How Synaflip handles your data.

Who we are and what this covers

Synaflip is a flashcard and spaced-repetition app for medical study, offered on the web and on Android. In this policy, “Synaflip”, “we” and “us” mean the operator of the Synaflip service.

This policy covers the Synaflip application (web and Android), its API and this website. It explains what we collect, why, who helps us process it, how long we keep it and the choices you have.

Information we collect

We collect only what is needed to run your account and your study library:

• Account details: your name and email address, whether the email is verified and, if you sign up with a password, a salted hash of that password. We never store your password itself.
• Study material you add: notes, cards, decks, subjects, images attached to notes, and PDFs, images or text you upload as sources for drafting cards.
• Study activity: your reviews, ratings and the schedule calculated from them, so the app can tell you what is due.
• Sign-in and security data: session records with the IP address and browser or device description of each sign-in, and short-lived rate-limit counters that protect against abuse.
• Subscription status, if you buy a plan: the plan, its period and its state as confirmed by the payment provider. We do not receive or store card numbers.
• Product usage events, unless you turn them off: see “Product analytics” below.

Signing in with Google

You can create an account or sign in with your Google account instead of a password. When you choose “Continue with Google”, Google asks you to allow Synaflip to see your basic profile. We request only the standard openid, email and profile permissions and nothing else.

From Google we receive and store:

• your Google account identifier, so we can recognise you the next time you sign in;
• your email address and whether Google has verified it;
• your name and, if your Google account has one, the link to your profile photo.

How we use Google user data

We use the information we receive from Google only to create and sign in to your Synaflip account, to show your name and email in the app, to link your Google sign-in to an existing Synaflip account with the same verified email, and to let you re-confirm your identity with Google before sensitive actions such as exporting a backup or deleting your account.

We do not request access to your Gmail, Google Drive, contacts, calendar or any other Google service. Google’s access and refresh tokens are discarded as soon as sign-in completes, so we cannot act on your Google account afterwards.

We do not sell Google user data, use it for advertising, share it with data brokers, or transfer it to anyone except the infrastructure providers that host our service. We do not use Google user data to develop, improve or train artificial-intelligence or machine-learning models.

Synaflip’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can stop Google sign-in at any time by removing Synaflip from the third-party connections in your Google account settings. Deleting your Synaflip account deletes the Google identity we stored.

How we use your information

We use the information above to:

• provide the service: keep your library, sync it between your devices and schedule your reviews;
• draft flashcards from the source pages you select, when you ask for it;
• send account emails, such as email verification and password reset codes;
• keep the service secure: authenticate requests, prevent abuse and investigate problems;
• manage a subscription you buy and enforce plan allowances;
• understand how the app is used so we can improve it, unless you turn this off (see “Product analytics”).

AI drafting of flashcards

When you ask Synaflip to draft cards from a source, the pages you select are sent to an AI service provider, Google’s Gemini API, only to produce those drafts. Each draft links back to the page it came from so you can check it, and nothing is saved to your decks until you approve it.

Only the content of the selected pages is sent. Your account details and Google profile are not. Do not upload patient-identifiable information: Synaflip is not designed to hold it.

Product analytics

To learn which parts of Synaflip help people study and where they get stuck, the app sends usage events to PostHog, an analytics provider, on its servers in the European Union. Events describe actions, such as a screen opened, a deck created, a study session finished or a card-drafting job completed, with counts, durations and settings such as your plan, the platform and the app version. Screens are recorded by their general address (for example “a deck page”), never with the ids of your decks or notes.

Events never include your notes, cards, answers, uploaded files or their names, and never your email address or name. They are linked to a random internal account identifier, not to your email or name. Session recording, automatic click tracking and advertising features are off.

You can turn this off at any time with “Share usage analytics” on the Account screen, on the web and on Android. When it is off, the app and our servers stop sending usage events for your account. When you delete your account, we also ask PostHog to delete the events and profile linked to your account identifier.

Separately, Cloudflare, which hosts this website and the web app, counts page views with Cloudflare Web Analytics on both. It records the address of each page viewed (in the web app this can include the random identifier of a deck or job, never its content), the referring page, browser, operating system, device type, country and page-load timing. It sets no cookies and uses no browser storage, and it is not linked to your account. It runs for every visitor; “Share usage analytics” and this website’s analytics choice do not turn it off.

Service providers and sharing

We do not sell your personal data and do not share it for advertising. We share it only with providers that help us run the service, only as far as each needs:

• Google, for sign-in with Google and for AI drafting through the Gemini API;
• Amazon Web Services (Simple Email Service, Mumbai region), to deliver account emails;
• PostHog (European Union), for product analytics, unless you turn it off;
• Cloudflare, which hosts this website and the web app and counts page views (see “Product analytics”);
• our hosting, database and file-storage providers, which store the service’s data;
• Razorpay (web) and Google Play with RevenueCat (Android), if you buy a subscription. They handle payment details under their own privacy policies.

When we may disclose information

We may disclose information if the law requires it, to respond to a valid legal request, or to protect the rights, safety and security of our users and the service.

Storage and security

Uploaded files are kept in private storage and are opened only through short-lived signed links issued to your own account. Every private request is authenticated and checked against the owner of the data. Sessions use secure, HTTP-only cookies. Passwords, tokens and your study content are kept out of our logs.

Your data may be processed in India and in other countries where our providers operate. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach as the law requires.

How long we keep data

We keep your account and library for as long as your account exists. Items you delete leave your library straight away and are permanently removed later by scheduled clean-up. Backup files you export are kept only briefly so you can download them.

When you delete your account, your profile, sessions, Google identity, library, review history and uploaded files are removed from our active systems, and deleting the account on Android also clears Synaflip’s data on that device. Copies in our system backups are removed as those backups expire. We may keep a minimal record of past purchases where tax or accounting law requires it.

Your choices and rights

Subject to applicable law, including India’s Digital Personal Data Protection Act, 2023, you can access, correct and delete your personal data and withdraw consent.

• Export: download a backup of your library from Account settings at any time.
• Correct: edit your cards and decks in the app, or ask us to correct your account details.
• Delete: delete your account from Account settings. We ask you to confirm your password or re-confirm with Google first.
• Object to analytics: turn off “Share usage analytics” on the Account screen.
• Withdraw consent or ask a question: email us. Withdrawing consent may mean we can no longer provide the service.

This website

This website has no account system, upload form or study database. Optional Google Analytics, when a deployment enables it, loads only after you choose “Allow analytics”; the choice is stored in your browser and you can change it with “Privacy choices” in the footer. Our hosting provider, Cloudflare, processes ordinary request information, such as IP address and browser details, to deliver pages, and counts page views for every visitor with cookieless Cloudflare Web Analytics (see “Product analytics”).

Age

Synaflip is intended for people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We will update this policy when our practices change and show the new date at the top of this page. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.

Contact and grievances

For privacy questions, data requests or grievances about how we handle your personal data, email us. We will reply as soon as we can and within the time the law allows. If you are not satisfied with our response, you may complain to the Data Protection Board of India.