AxieFlashDraft for review. This document describes what AxieFlash does today, but it has not had a legal review yet. Text in [brackets] is a detail the owner has not decided yet.
Introduction
This policy explains what information AxieFlash keeps, why, who else receives it, and the choices you have. It covers the AxieFlash Android app, our server and this website. AxieFlash is operated by axieflash (Pinamlayan, Oriental Mindoro, Philippines).
The app has a shorter version of this policy under Settings, Legal & Privacy. This website version has more detail. If they ever differ, tell us at axieflashdeveloper@gmail.com.
Information we collect
We collect only what the app needs to work. Most of your study data never leaves your phone.
| What | When | Where it's kept |
|---|---|---|
| Account: a random ID your phone creates the first time the app opens, its login token and a renewal secret, and when the login was last used | Every account | Our server keeps only a scrambled (hashed) form of the token and the secret. On your phone, the login is encrypted. |
| Google sign-in: your Google account ID, email address and name, and the username you pick | Only if you sign in with Google | Our server. We never see your Google password. |
| Your notes, photos and documents | When you add them | Your phone only. Text is read from photos and files on the phone; the files are never uploaded. |
| The text of your notes for Cloud AI | Only with Cloud AI on and your agreement | Sent to our AI provider to write your cards. AxieFlash does not store the text of your notes on its servers, only their length. |
| Study data: saved materials, study stacks, answer history, Library, XP, badges, streak and settings | As you play | Your phone only. |
| Card balance and ledger: spends, rewards and refills, and any correction the team makes, with its reason | As you play | Our server. |
| Rounds: for each finished round, its mode, subject, number of cards, correct answers, best streak and length | As you play | Our server. Not the questions you answered. |
| Cloud AI requests: mode, subject, where Study notes came from (typed, photo or document type), the notes' length, how many cards came back, and the processing cost and time | Each Cloud AI request | Our server. Not the cards' text or your notes. |
| Beta access: your request, the team's decision, when your one-time code was sent and redeemed, and your beta allowance | Only if you ask to join the beta | Our server. Codes are stored hashed and encrypted. |
| Feedback you send: your message, with your account and the app version | Only if you send feedback (Send Feedback, on the Create page) | Our server, until it's deleted with your account or your personal data. [RETENTION PERIOD: TO BE DECIDED] |
| Deletion requests: their type, times and status | If you make one | Our server. |
| Your agreement to the Terms and this policy (the versions and the time), your age confirmation, and your Cloud AI agreement | When you give them in the app | Your phone only. |
| Technical data: the app version sent with each request; in server logs, details such as IP addresses, pages or addresses requested, and errors | Every request to our server or this website | Our server. |
We don't collect payment details: nothing can be bought yet. AxieFlash has no advertising and no third-party analytics, in the app or on this website.
How we use it, and why we may
Each use has its own reason. Your agreement is only the reason for Cloud AI; the others don't depend on it.
| Purpose | Information | Basis |
|---|---|---|
| Give you an account, keep your cards and Premium, and restore them when you sign in on a new phone | Account, Google sign-in, card balance and ledger | Needed to provide the service you asked for |
| Write cards with Cloud AI | The text of your notes | Your agreement, which you can withdraw in the app |
| Run the beta: requests, approval, codes and allowances | Beta access, email address | Needed to provide the beta you asked to join |
| Keep the card economy fair, measure what the service costs, and improve it | Card ledger, rounds, Cloud AI requests | Our legitimate interest in running a fair, affordable service |
| Keep the service secure: logins, rate limits, preventing cheating and abuse, fixing errors | Account, technical data | Our legitimate interest in security and reliability |
| Read and answer your feedback, and fix what you report | Feedback, account, app version | Your request, and our legitimate interest in improving the app |
| Answer your questions and privacy requests | What you send us | Your request; legal obligations |
| Meet legal requirements | As required | Legal obligation |
[LEGAL REVIEW: confirm these bases under the Data Privacy Act and its implementing rules.] We don't sell your information, show ads, or use it for marketing.
Cloud AI and our AI provider
Cloud AI is part of Premium, and approved beta testers have it during their beta. It is off for free accounts. When it's on and you agree, the app sends the text of your notes to our server, which passes it to DeepSeek, our AI provider, to write your flashcards. The server checks the cards it gets back before sending them to your phone. Game Mode and Axie Run send only the subject you picked.
Without Cloud AI, cards are made on your phone and nothing is sent anywhere.
DeepSeek is based in China. Its privacy policy says it stores the personal data it collects in the People's Republic of China, and that its API, which AxieFlash uses, is covered by its Open Platform terms instead. [OWNER TO VERIFY: what DeepSeek's Open Platform terms say about keeping API requests and using them to train its models.] Don't put sensitive personal information in notes you send to Cloud AI.
You can turn Cloud AI off in Settings, and withdraw your agreement in Settings, Legal & Privacy, Consent & Permissions.
International transfers
Your information may be processed outside the country where you live: our server is in Singapore (DigitalOcean), Cloud AI requests go to DeepSeek in China, and Google processes sign-ins on its own servers worldwide. We send these providers only what is described above. [LEGAL REVIEW: the safeguards needed for these transfers.]
How long we keep it
- Account information: while your account exists.
- After you delete your account: your account is erased 24 hours after you ask. We keep play, card and cost records that no longer say whose they were, so our totals and bills stay correct. [RETENTION PERIOD FOR THESE RECORDS: TO BE DECIDED]
- Beta records: [RETENTION PERIOD: TO BE DECIDED]
- Server logs and backups: [RETENTION PERIODS: TO BE DECIDED]
- On your phone: until you delete your account, clear the app's data, or uninstall it.
Deletion is explained in full on Data Retention & Account Deletion.
How we protect it
- The app and this website talk to our server over encrypted connections (HTTPS).
- Your login is stored encrypted on your phone and scrambled (hashed) on our server, and it is never put in your phone's backups.
- Only the AxieFlash team can open the admin tools, behind a sign-in.
- Sensitive requests are rate-limited to slow down abuse.
No system is perfectly secure, and we can't promise that information will never be lost or misused. If a breach affects you, we will tell you and the authorities as the law requires.
Your rights
Under the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), you have the right to be informed about how your personal information is processed, and to access it, correct it, object to its processing, have it erased or blocked, and receive it in a portable form, as well as rights to damages and to file a complaint with the National Privacy Commission.
To use them:
- In the app: Request Data Deletion (Settings, Legal & Privacy), Delete account (Settings), and withdrawing your Cloud AI agreement.
- By email: axieflashdeveloper@gmail.com, for anything else, such as a copy of your data or a correction. Email from the Google account you signed in with, or include your user ID (Settings, Account), so we can check the account is yours.
Some requests may be limited where the law allows it, for example records we must keep. If we can't do what you ask, we will tell you why. [LEGAL REVIEW: which other laws apply if players are outside the Philippines, and response times.]
Children and age
AxieFlash is made for students. You must be at least 3 years old to use it, and the app asks you to confirm this when you first open it. If you are under 18, use AxieFlash with your parent's or guardian's permission. We don't knowingly collect information from anyone below the minimum age. If you think we have, tell us at axieflashdeveloper@gmail.com and we will delete it.
This website
This website sets no cookies, uses no browser storage, and runs no analytics or advertising. Our server logs each visit (for example the IP address and the page requested) to keep the site secure and working. See Cookies & Storage.
Changes to this policy
If we change this policy in a way that matters, we will update its version and date here and ask you to acknowledge it again in the app.
Contact
axieflash, Pinamlayan, Oriental Mindoro, Philippines.
Privacy and support: axieflashdeveloper@gmail.com
Data protection officer: [TO BE DECIDED, IF REQUIRED]