You may also have the right to appeal a decision or complain to your local data-protection authority.
To exercise a privacy right, contact us at the address below. We may need to verify your identity before completing a request. We will not discriminate against you for exercising an applicable privacy right.
13. Security
We use reasonable administrative, technical, and organizational safeguards designed to protect information. Passwords and refresh tokens are stored as one-way hashes on the server. Google identity tokens are verified against Google’s published signing keys and are not stored. Password changes require the current password, and account deletion requires your password or a fresh confirmation from Google. No system can guarantee absolute security, so please use a unique password and protect access to your device.
14. International data transfers
Windyloop is based in the United States, and our providers may process information in the United States and other countries. Those countries may have different data-protection laws from your country. Where required, we use appropriate safeguards for international transfers.
15. Children
FlashLoop is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child under 13 has created an account, contact us so we can investigate and delete the information. Additional age rules may apply in your country.
16. Changes to this policy
We may update this Privacy Policy as FlashLoop or the law changes. We will post the updated version here, revise the “Last updated” date, and provide additional notice when required by law. Continued use after an update takes effect is subject to the updated policy.
17. Contact us
Windyloop LLC · Chicago, Illinois 60660, USA. For privacy questions, requests, or complaints, email us.