Privacy Policy

2. Data we process

3. Purposes and legal bases

• Contract: account creation, notebook storage, source processing, AI generation, exports, sharing and plan management.
• Consent or user choice: sending content to AI providers for requested features, using optional personal provider keys, importing from Google Drive, connecting YouTube, using microphone or TTS. When browser speech recognition is unavailable or fails, a short recording may be sent to the server and the configured transcription provider; the transcription route does not retain the audio file.
• Legitimate interests: security, abuse prevention, rate limiting, debugging, reliability improvements and support.
• Legal obligations: accounting, payments, authority requests, disputes and privacy rights.

4. Recipients and providers

Memoniq uses technical processors, managed AI providers and user-selected providers. Content is sent only when needed for the requested feature.

Some providers may process data outside the EEA. Users should also review the privacy policy and terms of any optional provider they configure.

5. Managed AI, optional provider keys and local models

• Managed AI keys are stored only as server environment secrets. They are not exposed through APIs, UI state, localStorage or data exports.
• For cloud text generation, the current managed default is DeepSeek V4 Flash through OpenRouter when configured. Memoniq may change the provider or model for reliability, quality, security or availability.
• Selecting a different OpenRouter model is an advanced option available when the user connects a compatible personal key; it does not change Memoniq plan limits.
• Managed AI usage is protected by authentication, ownership checks, rate limits, plan limits and usage counters.
• Optional provider keys are encrypted server-side with AES-256-GCM and used by the runtime only to execute requests authorized by the user.
• Keys are not shown to admins, are not printed in logs and are not included in plaintext data exports to reduce leakage risk.
• The localStorage cache makes the app smoother, but it stays in the browser: use protected devices and sign out on shared devices.
• With LM Studio/Ollama or local TTS configured by the user, processing can stay on the device. Cloud features send only the data needed to the selected provider.
• Edge TTS and other browser services may connect directly from the browser to the external provider.
• Content created or transformed with AI is identified in the interface and, for supported formats, through visible notices and provenance metadata. Details and limitations are described on the AI transparency page.

6. Cookies, localStorage and analytics

We use technical cookies required for Supabase authentication, language and security. We do not use advertising cookies or commercial profiling.

We use localStorage/sessionStorage for UI preferences, onboarding state, optional provider-key cache, audio/TTS, notebook settings and local progress. Streaks, study statistics/events, plans containing section names, and quiz or exam answers/state may also remain in the browser. On a shared device, use separate browser profiles or clear site data after signing out.

Vercel Analytics may collect aggregated technical metrics on visits and performance. We do not sell personal data or use it for behavioral advertising.

7. Retention and deletion

• Accounts, notebooks, sources and materials remain until the account is active or the user deletes them.
• Shared links remain active until revoked or until the related account/material is deleted.
• Payment data is retained by Stripe under its obligations; Memoniq stores only plan and accounting information needed for the service.
• Feedback and technical logs may be kept for security, support and improvement; if you delete your account, feedback is anonymized where possible.
• Caches, backups and infrastructure logs may require a technical deletion period.

8. Security measures

• Supabase authentication, Row Level Security and server-side ownership checks.
• Encrypted optional provider keys, TLS/HTTPS, HSTS, CSP, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
• Rate limits, plan limits, origin checks on sensitive routes, input validation, file size limits and SSRF protection for external URLs.
• Service role access is limited to server code and used only after auth/ownership verification.
• Data exports avoid plaintext API secrets and provider caches are cleared when the authenticated identity changes. Some study progress remains local to the browser; separate profiles or clearing site data are recommended on shared devices.

No system is 100% secure. If a security incident occurs, we will handle notification and communication under applicable law.

9. Your rights

Under the GDPR you may request access, rectification, deletion, restriction, portability, objection and withdrawal of consent where applicable. You can export or delete your account from Account settings.

You may also contact us by email. You have the right to lodge a complaint with the competent supervisory authority.

Non-EU users

Where local law applies, we recognize equivalent rights where required. For California users: we do not sell or share personal information for cross-context behavioral advertising; you may request access and deletion. The service is not directed to children under 13.

10. Children, sensitive data and responsibility

Memoniq is designed for university students and not for children under 13. Do not upload health data, biometric data, ID documents, children's data or highly sensitive materials unless strictly necessary and authorized.

Users are responsible for having rights to uploaded materials and for verifying AI-generated content accuracy.