Privacy Policy
Last updated: 1 July 2026
This Privacy Policy explains how Remembly (“Remembly”, “we”, “us”) collects, uses, shares, and protects your personal data when you use the Remembly mobile app and website (together, the “Service”). It also explains your rights under the EU General Data Protection Regulation (“GDPR”) and equivalent laws.
1. Who is responsible for your data
The data controller for the Service is:
Vasileios Tanos
Kurfürstenstraße 73
10787 Berlin, Germany
Email: privacy@remembly.academy
We are not legally required to appoint a Data Protection Officer, but you can reach the person responsible for data protection at the email above.
2. What personal data we collect
Data you give us
| Category | Details |
|---|---|
| Account data | Your email address and a securely hashed password. If you sign in with Apple, we receive the email (which may be Apple’s private relay address) and, on your first sign-in only, the name you choose to share. |
| Profile | A display name you optionally set during onboarding, and your app language preference. |
| Learning content | The decks and flashcards you create or edit, including any text you type into them. |
Data created as you use the Service
| Category | Details |
|---|---|
| Study activity | Your progress, review history, streaks, statistics, and which decks you study — used to run spaced-repetition and show your stats. |
| Subscription status | Whether you have an active Remembly+ subscription and its type, provided to us by Apple and our subscriptions provider (RevenueCat). We never receive or store your card or payment details — payment is handled entirely by Apple. |
| Technical and analytics data | Basic technical and product-usage information needed to operate, secure, and improve the Service (e.g. app version, device type, screen views, onboarding steps, study sessions, paywall interactions, and feature usage). We do not use advertising trackers, and we do not send flashcard text, uploaded files, email addresses, or payment details to analytics providers. |
3. Why we use your data and our legal bases
Under the GDPR we must have a lawful basis for each use of your data:
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and run your account; provide the study features you ask for; sync your decks and progress across devices | Performance of a contract (Art. 6(1)(b)) |
| Process and validate your subscription and entitlements | Performance of a contract (Art. 6(1)(b)) |
| Keep the Service secure, prevent abuse, fix errors | Legitimate interests (Art. 6(1)(f)) |
| Understand product usage and improve onboarding, study, reminder, and subscription flows | Legitimate interests (Art. 6(1)(f)) |
| Comply with legal, tax, and accounting obligations | Legal obligation (Art. 6(1)(c)) |
| Send you a password-reset or account email you request | Performance of a contract (Art. 6(1)(b)) |
Where we ever rely on consent (for example, if we add optional features in future), you can withdraw it at any time without affecting processing already carried out.
4. Your decks are private
The decks and cards you create are private to your account. They are visible only to you, are protected by strict per-user access controls in our database, and are not shared publicly, sold, or made available to other users. Privacy is the default for everyone and is not a paid feature.
Some decks in the app are curated or featured learning content provided by Remembly. That content is created or selected by us and is not built from other users’ private decks.
5. Who we share your data with
We do not sell your personal data. We share it only with service providers (“processors”) that help us run the Service, under contracts that require them to protect it:
| Provider | Role |
|---|---|
| Supabase | Database, authentication, and hosting of your account and learning data. Hosted in the EU (European Economic Area). |
| Apple | Sign in with Apple, App Store distribution, and all subscription payments. |
| RevenueCat | Manages and validates subscription status and entitlements (United States). |
| TelemetryDeck | Privacy-focused product analytics used to understand aggregate app usage and improve the Service (Germany / European Union). |
| Vercel | Hosting for our website and, where applicable, the web app (United States / global edge). |
We may also disclose data where legally required (e.g. to comply with a valid legal request), or to establish, exercise, or defend legal claims, or to protect the rights and safety of our users.
6. International data transfers
Some of our providers are based outside the European Economic Area (EEA), for example in the United States. Where your personal data is transferred outside the EEA, we rely on appropriate safeguards recognised under the GDPR — in particular the European Commission’s Standard Contractual Clauses — so that your data remains protected. You can ask us for more information using the contact details below.
7. How long we keep your data
- We keep your account and learning data for as long as your account exists.
- When you delete your account, we delete your personal data and your decks from the live Service (see section 10). Backups are overwritten on a rolling basis within 30 days.
- We may retain limited records (such as transaction records) for as long as required by law (e.g. tax and accounting rules).
8. How we protect your data
Data is transmitted over encrypted connections (HTTPS/TLS) and stored on infrastructure operated by reputable providers with access controls. Passwords are stored only in hashed form. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data, and we will notify you and the competent authority of a personal data breach where the law requires.
9. Your rights
If the GDPR (or a similar law) applies to you, you have the right to:
- Access — get a copy of the personal data we hold about you;
- Rectification — correct inaccurate or incomplete data;
- Erasure — have your data deleted (“right to be forgotten”);
- Restriction — limit how we use your data in certain cases;
- Portability — receive your data in a structured, machine-readable format;
- Object — object to processing based on our legitimate interests;
- Withdraw consent — where we rely on consent.
To exercise any of these rights, email privacy@remembly.academy. We will respond within the time limits set by law (normally one month). You also have the right to lodge a complaint with a data protection authority. Our competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit) (www.datenschutz-berlin.de); if you live elsewhere in the EU, you may instead contact your own national authority.
10. Deleting your account and data
You can delete your account at any time from within the app: Settings → Delete account. This permanently removes your account, your decks, and your learning data from the Service. You can also ask us to do this by emailing privacy@remembly.academy. Note that deleting your account does not automatically cancel an App Store subscription — manage that in your Apple Settings → [your name] → Subscriptions.
11. Children
The Service is not directed at young children. You must be at least 16 years old (or the minimum age of digital consent in your country, if higher) to create an account. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app or by email. Continuing to use the Service after an update means you accept the revised policy.
13. Contact us
Questions or requests about your privacy? Email privacy@remembly.academy.