FlashcardPro

IT Innovations LLC DBA FlashcardPro Student Data Privacy and Security Policy

Effective October 30, 2026 · Download the PDF

Introduction

IT Innovations LLC DBA FlashcardPro is committed to protecting student data and supporting safe, effective studying. We handle student information responsibly and work to comply with the Family Educational Rights and Privacy Act (FERPA), the Children’s Online Privacy Protection Act (COPPA), where applicable, and relevant state student privacy laws.

Information We Collect

IT Innovations LLC DBA FlashcardPro may collect information needed to provide flashcards and study tools, including:

  • Account information: name, email address and a password (stored only as a salted hash), and whether the person is a student, teacher or school administrator
  • For a school: the school’s name, address, phone number and email domain, and the contact details of its administrators
  • Study information: the decks and cards a person creates or adds, their progress through the Leitner boxes, quiz answers, study timer and display settings
  • Notes a person chooses to upload to the AI tools (photos or PDFs), used only to make flashcards (see The AI Tools)
  • Billing records: the school’s or student’s payment amounts, dates and the payment processor’s reference. Card numbers never reach FlashcardPro
  • Records of AI use (counts and estimated cost) so fair-use limits can be applied

Schools and districts determine which students and teachers are added and are responsible for ensuring that information provided to FlashcardPro is appropriate and accurate.

How We Use Student Data

Student data is used only to provide studying and teaching tools. This may include:

  • Providing flashcards, quizzes and progress for each student
  • Letting school administrators manage their students and teachers
  • Billing a school or a student for the service, and applying fair-use limits
  • Providing, maintaining and improving FlashcardPro’s services
  • FlashcardPro strictly prohibits the advertising, monetization, selling, renting or leasing of student data. We do not monetize student data in any capacity. We do not show ads and we do not use tracking cookies.

Who Can See Student Data

  • A student’s decks, cards and progress are visible to that student.
  • School administrators can see the names and email addresses of their school’s students and teachers, and can turn accounts on or off. Each school can see only its own people.
  • A student who signs up on their own is not part of any school, and no school can see their data. If their school later joins FlashcardPro and the student’s email is at the school’s domain, the student moves into the school and the school’s administrators can see their account.
  • FlashcardPro’s owner can see account and billing information, and can see study data only when needed to support a person or school, to maintain the shared library of starter decks, or to review a deck a student has chosen to suggest for the public library.

The AI Tools

The AI tools are an optional paid add-on. When a person uses them to make flashcards from photos or PDFs of notes, to sort cards into topics, or to write multiple-choice answers, the uploaded files or the cards’ text are sent to an AI service provider (Anthropic) over an encrypted connection to produce the result. We use the provider’s business service, and the content is used only to produce the cards the person asked for.

FlashcardPro does not keep uploaded files. We keep only the file’s name and a fingerprint so the same file is not read twice. Please do not upload anything that contains sensitive personal information about other people. AI can make mistakes, so students should check the cards it makes.

Data Security Measures

IT Innovations LLC DBA FlashcardPro uses reasonable administrative, technical and physical safeguards designed to protect student data, including:

  • Encryption of all data in transit with HTTPS
  • Passwords stored only as salted hashes, never in readable form
  • Role-based access: students, teachers, school administrators and the platform owner each see only what their role needs, and each school’s people are kept separate from every other school’s
  • Rate-limited sign-in attempts and secure session cookies. A student can stay signed in on a device for up to 30 days; signing out ends the session, and a password reset ends all other sessions
  • Nightly backups that are encrypted and stored off-site, plus continuous database recovery logs, so data can be restored after a failure
  • Regular software updates and security reviews
  • Access to account data by FlashcardPro personnel limited to what is needed to support a person or school
  • Procedures for identifying and responding to security incidents, including prompt notice to affected schools and students if we learn that their data was disclosed without authorization

No system can be guaranteed to be completely secure. FlashcardPro works continuously to reduce risks and protect the confidentiality, integrity and availability of student data.

Data Sharing and Disclosure

IT Innovations LLC DBA FlashcardPro does not sell, rent or share student data for marketing purposes. Student data is shared only:

  • With authorized school or district personnel who have a legitimate educational interest
  • With service providers that support FlashcardPro’s operations and are required to protect the data: our hosting and email providers; PayPal, which processes payments and receives no study data; and, only when the AI tools are used, the AI service described above
  • With a school-directory lookup service, which receives only the school name or address being searched for, never student information
  • When required or permitted by law, court order or legal process
  • In an emergency when disclosure is necessary to protect a student’s health or safety

Data Retention and Deletion

Student data is retained only as long as needed to provide FlashcardPro, while an account is active, or as required by the applicable school or district retention policy, contract or law.

School administrators can turn their students’ and teachers’ accounts off at any time. A person, or a school, can ask us to delete an account and its study data using the contact details below. Deleted data may remain in encrypted backups for a limited time, until those backups are replaced by newer ones. Some information, such as billing records, may need to be retained to meet legal, audit or recordkeeping obligations.

Children’s Privacy

FlashcardPro is designed for students to use through their school or with a parent’s or guardian’s permission. Where a school provides FlashcardPro to its students, the school is responsible for any permission required for them to use an educational service. A student under 13 who is not part of a school should have a parent or guardian sign up for them. We collect only the information needed to provide the service, and we do not use it for advertising.

Parent and School Rights

Subject to applicable law and school or district procedures, parents and eligible students may have the right to:

  • Access student data maintained in FlashcardPro
  • Request correction of inaccurate or incomplete information
  • Request deletion of student data when permitted
  • Request information about how student data is collected and used
  • Opt out of certain data collection or uses where applicable

Parents and guardians of students who use FlashcardPro through a school should direct requests first to their child’s school or district, which controls the educational records and can help verify the request.

Compliance

IT Innovations LLC DBA FlashcardPro supports schools and districts in meeting their obligations under FERPA, COPPA where applicable, and applicable state student privacy laws. Schools and districts remain responsible for determining appropriate data practices, providing required notices, obtaining any required permissions, and responding to parent or eligible student rights requests.

Contact Information

Questions or privacy requests may be directed to:

Privacy Officer: Noah Beach
Contact form: https://flashcardpro.app/contact

Policy Updates

IT Innovations LLC DBA FlashcardPro may update this policy to reflect changes in its services, security practices or legal requirements. Material changes will be communicated through the FlashcardPro website, application, participating schools or districts, or other appropriate channels. The effective date will be updated whenever this policy changes.

Effective Date: October 30, 2026