Privacy policy

Last updated: [date]

This policy explains what personal data Memoraise (memoraise.app) processes, why, for how long, and what rights you have. It follows the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Who is responsible

The controller responsible for your data is:
[Your full name]
[Street and number], [postcode and city], Austria
Email: [contact email, e.g. privacy@memoraise.app]

For any question about your data, or to use your rights (section 8), write to that address.

2. What Memoraise processes

Your account

• Your username and email address, and whether you have confirmed the email address.
• Your password, stored only as a scrambled value (a salted scrypt hash). Nobody, including us, can read your password.
• The date you created your account.
• Your profile picture, if you choose one: either a ready-made avatar or a photo you upload.
• Your time zone (for example "Europe/Vienna"), as your browser reports it, so that each day's reviews start at your own midnight.

What you create and study

• Your decks: their names, descriptions, colours and daily limits.
• Your cards: the text and any pictures on them.
• Your study progress: which box each card is in, when it was last reviewed and when it is due again, and your answer from the same day (so that it can be changed).
• For pictures you upload: their file type, size and upload date.

Logging in

• When you log in, a random login key is created. The server stores it only as a scrambled value, with when it was created and when it ends: after one day, or after 30 days if you choose "Keep me logged in".
• Links in our emails (to confirm your email address or choose a new password) contain a similar key, which also ends: after 24 hours, or 1 hour for a new password.

Technical data

• Your IP address, kept only in the server's memory for up to 15 minutes, to limit how often someone can try passwords or ask for emails. It is not saved.
• Error messages in the server's log when something goes wrong. These are technical details and normally contain no personal data.
• Our hosting provider (section 4) may keep its own access logs, which include IP addresses, for [the period the hosting provider states].

Emails

We only send emails that the service needs: confirming your email address after you sign up, and resetting your password when you ask for it. There is no newsletter and no advertising.

Guest mode

If you use Memoraise as a guest, your trial deck and its pictures stay in your browser and are never sent to our server. They are gone when you close or reload the page.

3. Why, and on what legal basis

• To provide the service you signed up for (your account, decks, cards, study schedule, time zone, logging in and the account emails): GDPR Article 6(1)(b), performing our contract with you.
• To keep the service secure (limiting password guessing, error logs, hashed passwords and login keys): GDPR Article 6(1)(f), our legitimate interest in protecting your account and the service.
• Backups, so your data isn't lost if a disk fails: GDPR Article 6(1)(b) and (f).

Memoraise has no advertising, no analytics or tracking, and loads nothing from other websites. Your data is not sold or used for profiling.

4. Who else processes your data

We use these service providers, who process data only on our behalf and under a data processing agreement:

• Hosting: [hosting provider, e.g. Railway Corp. or Fly.io, Inc.], which runs the server and stores the database and pictures, in [data centre region, ideally in the EU, e.g. Frankfurt or Amsterdam].
• Email: Resend, Inc. (USA), which delivers the account emails. It receives your email address and the email's content.
• Backups: [backup storage provider and region].

Where a provider is in a country outside the EU, such as the USA, data is transferred on the basis of [the EU–US Data Privacy Framework, if the provider is certified, or the EU standard contractual clauses (GDPR Article 46) — check each provider's terms].

We only pass data to authorities if the law requires us to.

5. Storage in your browser

Memoraise uses no cookies. It keeps a few small items in your browser's storage:

• Your login key, so you stay logged in (until the browser is closed, or for 30 days with "Keep me logged in").
• Your username or email, only if you choose "Remember my username or email".
• The deck you last opened, so the app opens it again.
• Whether you have seen the welcome page in this tab.

These are strictly necessary for the service you asked for, so no consent is needed for them (§ 165(3) of the Austrian Telecommunications Act, TKG 2021). Logging out removes the login key.

6. How long data is kept

• Your account, decks, cards, pictures and progress: until you delete them, or delete your account.
• Login keys: until they end (1 or 30 days), then removed within 6 hours. Logging out ends the key at once.
• Email link keys: until used or ended (24 hours, or 1 hour), then removed within 6 hours.
• Pictures uploaded for a card that was never saved: removed after about a day.
• IP addresses for limiting login attempts: up to 15 minutes, in memory only.
• Backups: up to [30] days, after which deleted data is gone from them too.

7. Deleting your account

In My Account you can delete your account at any time. This immediately deletes your account, all your decks, cards, pictures and study progress, and logs you out everywhere. Copies in backups are removed as the backups expire (section 6).

8. Your rights

You have the right to:

• get a copy of the personal data we hold about you (GDPR Article 15);
• have wrong data corrected (Article 16); you can change your username yourself in My Account;
• have your data deleted (Article 17); you can delete your account yourself;
• restrict how we process your data (Article 18);
• receive your data in a common format (Article 20); you can download each deck yourself, as a CSV file or as a .zip file with its pictures;
• object to processing based on our legitimate interests (Article 21).

To use these rights, write to the address in section 1. We answer within one month.

You also have the right to complain to a data protection authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

9. Security

Connections to Memoraise are encrypted (HTTPS). Passwords and login keys are stored only as hashes. Pictures are checked to be real images. The page only runs Memoraise's own code.

10. Children

Memoraise is meant for people aged [14] and over. [Check with your reviewer whether younger users need a parent's agreement, and how to handle it.]

11. Changes to this policy

If this policy changes, the new version is published on this page with its date. For important changes, we will tell you by email or in the app.