Privacy Policy

1. Information We Collect

Personal Information

When you create an account with MemoForge, we collect the following personal information:

• Name and email address (required for account creation)
• Phone number (optional, for account recovery)
• Payment information (processed securely through Stripe)
• Profile preferences (language settings, timezone)

Document Content

To provide our flashcard generation service, we temporarily process:

• PDF documents, Word files, and images you upload
• Text content extracted from your documents
• Generated flashcards and translations

Usage Data

We automatically collect certain information about how you use our service:

• Device information (browser type, operating system)
• Usage patterns (features used, time spent)
• Performance data (page load times, errors)
• IP address and general location (for security and analytics)

2. How We Use Your Information

Service Provision

• Generate flashcards from your uploaded documents
• Provide AI-powered translations and audio pronunciation
• Maintain your account and user preferences
• Process payments and manage subscriptions

Communication

• Send processing notifications and system alerts
• Provide customer support and respond to inquiries
• Share important updates about our service
• Send promotional emails (with your consent)

Improvement and Analytics

• Analyze usage patterns to improve our service
• Monitor performance and identify technical issues
• Develop new features and capabilities
• Ensure security and prevent fraud

3. Data Storage and Security

Data Storage

Your data is stored securely using industry-standard cloud infrastructure:

• Database: Supabase (PostgreSQL) with SOC 2 compliance
• File storage: Cloudflare R2 with 99.9% uptime guarantee
• Processing: Temporary Google Cloud instances for AI operations
• Backup: Automated daily backups with encryption

Security Measures

• End-to-end encryption for all data transmission
• Advanced firewall protection and DDoS prevention
• Regular security audits and vulnerability assessments
• Two-factor authentication available for user accounts
• Secure API endpoints with rate limiting

Data Retention

• Account data: Retained while your account is active
• Flashcard decks: Stored permanently unless deleted by you
• Uploaded documents: Deleted immediately after processing
• Usage analytics: Anonymized and retained for 2 years

4. Information Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties except in the following circumstances:

Service Providers

We share data with trusted service providers who assist in operating our service:

• Google Gemini AI — for flashcard generation, Card Rescue (reformulating difficult cards), and Session Insights (coaching summaries). Flashcard generation sends your document content; Card Rescue sends specific flashcard text; Session Insights sends only anonymized session statistics and your deck name. Google processes this data under their Data Processing Addendum and does not use it to train their models
• Stripe — for payment processing (credit packs and subscriptions)
• Supabase — for database and authentication (EU region)
• Cloudflare — for content delivery and security
• PostHog — for product analytics (EU-hosted)
• Sentry — for error tracking and performance monitoring
• Resend — for transactional emails

Legal Requirements

We may disclose information when required by law, court order, or government request, or to protect our rights, property, and safety.

5. Your Rights and Choices

Access and Control

You have the following rights regarding your personal information:

• Access your personal data and download a copy
• Update or correct your information
• Delete your account and all associated data
• Opt out of marketing communications
• Request data portability

Data Portability

You can export your data at any time from your account settings. This includes your profile, flashcard decks, and usage history in JSON format.

Account Deletion

You can delete your account at any time from the settings page. This action permanently removes all your data and cannot be undone.

6. Cookies and Tracking

Essential Cookies

We use essential cookies to provide core functionality:

• Authentication cookies to keep you logged in
• Session cookies for security and functionality
• Preference cookies for your settings

Analytics

We use analytics cookies to understand how our service is used and to improve performance. You can opt out of analytics tracking in your browser settings.

7. International Data Transfers

Our infrastructure is primarily hosted in the EU (Supabase EU region, Cloudflare EU edge nodes, PostHog EU). Some service providers (Google Gemini, Stripe, Sentry) may process data outside the EU. Where data is transferred outside the EU/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or adequacy decisions to ensure your data is protected in accordance with GDPR requirements.

8. Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will delete such information promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Continued use of our service after changes constitutes acceptance of the new policy.

10. Contact Information

If you have any questions about this Privacy Policy or our privacy practices, please contact us: