Third-Party SDK Directory and Information Sharing List

Last Updated: November 4, 2026

Effective Date: November 4, 2026

To ensure the functionality, reliability, and security of FlashCard (hereinafter referred to as "the Application"), we may integrate Software Development Kits (SDKs) and technical services provided by third parties. All third-party SDKs integrated into our application undergo thorough security and privacy compliance assessments.

This directory provides details on the third-party SDK names, package names/identifiers, providers, purposes, types of data collected, and links to their respective privacy policies:

Personal Information Sharing Scope Statement

• We share personal information with third parties only in the following scenarios: when you actively purchase a membership or make a payment in the app, device model, OS version, network status, and order information are provided to Alipay (China) Network Technology Co., Ltd. through the official Alipay SDK; when you actively make or restore a purchase on iOS, transaction receipts and order numbers are processed by Apple Inc. through StoreKit.
• The app does not share your IMEI, IMSI, device MAC address, SUPI, SUCI, installed app list, location, contacts, call logs, calendar, SMS, phone number, images, or audio/video with any third-party SDK or service provider.
• The identities, purposes, processing methods, and types of personal information of the SDKs listed below are specified item by item; apart from the sharing scenarios above, all other SDKs process data locally on the device and do not transmit it to third-party companies.

1. Alipay SDK

• SDK Name: Alipay Client SDK (Alipay SDK)
• Package Name / Identifier: com.alipay.sdk (Maven: com.alipay.sdk:alipaysdk-android)
• Provider: Alipay (China) Network Technology Co., Ltd.
• Purpose / Use Case: Secure mobile in-app payments, order fulfillment, transaction anti-fraud and risk control
• Data Collected / Permissions: General device identifiers (device model, OS version, network status), android.permission.INTERNET, android.permission.ACCESS_NETWORK_STATE
• Processing Method: Invoked locally, transmitted over encrypted channels to Alipay payment servers
• Privacy Policy: https://render.alipay.com/p/c/k2cx0tg8

2. Google ML Kit Text Recognition SDK

• SDK Name: Google ML Kit Text Recognition SDK
• Package Name / Identifier: com.google.mlkit / com.google_mlkit_text_recognition (Gradle: com.google.mlkit:text-recognition-chinese)
• Provider: Google LLC
• Purpose / Use Case: Offline on-device Optical Character Recognition (OCR) for photo scanning and note creation
• Data Collected / Permissions: Selected images/photos, android.permission.CAMERA, android.permission.READ_MEDIA_IMAGES / photo library read permissions
• Processing Method: Entirely on-device offline processing. Images are never uploaded to the cloud or shared externally
• Official Terms / Privacy: https://developers.google.com/ml-kit/terms

3. freeRASP Mobile Security SDK

• SDK Name: freeRASP Mobile Security SDK
• Package Name / Identifier: com.aheaditec.freerasp / com.aheaditec.talsec (freerasp)
• Provider: Talsec s.r.o.
• Purpose / Use Case: Runtime Application Self-Protection (RASP), detecting Root/Jailbreak, emulators, dynamic hooking (Frida/Xposed/Magisk), debugging, and repackaging to safeguard application integrity
• Data Collected / Permissions: System security indicators (Root status, debug flags, app signing certificate hash; no personal identifying information)
• Processing Method: Local on-device real-time detection and mitigation
• Privacy Policy: https://talsec.app/privacy-policy

4. Apple StoreKit In-App Purchase SDK

• SDK Name: Apple StoreKit In-App Purchase SDK
• Package Name / Identifier: StoreKit.framework / io.flutter.plugins.inapppurchase (in_app_purchase)
• Provider: Apple Inc.
• Purpose / Use Case: iOS platform only, managing in-app subscription and non-consumable item purchases and receipt validation
• Data Collected / Permissions: Transaction receipts and order tokens linked to Apple ID (handled natively by iOS StoreKit)
• Processing Method: Native iOS system interaction; application only receives and verifies encrypted receipts
• Privacy Policy: https://www.apple.com/legal/privacy/

5. Sherpa ONNX Speech Recognition SDK

• SDK Name: Sherpa ONNX Speech Recognition SDK
• Package Name / Identifier: com.k2fsa.sherpa.onnx / sherpa_onnx
• Provider: Next-gen Kaldi / Open Source Community
• Purpose / Use Case: Offline speech-to-text input and pronunciation practice
• Data Collected / Permissions: Audio streams captured via microphone, android.permission.RECORD_AUDIO permission
• Processing Method: Entirely on-device offline neural network inference. No network connection required, no audio uploaded
• Project Home: https://github.com/k2-fsa/sherpa-onnx

6. device_info_plus Device Information SDK

• SDK Name: device_info_plus
• Package Name / Identifier: dev.fluttercommunity.plus/device_info / device_info_plus (^13.2.0)
• Provider: Flutter Community (open-source maintained)
• Purpose / Use Case: Reading device model, OS version, Android ID / iOS identifierForVendor for device fingerprint generation (authentication) and runtime security risk reporting (only when a threat is detected)
• Data Collected / Permissions: Device unique identifier (Android ID / IDFV), device model, OS version; no additional runtime permissions required
• Processing Method: Local read; device identifiers are only transmitted via HTTPS to the risk-control API after the user has consented to the Privacy Policy and a security threat is detected
• Project Home: https://pub.dev/packages/device_info_plus

7. photo_manager Photo Library SDK

• SDK Name: photo_manager / photo_manager_image_provider
• Package Name / Identifier: dev.fluttercommunity.plus/photo_manager / photo_manager (^3.11.0)
• Provider: Flutter Community (open-source maintained)
• Purpose / Use Case: Reading user photo library images for flashcard creation via photo-OCR scanning and image occlusion features
• Data Collected / Permissions: Photo files from the user's library; android.permission.READ_MEDIA_IMAGES (Android 13+) / android.permission.READ_EXTERNAL_STORAGE (Android ≤12); iOS uses NSPhotoLibraryUsageDescription
• Processing Method: Permission is requested only when the user actively opens the photo picker. Images are processed entirely on-device (ML Kit OCR) and are never uploaded to the cloud
• Project Home: https://pub.dev/packages/photo_manager

8. Third-Party SDK Processing in Silent and Background States

All third-party SDKs integrated into the app serve feature implementation and security protection; none are advertising, behavioral analytics/tracking, or push-notification SDKs. Their processing rules in silent states (when you are not actively using the app) and while running in the background are as follows:

• Alipay SDK: Invoked only when you actively initiate a payment or order query; it is not initialized and does not collect device information at app startup, in silent states, or while running in the background.
• Google ML Kit Text Recognition SDK: Performs on-device offline recognition only when you actively take a photo or select an image; it is not invoked in the background, and images are not uploaded.
• freeRASP Mobile Security SDK: Starts with the app after you agree to the Privacy Policy. While the app process remains alive (including the brief period after the app moves to the background before the system reclaims the process), it continues local security checks that read only system security indicators and upload nothing; device identifiers and risk types are reported to the risk-control endpoint only when a risk is detected.
• Apple StoreKit In-App Purchase SDK: Handled by the iOS system only when you actively make a purchase, restore purchases, or validate a transaction; it does not collect personal information in the background.
• Sherpa ONNX Speech Recognition SDK: Performs on-device inference only when you actively use speech read-aloud or transcription; it does not record or collect audio in the background.
• device_info_plus Device Information SDK: Reads device information locally only in scenarios you actively trigger (registration, proactive feedback submission) or when a security risk is detected; it does not proactively read or upload in silent or background states.
• photo_manager Photo Library SDK: Requests permission and reads selected images only when you actively open the photo picker; it does not access your photo library in the background.

Except for the scenarios listed above, third-party SDKs integrated into the app do not collect or upload your personal information in silent or background states. If new SDKs are added or processing rules change, we will update this list and notify you in the app.

9. Updates and Monitoring

We regularly monitor the security and privacy practices of integrated SDKs. As features evolve, this list may be updated to reflect current practices.

10. Self-Start and Associated Start Statement

• The app does not integrate third-party commercial SDKs capable of self-start, associated start, or background keep-alive (no advertising, analytics/tracking, or push-notification SDKs), and no SDK wakes up or silently launches other apps.
• The only boot-time self-start broadcast comes from the local notification component flutter_local_notifications (a Flutter ecosystem plugin, not a third-party commercial SDK): it only restores your daily study reminders that you have actively enabled after a device reboot, does not launch the app's main interface, does not access the network, and collects no personal information; once you disable study reminders, no such scheduling occurs.
• Associated starts occur only when you actively act: launching the Alipay client or cashier when you make a payment, and opening the app store or official download page when you actively check for updates; both are necessary to complete the action you initiated.
• There is no mutual wake-up, scheduled self-start, background keep-alive, or frequent self-start behavior within the app.