PRIVACY POLICY

1. Information We Collect

Account information. When you sign up, we collect your email address. If you sign in with Google or Apple, we receive a basic authentication identifier from that provider. Passwords are handled by our authentication provider (Supabase Auth) and are never stored by us in plaintext.

Training data. The content you create and the results you produce while training are stored so the Service can work: your routes (memory journeys), places (locations within them), word lists, test and time-attack results, streaks, and onboarding preferences.

Notification data. If you enable training reminders, the app schedules them locally on your device. We store only your reminder settings — whether reminders are on and the time you choose — so the schedule can be restored across your devices; which days they fall on follows from the practice frequency you picked during onboarding. We do not collect or store a push notification token.

Feedback you send. When you submit feedback or a bug report from within the app, we store the message you write, an anonymous device identifier, and basic technical details (such as your platform and app version) so we can understand and act on it. Please avoid including sensitive personal information in the message itself.

Usage data. To understand how people get started and to improve onboarding, we record which onboarding screens you reach, together with an anonymous device identifier, your platform, and your app version. If you are signed in, these records may also be associated with your account; we remove that association when you delete your account. This is first-party measurement only — we do not use third-party analytics (Section 2 explains what we mean by that term), we do not use these records to identify you, and we never sell them or share them for advertising.

Crash and error diagnostics. When the app crashes or runs into an error, it sends an automatic report so we can find and fix the problem. A report contains the technical details of the failure — the error message and the stack trace, an error code from our database where one applies, and basic technical information about the device and app state at that moment (such as your device model, operating system version, app version, locale, time zone, and available memory and storage) — along with a short trail of the requests the app had just made, from which we strip anything that identifies you or your account.

We do not attach your account identifier to these reports, and we do not send the routes, places, word lists, or test answers you create. Because an error message is written by whichever component failed, we cannot rule out that a fragment of text you entered appears inside one. These reports are diagnostic, not behavioral: they are never used to build a profile of you or to measure how you use the app.

Subscription verification. To confirm whether your subscription is active, we work with a payment verification provider. Every request its software makes carries the vendor identifier that Apple assigns to this app on your device; once you are signed in, it also receives your account identifier. Section 5 describes what that provider does with them.

2. How We Use Your Information

We use your information solely to provide and improve the Service: to authenticate you, to sync your routes and training data across devices, to show your progress and statistics, to deliver reminders you have enabled, to diagnose crashes and errors so that we can fix them, and to respond to support requests you send us.

We do not use your data for advertising, and we do not run third-party analytics on your activity. By "third-party analytics" we mean services that track or profile what you do in order to target or measure you; the providers described in Sections 3 through 5, which store your data, diagnose crashes, and verify your subscription on our behalf, are not analytics services in that sense.

3. Where Your Data Is Stored

Your account and training data are stored in a managed PostgreSQL database and authentication service provided by Supabase. Data is encrypted in transit between your device and our servers, and access to your data is restricted by row-level security so that only your account can read it.

Crash and error diagnostics are handled separately from your account data. They are processed on our behalf by Sentry (Functional Software, Inc.) on servers in the United States, and are retained there only for the limited period that service keeps them before deleting them automatically.

4. Sharing of Information

We do not sell your personal information, and we do not share it with advertising networks or with analytics companies that build profiles of users.

Your data is shared only with the service providers needed to run the Service — Supabase for database and authentication hosting, Sentry (Functional Software, Inc.) for crash and error diagnostics, and RevenueCat (RevenueCat, Inc.) for keeping track of subscription status — and where disclosure is required by law or a valid legal process. Each of these providers may use the data only to perform that function for us.

5. Payments and Subscriptions

Mnemarch offers paid features through in-app purchases. Payments are handled entirely by the Apple App Store. We never receive or store your card details, and we keep no record of your purchases in our own database.

To know whether your subscription is currently active, we use RevenueCat (RevenueCat, Inc.). Once you are signed in, we pass your account identifier to RevenueCat so that a subscription you bought on one device is recognized on your others; before you sign in, RevenueCat uses an anonymous identifier of its own. RevenueCat verifies the purchase receipt issued by the App Store and tells the app whether your subscription is active. Every request its software makes carries the vendor identifier that Apple assigns to this app on your device; that identifier is not an advertising identifier. As described in Section 4, RevenueCat may use the information it receives only to perform this function for us. RevenueCat does not receive your routes, places, word lists, or test results.

6. Data Retention

We keep your account and training data for as long as your account is active. If you delete your account, your account and training data are permanently removed as described in the next section, except for the limited records noted there.

7. Your Rights and Account Deletion

You may request access to or correction of your personal information by contacting us at the address below.

You can permanently delete your account at any time using the Delete Account option in the app settings. Deletion removes your account together with all routes, places, word lists, test and time-attack results, and statistics. This action cannot be undone.

We may retain usage records and any feedback you previously submitted in a form that is no longer linked to your account, for product improvement and abuse prevention.

Two things are outside our reach when you delete your account. Deleting your account does not cancel a subscription — you can manage or cancel it at any time in your App Store account settings — and the purchase records held by Apple and by RevenueCat are kept under their own retention rules rather than ours. Crash and error diagnostics already carry no account identifier, so there is no association to remove; they are deleted automatically when their retention period ends.

8. Children's Privacy

The Service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us and we will delete it.

9. Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) setting. The Service does not engage in cross-site tracking, behavioral advertising, or third-party analytics, so there is no tracking to disable. Accordingly, the Service does not change its behavior in response to DNT signals. This does not affect the limited technical identifiers our service providers receive in order to perform their functions, as described in Sections 3 through 5.

10. Changes to This Policy

We may update this policy from time to time. The "Updated" date at the top of this page shows when it was last revised, and each revised version takes effect as of that date unless stated otherwise. Material changes will be announced within the app or on this website before they take effect.

11. Contact

For questions about this policy or your data, contact us at support@mnemarch.com.