← Back to home

Privacy Policy

Effective Date: November 10, 2025

Last updated: August 13, 2026

This privacy policy applies to the Memorize - Memory Training mobile application (hereinafter referred to as "the Application") developed by Guillaume Kervran (hereinafter referred to as "the Developer" or "we") as a freemium service. This application is provided "AS IS".

Where to find this policy

• In the app: Profile > Settings > Privacy Policy
• Online: Link to the page
• On stores: Link in the app description (Google Play / Apple App Store)

1. Information We Collect

1.1 Information You Provide

When you create an account on Memorize, we collect the following information:

• Email address (required for authentication)
• First and last name (optional)
• Display name/username (for your public profile)
• User preferences (app settings)

1.2 Information Collected Automatically

1.2.1 Performance and Training Data

Memorize is a competitive speed memory training application. We automatically collect:

• Scores and performances: your results for each training session
• Memorization speed: time required to memorize information sequences
• Rankings and statistics: your position in rankings by discipline
• Best scores: your personal records per game mode

1.2.2 Usage Data

• Game sessions: dates, times, and duration of use
• Rounds completed: history of your training sessions

1.2.3 Optional Usage Analytics

If you consent, we collect limited data to understand how Memorize is used and improve its user journeys:

• Opening the Application
• Selected training discipline and mode
• General training settings, such as duration or number of items
• Progression between the memorization and recall stages
• Training completion, score, memorization time, and whether a personal record was achieved
• Display of the sign-up prompt and confirmation of sign-up
• Authentication provider used
• Application version, operating system, and general technical display characteristics

Before you sign in, this data is associated with a random identifier generated for the installation. After you sign in, it may be associated with the pseudonymous identifier of your Memorize account. Events collected before sign-in may then be linked to the same journey.

We may also associate the sign-up date, authentication provider, and email confirmation status with this pseudonymous profile. The email address itself is not transmitted to the usage analytics service.

In this context, we never transmit your email address, first name, last name, username, the content of your answers, sequences to be memorized, or any other text you enter.

These analytics are disabled by default. They are activated only after you consent and can be disabled at any time from the settings, without losing any functionality.

1.2.4 Subscription Data

• Premium status: active subscriber or free user
• Subscription history: start dates, renewal, cancellation
• Subscription type: monthly or annual
• Information required to verify purchases: product or offering purchased, receipt or transaction data provided by Apple or Google, expiration dates, and associated entitlements

1.3 Technical Identifiers

To ensure the proper functioning of the Application and manage your subscriptions, we collect only strictly necessary technical identifiers:

• Pseudonymous Memorize account identifier (UUID): generated when the account is created and used by Memorize to identify it. It is transmitted to RevenueCat to synchronize the subscription and, only with your consent, to the optional usage analytics service.
• Random RevenueCat identifier: when the subscription service is initialized before you sign in, RevenueCat generates and locally stores a random pseudonymous identifier. It may subsequently be linked to your account UUID to maintain continuity of your purchases and entitlements.
• Random usage analytics identifier: only if you consent to optional usage analytics, the SDK generates a random pseudonymous identifier on your device. After sign-in, it may be linked to your account UUID to maintain journey continuity. It is reset when you sign out.
• IDFV (Identifier for Vendors on iOS): this technical device identifier is automatically transmitted to RevenueCat as part of the operation of the purchase and subscription management service. It is not the IDFA advertising identifier.

These identifiers are used only for the purposes specified above: identifying the account, maintaining subscription continuity and, with your consent, measuring use of the Application. Memorize does not collect or transmit IDFA, Google Advertising ID, or Android ID to its service providers.

1.4 Technical Access and Application Permissions

To operate correctly, Memorize uses the following technical access. Internal local storage and Internet connectivity do not trigger any sensitive permission request.

Required Technical Access:

• Internal local storage: used to retain certain preferences, your usage analytics choice, and temporary data required for the Application to operate. This private storage does not require access to your files, photos, or the device's shared storage.
• Internet: to sync your scores and connect to your account

Sensitive Permissions We Do Not Request:

• ❌ Location / GPS
• ❌ Camera
• ❌ Microphone
• ❌ Contacts
• ❌ Photos / Gallery
• ❌ SMS / Phone calls

1.5 Location

The Application does not collect precise geolocation data.

1.6 Public Data Visible to Other Users

Always publicly visible:

• Your display name/username
• Your best scores by discipline
• Your position in general and discipline rankings
• Your performance statistics (records)

Visible to friends only: Your recent progress, training sessions, score improvement notifications.

Not publicly visible: Your email address, first/last name (if different from username), detailed error statistics, payment history.

2. How We Use Your Information

We use the collected information to:

• Provide the service: create and manage your account, save your progress
• Personalize your experience: adapt training content to your level
• Create leaderboards: generate public rankings based on performances
• Subscription management: process your payments and manage your premium status
• Optional usage analytics: with your consent, understand the journeys used, identify where users leave those journeys, and improve the Application's features
• Ensure security: detect and prevent fraud, abuse, and violations of our terms of service
• Communication: send you important information about your account and the Application
• Technical support: resolve your issues and answer your questions
• Marketing (with your consent): inform you of new features, promotional offers, and content

We never sell your personal data to third parties.

3. Sharing Your Information with Third Parties

We only share your information with the following service providers, which are necessary for the operation of the Application:

3.1 Infrastructure Services

Supabase (hosting and authentication)

• Data stored in France (region eu-west-3, Paris, via AWS)
• Shared data: email, login credentials, profile data, training statistics
• Supabase Privacy Policy

3.2 Optional Usage Analytics Service

PostHog (analysis of Application usage)

• Role: processor responsible for processing usage analytics data solely on our instructions
• Activation: only after your explicit consent
• Primary hosting: PostHog Cloud EU in Frankfurt, Germany
• Data transmitted: pseudonymous identifier, events and properties described in section 1.2.3, Application version, operating system, and general technical display characteristics
• Data excluded: email address, first name, last name, username, and entered content
• The IP address is not retained and no geolocation is derived from it
• Session recording, screenshots, and advertising tracking are disabled
• Processing is governed by a data processing agreement
• PostHog Privacy Policy

3.3 Payment Services

RevenueCat (subscription management)

• Location: United States
• Identifiers processed: a random pseudonymous identifier generated by RevenueCat before you sign in, followed by the pseudonymous identifier of your Memorize account (UUID) after you sign in; these identifiers may be linked to maintain subscription continuity
• Purchase and subscription data: product or offering purchased, receipt or transaction data provided by Apple or Google, history, status, expiration dates, and entitlements
• Purposes: verifying and restoring purchases, synchronizing the subscription, and enabling premium features
• Memorize does not transmit any email address, first name, last name, or advertising identifier to RevenueCat
• RevenueCat Privacy Policy

Payment Platforms

• Google Play Store (Android) and Apple App Store (iOS) process payments directly
• We never receive your payment information (credit card, banking details)
• These platforms apply their own privacy policies

3.4 Communication Services (future)

We plan to use emailing services for transactional and marketing communications (with your consent). You will be informed and can unsubscribe at any time.

3.5 Legal Disclosure

We may disclose your information if required by law, legal proceedings, government requests, or to protect our rights and safety.

4. Your Rights (GDPR)

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

• Right of Access: Request a copy of all personal data we hold about you.
• Right of Rectification: Correct your personal information directly in the App settings.
• Right to Erasure: Request deletion of your account (see below).
• Right to Data Portability: Receive your data in JSON or CSV format.
• Right to Object and Restriction.

4.1 Optional Usage Analytics

You may withdraw your consent at any time from Profile > Settings > Optional usage analytics. Withdrawal applies to future collection and does not limit any Application functionality.

Withdrawing consent does not automatically delete data already collected. To request access to or deletion of this data without deleting your account, contact us at guillaumekervran@gmail.com.

When you delete your account from the Application, usage analytics data associated with your account's pseudonymous identifier is also scheduled for deletion by our processor. This deletion may require technical processing time.

4.2 Right to Erasure ("right to be forgotten")

How to delete your account:

• In the Application: From the homepage of the application, while being connected > Profile > Manage my profile > Delete my account
• By email: Contact us at guillaumekervran@gmail.com

When you delete your account, we delete all your personal data, scores, history, and credentials.

4.3 Exercising Your Rights

To exercise any of these rights, contact us at guillaumekervran@gmail.com. We will respond within 30 days.

5. Data Retention

• Active account data: retained as long as your account is active.
• Data after account deletion: deleted within 30 days.
• Billing data: retained 10 years (French accounting laws).
• Security logs: retained 12 months for fraud detection.

6. Data Security

• Encryption: In transit (HTTPS/TLS 1.3) and at rest (AES-256).
• Authentication: Secure password management via Supabase Auth (bcrypt).
• Infrastructure: Secure hosting (Supabase/AWS).
• Breach Notification: We will inform you within 72 hours in case of a breach affecting your data.

7. Age Requirements and Protection of Minors

Our Service is not intended for children under 13 years of age.

• We do not knowingly collect personal information from children under 13.
• If you are a parent and discover that your child has provided us with personal data, please contact us immediately for deletion.
• Users between 13 and 16 years of age in the EU must obtain parental consent before using the Service.

8. International Data Transfers

8.1 Data Localization

Primary Storage
Your personal data is stored on servers located in France (Paris region - eu-west-3) via the Supabase/AWS infrastructure.

Optional usage analytics
When you consent, the usage analytics data described in section 1.2.3 is primarily hosted by PostHog Cloud EU in Frankfurt, Germany. It is associated with pseudonymous identifiers rather than your email address or name.

Limited Transfers to the United States
Some of our service providers may process data in the United States under the conditions described below:

• RevenueCat: a random pseudonymous RevenueCat identifier or the pseudonymous Memorize account identifier (UUID), and purchase and subscription information, including the product or offering purchased, receipt or transaction data provided by Apple or Google, history, status, expiration dates, and entitlements
• This data is necessary to verify and restore purchases, synchronize the subscription, and enable premium features; Memorize does not transmit any email address, first name, last name, or advertising identifier to RevenueCat
• PostHog: although usage analytics data is primarily hosted in the European Union, PostHog and some of its subprocessors may carry out limited processing outside the European Economic Area, including in the United States, to provide, secure, and support the service. This processing remains limited to the pseudonymous data described in this policy.

8.2 Protection Guarantees

These transfers to the United States are governed by the following protection mechanisms:

Standard Contractual Clauses (SCCs)

• We use Standard Contractual Clauses approved by the European Commission
• These clauses guarantee a level of protection equivalent to the European GDPR
• The DPA signed with PostHog incorporates the Standard Contractual Clauses adopted by the European Commission, with Memorize as controller and PostHog as processor. RevenueCat's DPA also provides for the application of the Standard Contractual Clauses to the relevant transfers.

Security Certifications

• PostHog products are covered by a SOC 2 Type II report following an independent audit
• RevenueCat states that it undergoes an annual SOC 2 Type II audit
• AWS, used for the Supabase and RevenueCat infrastructure, holds certifications including ISO 27001 and provides SOC 1, SOC 2, and SOC 3 reports
• These certifications and reports cover the controls of the relevant service providers; they do not replace our own security and GDPR compliance obligations

Data Privacy Framework (DPF)

• RevenueCat participates in the EU-US Data Privacy Framework, offering additional guarantees for EU-US transfers
• PostHog states that it participates in the EU-US Data Privacy Framework, its UK Extension, and the Swiss-US Data Privacy Framework. Its DPA provides that the Standard Contractual Clauses also remain applicable and that an alternative transfer solution must be used if this mechanism ceases to be valid.
• Verify DPF certification

8.3 Data Minimization

We minimize international transfers to the maximum extent possible:

• Account, profile, and training data is primarily hosted in France, while optional usage analytics data is primarily hosted in the European Union
• We configure each service to limit transmitted data to what is strictly necessary for its purpose
• Data transmitted to PostHog is limited to pseudonymous identifiers and the events described in section 1.2.3; no email address, name, or entered content is transmitted
• Data transmitted to the subscription management service is limited to the account's pseudonymous identifier and the information necessary to manage purchase entitlements and subscription status
• No advertising identifier, entered training content, or bank payment data is transmitted to these services

8.4 Your Rights

You retain all your GDPR rights regarding your data, including data transferred outside the EU:

• Right to be informed of the destination countries and the safeguards governing transfers
• Right to obtain information about the applicable appropriate safeguards, including the Standard Contractual Clauses
• Right of access, rectification, erasure, restriction, objection to processing where the legal conditions are met, and data portability
• Right to withdraw your consent to optional usage analytics at any time
• Right to lodge a complaint with the competent data protection authority (CNIL)
• Right, where applicable, to exercise the remedies provided by the relevant transfer mechanisms

For any questions, contact us: guillaumekervran@gmail.com

9. Managing Your Subscription

Memorize offers two premium subscription plans:

• Monthly subscription.
• Annual subscription.

Prices are displayed within the application and on the respective stores (Google Play Store / Apple App Store) in your local currency.

Canceling Your Subscription

• Android: Google Play Store > Subscriptions > Memorize > Cancel
• iOS: Settings > [Your name] > Subscriptions > Memorize > Cancel

Refund Policy: 14-day EU right of withdrawal (if service unused). Contact us at guillaumekervran@gmail.com.

10. Local Storage and Tracking Technologies

10.1 Storage on Your Device

The Application stores certain data directly on your device to enhance your experience:

• Authentication Token: stored securely (Keychain on iOS, Keystore on Android) to maintain your logged-in session
• User Preferences: language, theme, training settings
• Temporary Cache: recent training results for offline viewing (automatically cleared after 7 days)

This data remains on your device and is only synchronized with our servers when necessary.

10.2 Usage Analytics and No Advertising Tracking

The Application does not contain any advertising tracking technology:

• No advertising identifiers
• No third-party advertising
• No tracking of your activity across different applications or websites
• No sale of data
• No session recording or screenshots

The optional usage analytics described in this policy is used exclusively to understand journeys within Memorize and improve the Application. It is disabled by default and operates only after your explicit consent.

It is not used to display advertising, create an advertising profile, make automated decisions about you, or track your activity outside Memorize.

10.3 Management of Local Data

You can clear locally stored data at any time:

• Logging out: clears the authentication token
• Deleting the Application: permanently clears all local data

11. Communications

With your consent, we may send you informative emails regarding:

• New features of Memorize
• Tips on memorization techniques
• Competitions and community challenges

You can unsubscribe at any time via the link in each email or in the Application settings.

We do not send any third-party advertising.

12. Changes to This Policy

We may update this policy. We will notify you of any significant change through the Application or by email. When a change requires renewed consent, we will ask you to make a new choice before activating the relevant processing.

13. Legal Basis for Processing (GDPR)

Data Type	Legal Basis
Account and authentication	Contract performance
Scores and performances	Contract performance
Subscription and payments	Contract performance
Billing data	Legal obligation
Security and fraud	Legitimate interest
Optional usage analytics	Consent — Article 6(1)(a) GDPR

14. Contact and Complaints

Guillaume Kervran
Email: guillaumekervran@gmail.com
Country: France

You have the right to file a complaint with the CNIL (https://www.cnil.fr/).

15. Consent

The general operation of Memorize does not rely on blanket consent to all processing described in this policy. Each processing activity relies on the legal basis specified in section 13.

Optional usage analytics is activated only after you make an explicit choice. You may decline it without losing any functionality and withdraw your consent at any time from the Application settings.

Withdrawing consent stops future collection for these usage analytics. It does not affect the lawfulness of processing carried out before the withdrawal.

16. Key Points Summary

• Hosting: Account, profile, and training data is primarily hosted in France. Optional usage analytics is primarily hosted in the European Union. Some limited processing may take place in the United States under the safeguards described in this policy.
• Security: Strong encryption, no data selling.
• Public data: Username and scores are public.
• Subscriptions: Managed via Stores, cancel anytime.
• Permissions: No sensitive permission is requested; preferences and temporary data are retained in the Application's private local storage.

17. Data Safety Compliance Statement

This policy will serve as the reference for the next update of the Google Play Data Safety and Apple App Privacy disclosures. Those disclosures must remain consistent with the practices described in this document and be updated whenever those practices change.