Flick AI
Privacy Policy
Last updated 11 September 2026
This policy describes what the Flick AI iOS app collects, why, and what you can do about it. It is written to be specific: where we name a service or a category of data, that is what the app actually does, not a template.
Who is responsible
Flick AI (“we”, “us”) operates the Flick AI mobile application and is the data controller for the personal data described here. You can reach us at support@tryflickai.com for any question about this policy or to exercise any right described below.
Screen Time data never leaves your device
Flick AI uses Apple’s Screen Time APIs (Family Controls, Managed Settings and Device Activity) to block apps while Scroll Mode is on. The identifiers iOS gives us for the apps you select are opaque, encrypted tokens. We cannot read which apps they refer to, and we never transmit them. Your app selection, and everything Screen Time reports about your usage, stays on your iPhone.
What we collect
Account
Your email address, and an account identifier. You can sign in with an emailed link, with Sign in with Apple, or with Google. If you use Sign in with Apple with Apple’s private relay, we only ever see the relay address.
Study material you upload
PDFs, photos, presentations and text you add to build a deck. The file is stored so your deck can keep generating from it, along with its filename, type and page count. Its contents are sent to OpenAI to generate your cards and questions.
Study activity
The decks, cards and questions generated for you, which questions you have seen, which you answered correctly, and your progress through each deck. This is what makes the app work — without it there is nothing to show you next.
Purchases
Subscription status and transaction identifiers, handled through RevenueCat and Apple. We never see your card details. Payment is handled entirely by Apple.
Product analytics
We record a small, fixed set of events to understand whether the app works:
paywall_viewed, paywall_restore_succeeded,
auth_signed_out, auth_account_deleted, and
scroll_shield_launch. These are tied to your account identifier so we
can tell one person’s session from another’s. We do not use them for advertising,
and we do not sell them.
Why we are allowed to process it
Under the GDPR, we rely on:
- Performance of a contract — your account, your uploaded material, your study data and your subscription. The app cannot function without these.
- Legitimate interests — the product analytics above, to keep the app working and to fix what is broken. You may object to this at any time by writing to us.
- Legal obligation — retaining transaction records where tax or consumer law requires it.
Who else processes it
We use a small number of providers. Each acts on our instructions.
| Provider | What for | Where |
|---|---|---|
| Supabase | Accounts, database, file storage | EU (Ireland) |
| OpenAI | Generating cards and questions from your material | United States |
| PostHog | Product analytics | EU Cloud |
| RevenueCat | Subscription status | United States |
| Vercel | API hosting | EU region |
| Cloudflare | This website | Global |
| Resend | Sign-in and account emails | EU (Ireland) |
| Apple, Google | Sign-in, payments | Global |
Transfers to providers outside the EEA are made under the European Commission’s Standard Contractual Clauses.
How long we keep it
Your account data, uploaded material and study history are kept for as long as your account exists. Delete your account in the app and all of it is permanently deleted — profile, decks, cards, study progress and subscription state — with no undo and no recovery period. Transaction records may be retained longer where law requires. Analytics events are retained by PostHog under their standard retention.
Your rights
If you are in the EEA or the UK, you have the right to access your data, to correct it, to have it erased, to receive a portable copy, to restrict or object to processing, and to withdraw consent where we relied on it. Write to support@tryflickai.com and we will respond within one month.
You also have the right to complain to a supervisory authority. In Lithuania this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), vdai.lrv.lt.
Children
Flick AI is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.
Security
Data is encrypted in transit. Access to your rows in our database is enforced at the database level, so one account cannot read another’s data. No system is perfectly secure, and we will not claim otherwise.
Changes
If we change this policy we will update the date at the top. Material changes will be announced in the app.