Legal # Privacy Policy Effective September 1, 2026. Last updated September 1, 2026. This Privacy Policy explains how Memorize By Heart, LLC (Memorize By Heart, we, us, or our) collects, uses, stores, and shares personal information through our website, iOS and Android apps, and related services (the Service). We know that memorization content can be personal, confidential, or sensitive. We collect only the information reasonably needed for the purposes described below. We do not sell personal information, and we do not use personal content for personalized advertising. ## Information we collect The information depends on the features you choose to use. - **Account and profile information:** email address, display name, profile photo, authentication provider, account identifiers, language, country or flag selection, time zone, and account settings. - **Memorization and practice information:** text, title, author, tags, language, due dates, game results, scores, review history, progress, statistics, streaks, points, badges, challenges, notification schedules, and preferences. - **Groups and public content:** group names, invitations, membership, roles, member profile information, shared memorization content, and the progress or scores shown to members or group admins. This also includes content you publish to the public Library, your publisher display name, reports about published content, and download or use counts. - **Optional files, images, audio, and speech:** files or images selected for text extraction, recorded audio, speech input, selected text sent for natural voice generation, and generated audio. We process these only when you choose the related feature and grant any device permission it needs. - **Purchase and transaction information:** plan or product, Premium entitlement, trial, renewal, expiration, cancellation, purchase platform, price and currency, and transaction or customer identifiers. Apple, Google, or Stripe processes payment-card details. We generally do not receive full payment-card numbers. - **Device, usage, and diagnostic information:** IP address, device and browser type, operating system, app version, locale, installation or account identifiers, feature interactions, timestamps, performance information, and crash or error details. - **Communications:** messages, attachments, and account information you provide when you ask for support or make a privacy request. ## How we collect information - Directly from you when you create an account or add content. - Automatically from the website or app through cookies, local storage, software development kits, server logs, analytics, and crash tools. - From authentication, app-store, payment, and subscription providers when they confirm your identity, purchase, or entitlement. - From another user when they invite you to or interact with you in a group. ## Why we use information We use personal information to: - create and secure accounts; - store, retrieve, and synchronize content according to your selected storage mode; - run games, reviews, statistics, groups, and notifications; - provide optional file, OCR, speech, recording, and voice features; - verify subscriptions and provide paid features; - answer support and privacy requests; - detect abuse, protect accounts, diagnose failures, and maintain the Service; and - understand feature use and improve reliability without using your personal memorization text for advertising. ## How particular features handle information - **Imports and OCR:** on mobile, an image or supported file selected for OCR is sent to Google Cloud Vision to extract text. On the web, supported text, HTML, PDF, and image imports are processed in the browser by our code and included in cloud sync only if you save the resulting memorization. Browser OCR may download language and software resources needed to run. Google states that immediate Cloud Vision OCR content is processed in memory and is not used to train its models, although request metadata may be logged temporarily. - **Speech, voices, and recordings:** speech recognition and text-to-speech may be performed on the device or by Apple or Google, depending on platform settings and available system services. We use recognition results to run the selected game and do not save raw speech audio as a cloud recording unless you separately choose to record and upload it. Natural voice sends selected memorization text and voice settings to OpenAI and stores the generated audio in your cloud account. - **Groups and Library:** group members and admins can see the member, content, progress, and leaderboard information made available to their role. Public Library content, publisher display name, and basic popularity information are visible to anyone who can access the Library. Group invitations and activity may cause us to send service emails. - **Reminders and widgets:** practice reminders are scheduled as local device notifications. The mobile app does not currently obtain an Expo push token for these reminders. If you add a widget, its selected summary or memorization title may appear on a home or lock screen where another person can see it. - **Premium:** Apple, Google Play, or Stripe processes the purchase. RevenueCat receives purchase and account-linked identifiers so we can confirm Premium access across supported platforms. Deleting an account does not by itself cancel a subscription. ## Legal bases for processing Where European Economic Area or United Kingdom law applies, we rely on the legal basis appropriate to the purpose: performance of our contract to provide requested account, storage, practice, sharing, and paid features; our legitimate interests in securing, supporting, measuring, and improving the Service; consent for optional processing when the law requires it; and compliance with legal obligations. You may object to processing based on legitimate interests. We do not intentionally infer health, religion, or other sensitive traits from memorization content. Account information is needed for sign-in, cloud sync, Groups, and account-linked Premium access. If you do not provide it, you can use only the guest or local features that the applicable platform makes available. Optional camera, file, microphone, speech, notification, and sharing information is needed only for the feature you request. ## Consent and your choices Accepting our Terms is not blanket consent to unrelated uses of personal information. Where consent is required, we ask for it for the specific purpose in clear language, including express consent for sensitive personal information when required. You may withdraw consent for future use or communication, subject to legal limits. Withdrawal does not undo processing that was lawful before the withdrawal, and a feature may no longer work if the information is necessary to provide it. Some processing may occur without separate consent when the law permits it, including when it is necessary to provide a service you requested, prevent fraud, comply with law, or allow a contracted service provider to perform its assigned work under privacy obligations. - Choose cloud sync or an available local-storage mode in Settings. Turning cloud sync back on sends the local records selected for migration to our cloud database. - Do not start optional OCR, natural voice, recording, speech, notification, camera, or photo features if you do not want the related information processed. - You can decline device permissions in the operating system. The related feature may then be unavailable. - You can unsubscribe from promotional email through the link in the message. We may still send account, security, billing, or service messages. ## Cookies and storage technologies The website uses an authentication cookie to keep a signed-in session working. We also use browser local storage and IndexedDB to remember settings, cache cloud records, hold queued changes, confirm recent subscription access, and store browser-only memorization data. Firebase Analytics and related providers may use identifiers or similar technologies for measurement and diagnostics. Firebase Analytics is enabled in current production builds and can be associated with an account identifier after sign-in. We do not use it for personalized advertising. You may object to analytics processing where applicable by contacting us. Browser and device privacy controls may also limit identifiers, but can affect measurement differently by platform. You can block or clear these technologies in your browser, but sign-in, saved settings, offline access, and other features may stop working. Clearing browser data deletes browser-only records and cached copies on that browser. It does not delete a separate cloud copy. ## Service providers and disclosures Within Memorize By Heart, access is limited to authorized personnel and contractors who need information for engineering, security, customer support, billing, privacy-request, or legal work. Access is tied to job responsibilities and subject to confidentiality obligations. We disclose only the information reasonably needed for a provider to do work for us or when disclosure is otherwise permitted or required by law. Providers may include: - [Google Firebase and Google Cloud](https://firebase.google.com/support/privacy/) for authentication, cloud database and file storage, app security, analytics, crash diagnostics, server functions, email workflow, and mobile OCR. Firebase Authentication also processes account information when you use Apple or Google sign-in. Apple or Google system speech services process information when selected or enabled. - [RevenueCat](https://www.revenuecat.com/privacy-policy) for subscription status and entitlement verification. - Apple, Google Play, and [Stripe](https://stripe.com/privacy) for purchases, billing, refunds, and subscription management. - [OpenAI](https://openai.com/enterprise-privacy/) when you choose natural voice generation. The selected text is sent through the OpenAI API and generated audio is saved to your account. OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer opts in. - Apple or Google for sign-in when you choose the applicable provider. - [Vercel](https://vercel.com/legal/privacy-policy) for website hosting, [Cloudinary](https://cloudinary.com/privacy) for delivery of website media, and an email delivery provider for account, group, support, and service messages. We may also disclose information to comply with law, respond to valid legal process, protect a person or the Service, investigate abuse, or complete a business transaction under appropriate confidentiality safeguards. ## Where we process information Memorize By Heart and several providers are based in the United States. Personal information may be stored or processed in the United States, Canada, or another country where a provider operates. That country may have different privacy laws, and lawful authorities there may be able to access information. For transfers from the European Economic Area or United Kingdom, we use an available adequacy decision, contractual protections such as the European Commission's Standard Contractual Clauses or United Kingdom transfer addendum, or another lawful transfer mechanism as applicable. Contact us to ask about the safeguard relevant to your information. ## Retention and deletion - Account information and private cloud content are generally kept until you delete the item or account, unless we must keep a limited record for security, dispute, accounting, or legal reasons. - Browser-only and mobile Offline Mode records remain under your control on that browser or device until the app, account workspace, or browser data is cleared. We cannot recover a local-only copy from the cloud. - Public Library content you published may remain public after account deletion with ownership reassigned or identifying account links removed, as explained when you publish or delete your account. - Subscription, analytics, diagnostic, support, and security records are kept according to the applicable provider settings and for the period needed for the stated operational, accounting, security, or legal purpose. The self-service control in Settings deletes your sign-in account and profile and starts the product's account-removal process. To request deletion of all associated cloud records and provider-linked data, email [support@memorizebyheart.app](mailto:support@memorizebyheart.app) with the subject Account Deletion. This separate request is currently needed because the self-service control may not remove every associated record from each active system. We verify and process the request, subject to lawful exceptions. You must separately cancel a paid subscription through the platform where you purchased it. When a retention purpose ends, we delete or anonymize the information as required by law. Deletion from active systems may not immediately remove information from protected backups, but backup copies are not returned to ordinary use and expire according to the backup cycle. ## Your storage choice Signed-in users can use cloud sync. Eligible users can instead turn on **Browser-only storage** on the web or **Offline Mode** in the mobile app. - **Cloud sync:** personal memorizations, settings, practice progress, and related records are stored with our cloud service provider and can sync across supported devices. A local cache may keep previously loaded data available during a connection loss. - **Browser-only storage or Offline Mode:** new changes to personal memorizations and progress are kept in that browser or on that device and are not sent to our cloud database for sync while the setting remains on. - Turning local storage on does not automatically delete information that was already stored in the cloud. Delete individual cloud content before changing modes, use the account-deletion control, or contact us if you want an existing cloud copy removed. These settings control the storage and synchronization of personal memorization data. They do not place a device in airplane mode or disable every network request. When a connection is available, account sign-in, subscription verification, security checks, analytics, crash reporting, and online-only features may still communicate with us or our providers as described below. ## Security and privacy incidents We use access controls, provider security features, transport encryption, monitoring, and other reasonable safeguards appropriate to the information. Local-only data is also protected by your device, operating system, browser, passcode, and account security. No storage or transmission method is completely secure. We investigate suspected confidentiality incidents, take reasonable steps to reduce harm, and notify affected people and regulators when required by law. ## Children The Service is not directed to children under 13, and they may not create an account. Where local law requires parental or guardian consent for an older child, that consent is required. Contact us if you believe a child provided information without the required permission. ## Your privacy rights Depending on where you live, you may have rights to know whether we hold personal information about you, access it, correct it, request deletion, withdraw consent, object to certain uses, or receive eligible computerized information in a structured and commonly used format. Residents of the European Economic Area or United Kingdom may also ask us to restrict processing and may complain to their local data protection authority. If California law applies to us and your information, you may have rights to know, delete, correct, and receive equal service when exercising a right. We do not sell or share personal information for cross-context behavioral advertising, so we do not provide a sale or sharing opt-out. An authorized agent may submit a request where the law permits it, subject to verification. We do not use solely automated processing to make decisions that have a legal or similarly significant effect on you. Spaced-repetition timing, scores, badges, and suggestions help operate the learning features and do not determine legal rights. You may appeal a privacy-request decision where applicable law provides that right. ### Quebec If Quebec law applies: - Your personal information may be communicated and processed outside Quebec, including in the United States, elsewhere in Canada, or another country where a provider operates. - Personal information generally may not be collected from a child under 14 without consent from a parent or tutor unless the collection is clearly for the child's benefit. - We will respond to a written access or correction request within 30 days of receiving it. You may also complain to the [Commission d'accès à l'information du Québec](https://www.cai.gouv.qc.ca/protection-renseignements-personnels/citoyens-protection-renseignements-personnels/recours-devant-commission). Send a written request to the privacy contact below. We may ask for enough information to verify your identity and protect your account. If European Economic Area or United Kingdom law applies, we generally respond within one month, subject to permitted extensions. If we cannot grant a request, we will explain the reason and available recourse when required. ## Privacy questions and complaints The Person Responsible for the Protection of Personal Information at Memorize By Heart, LLC receives privacy requests and complaints. Email [support@memorizebyheart.app](mailto:support@memorizebyheart.app) with the subjectPrivacy Request, or write to Memorize By Heart, LLC, 500 S 7th St, Las Vegas, NV 89101-6904, United States. Include the account email, the right you want to exercise, and enough detail for us to investigate. Please do not send a password or full payment-card number. The privacy officer will record the request, verify identity when needed, review the relevant systems and providers, and send a written outcome or request for additional information. If a complaint is substantiated, we will take appropriate corrective steps and explain them to the extent we can without exposing another person's information or confidential security details. Contacting us does not waive a right to complain directly to a regulator. If United Kingdom data-protection complaint duties apply, we will acknowledge a complaint within 30 days, investigate it without undue delay, keep you appropriately informed, and tell you the outcome. ## Changes to this policy We may update this policy as the Service or law changes. We will post the updated date here and give notice of material changes in the Service or by another appropriate method when required. We will request new consent if a change requires it. See our [Terms and Conditions](https://memorizebyheart.app/terms-and-conditions) for the rules that apply to use of the Service. ## Source and feedback [Read this page on Memorize By Heart](https://memorizebyheart.app/privacy-policy). Found an error or a missing answer? [Contact support](mailto:support@memorizebyheart.app) with the page URL, the question, and the detail that needs a correction. Do not include passwords or private memorization text.