Privacy Policy

1. Information We Collect

2. How We Use Your Information

We use collected information for the following purposes:

• Service provision and improvement: Create and maintain your account; store, sync, and display flashcards; track learning progress; implement spaced repetition; enable public category sharing; provide support; and improve the Service.
• AI-powered features: Generate language learning content, quiz options, translations, explanations, and AI-generated flashcard suggestions.
• Communication: Send welcome emails, account-related notices, privacy or terms updates, push notifications for learning reminders with consent, and optional feature or service updates.
• Legal and security: Comply with legal obligations, prevent fraud or abuse, enforce our terms, protect rights and safety, and maintain audit logs for security and compliance.

3. Legal Basis for Processing

We process personal data under the following legal grounds:

• Contract Performance: To provide the core functionality of Memicorn as described in our Terms of Service.
• Consent: For optional features such as push notifications, promotional emails, public category sharing, and analytics where consent is required.
• Legitimate Interests: For service improvement, fraud prevention, security measures, and anonymous analytics.
• Legal Obligations: To comply with applicable laws, regulations, and legal processes.
• Vital Interests: To protect the vital interests of you or another person in rare circumstances.

4. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information. We share information only in the following circumstances:

• With Your Consent: When you explicitly agree to share information, such as making categories public.
• Service Providers: With trusted third-party services that help us operate Memicorn.
• Legal Requirements: When required by law, court order, or government request.
• Safety and Rights Protection: To protect the rights, property, or safety of Memicorn, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to users where required.
• Aggregated Data: We may share anonymized, aggregated data that cannot identify individuals.

5. Third-Party Services

We use third-party services to operate Memicorn. Each service has its own privacy policy and data protection measures.

We maintain Data Processing Agreements with service providers that process personal data on our behalf where appropriate.

6. AI Services and Automated Processing

• OpenAI Integration: When you use AI-powered features, flashcard content may be sent to OpenAI's API for processing. Generated content is stored in your account and treated as your user-generated content.
  • OpenAI processes this data according to its privacy policy and data usage policies.
  • We configure our OpenAI integration to opt out of training on your data where available.
  • OpenAI may temporarily retain data for security and abuse monitoring according to its policies.
• Automated Processing: Memicorn uses automated processing for spaced repetition, learning analytics, and AI-generated content suggestions.

You have the right to request human review of automated decisions that significantly affect you where applicable law provides that right.

7. Data Retention and Deletion

• Active Account Data: Retained while your account is active and you use the Service.
• Deleted Account Data: Removed from active systems within 30 days of an account deletion request.
• Backup Data: May be retained in backups for up to 90 days.
• Legal Hold Data: Retained as required by law or legal proceedings.
• Anonymized Analytics: May be retained indefinitely in aggregated form.

You can delete your account at any time through the app settings menu under Settings > Account > Delete Account, or by contacting info@memicorn.com.

Upon deletion, we remove personal data from active systems, delete or anonymize content and learning data, and retain only data required for legal compliance or legitimate business purposes.

8. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in Transit: All data transmitted between your device and our servers uses HTTPS/TLS encryption.
• Encryption at Rest: Sensitive data is encrypted in databases and storage systems.
• Access Controls: Production access is limited and multi-factor authentication is required where appropriate.
• Password Security: Passwords are hashed using secure cryptographic functions and are never stored in plain text.
• Security Review: We periodically review security practices and vulnerabilities.
• Secure Development: We follow OWASP guidance and secure development best practices.
• Incident Response: We maintain procedures for detecting and responding to security incidents.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we use commercially reasonable efforts to protect your data.

9. International Data Transfers

Your information may be transferred to and maintained on servers located outside your country of residence.

• Data Centers: Our primary data is hosted in the United States through our service providers.
• Safeguards: We use appropriate safeguards for international transfers where required.
  • Standard Contractual Clauses approved by the European Commission where applicable.
  • Data Processing Agreements with service providers.
  • Other transfer safeguards required by applicable law.
• Your Consent: By using Memicorn, you consent to transfers to countries that may have different data protection laws than your jurisdiction, subject to applicable law.

10. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of personal data, subject to legal requirements.
• Portability: Receive your data in a structured, machine-readable format.
• Restriction: Request restriction of processing of your personal data.
• Objection: Object to processing based on legitimate interests or direct marketing.
• Withdraw Consent: Withdraw consent where consent is the legal basis for processing.
• Non-Discrimination: Not be discriminated against for exercising your privacy rights.

To exercise these rights, contact info@memicorn.com. We will respond within 30 days or as required by applicable law.

11. Regional Privacy Rights

12. Children's Privacy

Memicorn is not intended for children under 13 years of age, or 16 in certain jurisdictions.

We do not knowingly collect personal information from children under the applicable age limit. If you are a parent or guardian and believe your child provided personal information, contact info@memicorn.com.

• We will promptly delete the child's personal information after verification.
• We will terminate any account associated with the child.
• We will take reasonable measures to prevent future collection from that child.

13. Cookies and Tracking Technologies

Our mobile app does not use cookies in the traditional web browser sense. We use similar technologies for app functionality and analytics where enabled.

• Local Storage: Stores preferences and session data on your device.
• Device Identifiers: Used for anonymous analytics and push notifications.
• Analytics SDKs: Firebase Analytics may collect anonymous usage data and can be disabled in settings where supported.

You can limit tracking by disabling analytics in app settings, using device privacy settings, or revoking app permissions.

14. Push Notifications

With your consent, we may send learning reminders, review schedules, achievement milestones, progress updates, important service announcements, and optional feature notifications.

• Device tokens are collected solely to deliver push notifications.
• Device tokens are stored securely and encrypted.
• Device tokens are not used for tracking or profiling.
• Device tokens are deleted when you disable notifications or delete your account.

You can disable push notifications through your device notification settings or the app settings menu.

15. Data Breach Notification

In the event of a data breach that may compromise personal information, we will notify affected users within 72 hours of discovery or as required by applicable law.

• Notification Method: Email to your registered email address and in-app notification where available.
• Information Provided: Nature of the breach, types of data involved, steps taken, and recommended protection steps.
• Regulatory Reporting: We will notify relevant data protection authorities where required by law.
• Mitigation: We will take immediate steps to secure the breach and prevent future occurrences.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in practices, technology, legal requirements, or other factors.

• Notification: Material changes will be notified by email, in-app notification, or prominent website notice.
• Review Period: For material changes, we will provide at least 30 days notice before changes take effect where practical.
• Continued Use: Your continued use of Memicorn after changes indicates acceptance of the updated policy.
• Previous Versions: We maintain prior policy versions for transparency.

17. Contact Information

For privacy-related questions, concerns, or to exercise your rights, contact us:

For GDPR-related inquiries, contact info@memicorn.com.

• EU residents: You may lodge a complaint with your local Data Protection Authority.
• UK residents: You may lodge a complaint with the Information Commissioner's Office.
• California residents: You may contact the California Privacy Protection Agency.