Privacy Policy — MemoCat

1

1 Who is responsible for your data

MemoCat is a flashcard service for learning, at memocat.org. The controller of your personal data, in the sense of the GDPR, is Aleksei Okatev, a sole trader registered in Germany. The full address is in the Impressum.

For anything about your data, write to privacy@memocat.org.

2

2 What we collect

Your account

Email address, an encrypted form of your password, your time zone, and a profile picture if you add one.

What you put in

Your decks, cards, and any text you paste in to make cards from.

How your studying goes

Which cards you answered, how you rated them, and when. This is the schedule itself — without it there is nothing to remind you of.

Your devices

For each signed-in device: an identifier the app generates, the device name, the app version, the IP address it last connected from, and when. This is what lets you see your signed-in devices and sign them out.

Purchases

Apple's transaction identifiers, which product was bought, the amount and currency. We never see your card details.

Sign in with Apple

The identifier Apple gives us for you, and the email address Apple shares — which may be one of Apple's private relay addresses.

3

3 Why we use it, and on what legal basis

Running the service: your account, your cards, your schedule, your subscription.

Art. 6(1)(b) GDPR — performing our contract with you

Keeping accounts secure, spotting abuse, and limiting how often expensive features can be called.

Art. 6(1)(f) GDPR — our legitimate interest in a service that works and is not abused

Study reminders and the weekly summary, which you can switch off in Settings.

Art. 6(1)(a) GDPR — your consent, withdrawable at any time

Keeping records of payments for tax purposes.

Art. 6(1)(c) GDPR — a legal obligation

4

4 Where it is kept

Your data is stored on servers operated by netcup GmbH in Nuremberg, Germany.

Passwords are stored only as a one-way hash — we cannot read them, and neither can anyone who gets hold of the database.

5

5 Who else touches it

We use a small number of companies to run the service. Each one only gets what it needs for its part.

Apple

Sells and bills the Pro subscription, and tells us whether it is active.

Resend

Sends the emails — confirmations, password resets, the weekly summary.

OpenRouter

Runs the AI features. It receives the text you hand to them — nothing else from your account.

MyMemory (Translated S.r.l., Italy)

Translates individual words you ask about.

Sentry

Collects error reports when something breaks, so it can be fixed.

Some of these are outside the EU. Where that is the case, the transfer is covered by the European Commission's standard contractual clauses.

We do not sell your data, and we do not use it for advertising.

6

6 What the AI sees, and what stays on your phone

The AI features only ever receive the text you give them for that one task — a chapter you pasted, a PDF you chose, a page you linked. They do not receive your other decks, your email address, or your study history.

📷 Scanning is done on your phone

When you scan a page or read from a photo, the picture is recognised on the device itself. The photo never leaves your phone — only the text you keep is sent, and only if you then ask for cards to be made from it.

7

7 How long we keep it

Your account and everything in it stays until you delete it. When you delete your account it is removed from our systems within 30 days, backups included.

One exception: German tax law requires records of payments to be kept for up to 10 years. That means the amount, the date and the transaction number — not your cards or your study history.

8

8 Your rights

📋 Access

Ask for a copy of your data (Art. 15)

✏️ Correction

Have anything wrong put right (Art. 16)

🗑️ Erasure

Delete your account and its data (Art. 17)

📤 Portability

Export your decks and cards (Art. 20)

⏸️ Restriction

Ask us to pause processing (Art. 18)

✋ Objection

Object to processing based on our legitimate interest (Art. 21)

You can delete your account and export your decks yourself, from the app or the website, without asking anyone. For anything else, write to privacy@memocat.org — we answer within 30 days.

Where you have given consent, you can withdraw it at any time; that does not affect what was done before you withdrew it.

You also have the right to complain to a data protection authority — ours is [ to be completed in config/legal.yml ], and you may also go to the one where you live.

9

9 Cookies

We use two: one to keep you signed in, and one to remember your answer to the cookie banner. Nothing for advertising, and nothing that follows you to other sites.

10

10 Children

MemoCat is not for children under 16. If you believe a child has made an account, tell us and we will remove it.

11

11 Changes

If we change anything that matters here, we will email you before it takes effect.

12

12 Contact

Privacy questions: privacy@memocat.org

🔒 Privacy Policy