Legal

Privacy policy

Last updated 02 August 2026

The short version

01

We never sell your data.

Not to advertisers, not to data brokers, not to anyone.
02

No newsletters. No marketing email.

We email you sign-in links, and important notices about your account if we must. We never sign you up for anything.
03

No tracking or analytics scripts.

The only third-party script on the site is Google AdSense, which pays for the service.
04

Your data is stored in Europe.

Our servers are at Hetzner in Frankfurt, Germany. A few providers help us send email and catch errors — they are all listed below.
05

Your flashcards are not used for AI.

We never use your cards or study data to train AI models, and we never give or sell them to anyone who does.
06

Free, with no limits.

Ads pay for the service. There is no paid plan and nothing is locked.
07

You can delete everything yourself.

One page in your account deletes your account and all its data, permanently.

Who we are

FreeFlashcards.net is run by AYO SOLUTION APS, a company registered in Denmark (CVR DK42981494), Havnegade 53A, 3. sal, 1058 København K, Denmark. We are the data controller for the personal data on this page.

Questions or requests about your data: [email protected].

What we collect, and why

We collect only the data we need to run the service. We follow the principle of least privilege: each part of our system, and each person who works on it, can access only the data that the task needs.

Your account

What: Your email address. Your password, only if you choose to set one — we store it as a one-way hash that nobody can read. Your timezone, as your browser reports it.
Why: To create your account and sign you in. The timezone lets us count your study days from your local midnight.
Legal basis: Contract (GDPR Art. 6(1)(b)).
Kept: Until you delete your account.

Your decks and study progress

What: The decks and cards you create or import, and your study history: which cards you studied, the grade you gave each one, and when each card is due again.
Why: This is the service: we store your cards and schedule your reviews.
Legal basis: Contract (Art. 6(1)(b)).
Kept: Until you delete your account. This includes decks you archived.

Shared decks

What: When you join a deck through a share link, we store that you are a member, and your role (viewer or editor).
Who sees it: If you join as a viewer, the deck owner can see your name or email address and your progress on that deck: cards studied, accuracy, cards due, and the day you were last active. The progress of editors is not shown to anyone. We tell you this before you join.
Legal basis: Contract (Art. 6(1)(b)).
Kept: The owner sees your progress only while you are a member. If you leave, or the owner removes you, it disappears from their view. We keep your own progress, so you lose nothing if you join again.

Sign-in links

What: Your email address and a hashed copy of the one-time code in the link.
Why: To sign you in without a password.
Legal basis: Contract (Art. 6(1)(b)).
Kept: A link works once and stops working after 15 minutes. We delete it when you use it or ask for a new one. If you never use it, we delete it automatically one week after it stops working.

Security and sessions

What: When you are signed in, we store your IP address and browser type with your session. Our web server also keeps a technical log of requests: IP address, page address, time and browser type.
Why: To keep you signed in, to protect accounts against abuse such as repeated sign-in attempts, and to find and fix problems.
Legal basis: Our legitimate interest in a secure, working service (Art. 6(1)(f)).
Kept: Session data is deleted soon after the session ends. Server logs are deleted after 14 days.

Error reports

What: When something breaks, we send a technical error report to Sentry: what went wrong, the page address and details about the request. We do not include your email address, your IP address or your cookies.
Why: To find and fix bugs.
Legal basis: Legitimate interest (Art. 6(1)(f)).
Kept: At most 90 days.

Ad-blocker notice

What: If you are signed in and we detect an ad blocker, we show a notice. We count how many times we showed it to your account. The check runs in your browser, and we store only the number.
Why: Ads pay for the service. The count tells us how often the notice appears.
Legal basis: Legitimate interest (Art. 6(1)(f)).
Kept: Until you delete your account.

Email

We send you sign-in links when you ask for them. If we must, we also send important notices about your account or the service, for example a change to our terms. We never send newsletters or marketing, and we never sign you up for anything.

Advertising

FreeFlashcards.net is free because it shows ads from Google AdSense. Ads appear on public pages, your dashboard and deck pages. They never appear on study screens.

When a page with ads loads, your browser connects to Google. Google receives technical data such as your IP address, browser details and the address of the page, and it can set or read cookies and similar identifiers.
Google is an independent controller of this data. Google explains its use in How Google uses information from sites or apps that use its services.
If you are in the EEA, the UK or Switzerland, Google shows a consent message on your first visit. You choose if Google can use cookies for personalised ads. If you say no, Google shows non-personalised ads. These can still use cookies, for example to limit how often you see an ad and to stop fraud. You can change your choice at any time with the privacy settings link that Google shows on the page.
You can also manage personalised ads in Google's My Ad Center.
We never send Google your email address, your cards or your study data.

Cookies and local storage

The cookies we set are necessary for the site to work, so they do not need your consent:

freeflashcardsnet-session keeps your session while you use the site.
XSRF-TOKEN protects forms against cross-site request forgery.
remember_web_… keeps you signed in on this device for up to 400 days, or until you sign out.

We also save a few settings in your browser's local storage: your study theme, if you prefer to sign in with a password, and when you closed a notice. On the classic version of the site, the decks you made are saved there too. This data stays in your browser. We do not receive it, except when you choose to import classic decks into your account.

Google's advertising cookies are described under Advertising above.

Who else handles your data

We never sell your data, and we never share it with anyone for their own purposes. To run the service, we use the providers below. Except for Google's advertising, they process data only on our instructions, under a data processing agreement.

Hetzner Online GmbH (Germany) hosts our servers and database in Frankfurt. It stores all the data above.
Postmark (ActiveCampaign, LLC, USA) and Resend, Inc. (USA) deliver sign-in emails. They receive your email address and the content of the email.
Sentry (Functional Software, Inc., USA) receives error reports.
Google Ireland Limited shows ads, as an independent controller. See Advertising.
UserJot hosts our feedback board. It receives data only if you open the Feedback link and post there. UserJot's own privacy policy applies.

Postmark, Resend and Sentry can process data in the USA. These transfers are protected by the EU–US Data Privacy Framework or by the EU Standard Contractual Clauses.

Some older public pages (the homepage, the article lists and the classic study tool) load open-source code from public CDNs: cdn.tailwindcss.com, cdn.jsdelivr.net and unpkg.com. One article shows a YouTube video in privacy-enhanced mode. When these pages load, those services receive your IP address, like with any web request.

We disclose data to authorities only when Danish or EU law requires it.

AI

We do not use your flashcards, your study history or any other data about you to train AI models — ours or anyone else's. We do not sell or license your data to AI companies.

How we protect your data

Least privilege: only the people who run FreeFlashcards.net can access the production systems, and only as much as each task needs.
All connections use HTTPS.
Passwords are stored only as one-way hashes. Sign-in links work once, expire after 15 minutes, and are stored only as hashes.
We limit the number of sign-in attempts.
Deleted data can stay in our backups for up to 30 days, until the backups are overwritten. We do not restore single accounts from backups.

Your rights

Under the GDPR, you have the right to:

get a copy of the data we have about you, also in a machine-readable format;
correct data that is wrong;
delete your account and all its data. You can do this yourself: sign in and use Delete account on your dashboard. You can also ask us to do it;
object to processing that is based on our legitimate interest, or ask us to restrict it;
withdraw your consent for personalised ads at any time, with Google's privacy settings link on the page.

To use these rights, email [email protected]. We reply within one month.

Children

You must be at least 13 years old to create an account.

Changes to this policy

When we change this policy, we update the date at the top. If a change is significant, we tell signed-in users before it takes effect.

Contact

AYO SOLUTION APS, CVR DK42981494, Havnegade 53A, 3. sal, 1058 København K, Denmark, Denmark.
[email protected]