← Flashy

Privacy Policy

Effective 2026-10-01

Flashy is a study app for test prep, such as the SAT and PSAT. An account can be held by a parent or legal guardian and, where Flashy offers it, by a tutor or teacher or by a student 13 or older who signs up on their own. This page says what we collect, why, who else sees it, and how to get rid of it. “You” means the account holder. Wherever it says “parent”, that includes a legal guardian.

Who we are

Flashy is operated by Steady Spark Software LLC, a Wyoming limited liability company, 30 N Gould St, Ste R, Sheridan, WY 82801. You can reach us at [email protected] or (855) 616-0066.

What we collect

From the account holder: name, email address, and sign-in details such as a password (stored hashed, never in plain text). We use them to run your account and contact you about it.

From whoever buys a paid plan (the account holder, or a parent paying for a student’s account): billing and payment details, such as their name, billing address and payment card, which our payment processor collects and processes for us, and a record of what was bought. We use them to take payments, handle refunds and disputes, and keep the records the law requires.

From each student a parent, tutor or teacher adds: a first name or nickname, a username you choose, and a password. We never ask the student directly for any of it — you enter it. A tutor or teacher also gives the student’s month and year of birth, so we can confirm the student is 13 or older.

From a student who signs up on their own (13 or older): a name or nickname, an email address and password, and their month and year of birth. We ask the month and year first, so we can tell whether they can sign up on their own.

About the student’s studying: details such as their grade, date of birth and test date, which help us tailor the plan.

From studying: what a student answers and types while practicing, and their conversations with Spark, Flashy’s AI learning companion, which may include lessons by text or voice and short notes Spark keeps so it can pick up where they left off. This is the product — it is what produces the study plan and the progress you see.

Voice: lessons with Spark can be spoken. The audio is sent to our AI provider so Spark can answer; we do not keep the recording.

Automatically: ordinary technical information such as IP address, browser type and pages visited, used to run, secure and improve the service. We don’t track you across other websites, and we don’t let other companies use Flashy to do so for advertising.

What we do NOT do

We do not sell personal information.

We don’t use students’ information to target ads, and we don’t share it with others for their advertising.

Flashy is not a school.

Emails to account holders

We send essential emails about your account. You can also choose to get marketing emails from Flashy, such as news, tips and offers; that’s optional, and you can unsubscribe at any time. Unsubscribing doesn’t stop essential account emails or affect studying.

Our email providers send these for us and tell us whether they were delivered and opened.

Students under 13 — direct notice to parents

This is the notice required by the Children’s Online Privacy Protection Act (COPPA), and it is why the account belongs to you rather than to your student.

Students under 13 use Flashy only through a parent’s account. If someone under 13 tries to sign up on their own, we don’t create an account, and we ask them to have a parent sign up instead. Tutors and teachers can’t add a student under 13; a parent has to. Flashy doesn’t let students make personal information public.

What we collect about your student: a first name or nickname, a username and password, optionally their date of birth and grade and a target test date, and what they answer, type or say while they study, including their conversations with Spark. You give us the first few when you add them; the rest comes from using the app.

Their voice: lessons with Spark can be spoken. The audio is sent to our AI provider so Spark can answer; we do not keep the recording. Voice and Spark’s notes are included in the consent you give for this version of the policy. If you agreed to an earlier version, we will ask you before your student can use voice or Spark keeps notes. A parent or tutor can turn voice off for a student on their Classroom tab.

And, as on any website: the ordinary technical information a browser sends — an IP address, device and browser type, and which pages were used, which may include a recording of how a page was used, so we can see how Flashy is used and fix problems.

Flashy doesn’t ask your student for contact details such as a home address or phone number. Talking with Spark is free text or speech: what your student types or says is stored as text with their studying, sent to our AI providers to generate Spark’s replies, and used to run and personalize their practice. Our AI providers do not use it to train their models, and if we ever want to use it to train our own, we will ask you first.

How we use it: to provide, personalize and improve Flashy for your student, show you their progress, keep the service secure, and contact you about the account. We don’t use your student’s information for targeted advertising, and we don’t sell it.

Your consent: we need your consent before we collect, use or share information from your student, and without it we won’t. You give it when you add each student, on the form where you add them. It is per student, not once for the account.

Sharing with the service providers listed below is part of how Flashy works. We don’t disclose your student’s information to any other third party unless you give separate consent.

Your rights: you can review the personal information we have collected from your student, have it deleted, and refuse further collection or use at any time. Email [email protected] and we will action it. When a student is deleted, we delete their information as set out under “How long we keep it”.

Who else sees it

The companies below are our service providers. They process information on our behalf to provide their services to us. Our AI providers do not use it to train their models. The table names the providers we use today, and we may change them over time.

Our providers keep information for us only while we do, apart from short-term security logs some keep as part of providing their service to us. Our payment processor also uses payment information for its own purposes under its own privacy policy, such as preventing fraud.

CompanyWhyWhat it receivesNeeded for
VercelHosting and infrastructure, including routing requests to our AI providers.Information passing through the service, such as account details, study activity and ordinary request information.The service.
NeonDatabase hosting and storage.The information we store, such as account details and study activity.The service.
PostHogAnalytics, diagnostics, feedback, support and account emails.Information about how Flashy is used and whether it is working, which may include recordings of how pages were used, feedback, conversations with Spark (which may include a student’s first name or nickname), and the details needed to send account emails.Running and improving the service.
ResendEmail delivery and email preferences.The details needed to send an email, such as the recipient’s email address and name, the message, and email preferences.Emails from Flashy.
AnthropicAI services that power Spark.The information needed to respond, which may include conversations with Spark and study activity. Anthropic does not use it to train its models.Spark.
OpenAIAI services that power Spark, including voice.The information needed to respond, which may include conversations with Spark, including voice, and study activity. OpenAI does not use it to train its models.Spark.
TwilioAnswers our phone line and takes messages.Messages left for us, such as the caller’s phone number and message.Our phone line.
StripePayments and billing.The details needed to take a payment, such as the buyer’s name, email address, billing address and payment card, and what was bought.Paid plans.
CloudflareNetwork, security and content delivery.Ordinary request information, such as IP address and browser type.The service.

How long we keep it

We keep information only as long as we need it for the purpose it was collected for, and students’ information is never kept indefinitely.

WhatWhy we keep itHow long
Account details (account holder and student)To keep the account working and let a family sign back in.While the account is open, then deleted within 30 days of account deletion — or, if no one has signed in to the account for 24 months and it has no active paid plan, deleted within 30 days after that.
Practice answers and study plansThey are the product: they produce the study plan and the progress you see.While the account is open, then deleted within 30 days of the student or the account being deleted — or, if no one has signed in to the account for 24 months and it has no active paid plan, deleted within 30 days after that.
Conversations with SparkSo a student can pick up where they left off, and so we can check Spark is helping.While the account is open, then deleted within 30 days of the student or the account being deleted — or, if no one has signed in to the account for 24 months and it has no active paid plan, deleted within 30 days after that.
Usage, diagnostic and error informationTo run, secure and improve the service.While the account is open, then deleted within 30 days of the student or the account being deleted — or, if no one has signed in to the account for 24 months and it has no active paid plan, deleted within 30 days after that.
Purchase and billing records (buyer)To take payments, handle refunds and disputes, and meet tax and accounting obligations.For as long as tax, accounting and other legal obligations require, generally up to 7 years after the purchase, including after the account is deleted.

Ask us to delete a student, or your whole account, and we will, apart from records the law requires us to keep, such as purchase records. Backups age out on our database provider’s recovery window after that. And if an account simply stops being used, we do not keep the data forever: 24 months without a sign-in and no active paid plan, and it is deleted, as the table says.

Your choices

Email [email protected] to see what we hold, correct it, delete it, or refuse further collection or use for a student.

Changes

If we change this policy in a way that matters, we will update the effective date above and tell account holders by email, and if the change affects how we collect, use or share a student’s information and the law requires it, we will ask for your consent again first.

If Flashy is merged, acquired, sold or reorganized, information may move to the new owner as part of it. Students’ information stays covered by this policy unless you are told about a change and, where the law requires, asked first.

Questions about this policy go to [email protected].