Privacy Policy

1. Information We Collect

Personal Information

When you create an account with MemoForge, we collect the following personal information:

• Name and email address (required for account creation)
• Phone number (optional, for account recovery)
• Payment information (processed securely through Stripe)
• Profile preferences (language settings, timezone)

Document Content

To provide our flashcard generation service, we temporarily process:

• PDF documents, Word files, and images you upload
• Text content extracted from your documents
• Generated flashcards and translations

Usage Data

We automatically collect certain information about how you use our service:

• Device information (browser type, operating system)
• Usage patterns (features used, time spent)
• Performance data (page load times, errors)
• IP address and general location (for security and analytics)

2. How We Use Your Information

Service Provision

• Generate flashcards from your uploaded documents
• Provide AI-powered translations and audio pronunciation
• Maintain your account and user preferences
• Process payments and manage subscriptions

Communication

• Send processing notifications and system alerts
• Provide customer support and respond to inquiries
• Share important updates about our service
• Send promotional emails (with your consent)

Improvement and Analytics

• Analyze usage patterns to improve our service
• Monitor performance and identify technical issues
• Develop new features and capabilities
• Ensure security and prevent fraud

3. Data Storage and Security

Data Storage

Your data is stored securely using industry-standard cloud infrastructure:

• Database: Supabase (PostgreSQL) with SOC 2 compliance
• File storage: Cloudflare R2 with 99.9% uptime guarantee
• Processing: Temporary Google Cloud instances for AI operations
• Backup: Automated daily backups with encryption

Security Measures

• End-to-end encryption for all data transmission
• Advanced firewall protection and DDoS prevention
• Regular security audits and vulnerability assessments
• Two-factor authentication available for user accounts
• Secure API endpoints with rate limiting

Data Retention

• Account data: Retained while your account is active
• Flashcard decks: Stored permanently unless deleted by you
• Uploaded documents: Deleted immediately after processing
• Usage analytics: Anonymized and retained for 2 years

4. Information Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties except in the following circumstances:

Service Providers

We share data with trusted service providers who assist in operating our service:

• OpenRouter gateway and OpenAI (openai/gpt-6-luna) — for flashcard generation, Card Rescue (reformulating difficult cards), and Session Insights (coaching summaries). Flashcard generation sends your document content; Card Rescue sends specific flashcard text; Session Insights sends anonymized session statistics, your deck name, and the front and back text (up to 100 characters each) plus the rating (Again or Hard) for up to 10 struggled cards. OpenAI's API Data Usage Policies state that API data is not used to train models unless you explicitly opt in; its Data Processing Addendum describes the applicable processing terms. OpenRouter says it does not use your Inputs or Outputs for model training, but also says it does not control the downstream model provider's handling of Inputs or Outputs, so the selected provider's own terms govern that processing; see the OpenRouter Privacy Policy
• Google Gemini — for AI research with Google Search grounding. AI research sends your research topic to Gemini and uses the returned sourced summary to create flashcards. Google's Gemini API terms say that Paid Services do not use prompts or responses to improve Google products and process them under Google's Data Processing Addendum, and that those Paid Services data-use terms apply to users in the EEA, Switzerland, or the UK even when the service is otherwise free. Unpaid Services may use submitted content and generated responses to provide, improve, and develop Google products and machine-learning technologies, and human reviewers may process inputs and outputs; we cannot verify which Google service terms apply to a particular request. For Google Search grounding, Google says it stores prompts, provided context, and output for 30 days to create Grounded Results and Search Suggestions and may use that stored information for debugging and testing; its terms prohibit caching, copying, storing, or using Grounded Results or Search Suggestions except listed cases, including up to two years for display evaluation, end-user chat history, or temporary resubmission; the minimum time necessary for legal compliance; or end-user copies that are not collected programmatically or used to create a database
• Stripe — for payment processing (credit packs and subscriptions)
• Supabase — for database and authentication (EU region)
• Cloudflare — for content delivery and security
• PostHog — for product analytics (EU-hosted)
• Sentry — for error tracking and performance monitoring
• Resend — for transactional emails

Ask Memo support assistant

When you use Ask Memo, your submitted support question is processed through OpenRouter and the selected OpenAI model (openai/gpt-6-luna). Ask Memo is stateless and is not used to access your account, decks, sources, credits, subscription, or study content. Review the applicable provider policies and processing terms:

• OpenRouter Privacy Policy
• OpenRouter Terms
• OpenAI Data Processing Addendum
• OpenAI API Data Usage Policies

Legal Requirements

We may disclose information when required by law, court order, or government request, or to protect our rights, property, and safety.

5. Your Rights and Choices

Access and Control

You have the following rights regarding your personal information:

• Access your personal data and download a copy
• Update or correct your information
• Delete your account and all associated data
• Opt out of marketing communications
• Request data portability

Data Portability

You can export your data at any time from your account settings. This includes your profile, flashcard decks, and usage history in JSON format.

Account Deletion

You can delete your account at any time from the settings page. This action permanently removes all your data and cannot be undone.

6. Cookies and Tracking

Essential Cookies

We use essential cookies to provide core functionality:

• Authentication cookies to keep you logged in
• Session cookies for security and functionality
• Preference cookies for your settings

Analytics

We use analytics cookies to understand how our service is used and to improve performance. You can opt out of analytics tracking in your browser settings.

7. International Data Transfers

Our infrastructure is primarily hosted in the EU (Supabase EU region, Cloudflare EU edge nodes, PostHog EU). Some service providers (Google Gemini, OpenRouter/OpenAI, Stripe, Sentry) may process data outside the EU. Where data is transferred outside the EU/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or adequacy decisions to ensure your data is protected in accordance with GDPR requirements.

8. Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will delete such information promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Continued use of our service after changes constitutes acceptance of the new policy.

10. Contact Information

If you have any questions about this Privacy Policy or our privacy practices, please contact us: