Privacy Policy

Last updated: 2026-10-21.

Beta: Mneme is in closed beta, so this policy is not final. The services and processors described below can still change as the app develops. Changes appear here with a new date above, and anything that materially affects how your data is handled is emailed to you first.

This policy covers both this website and the Mneme desktop app.

Controller

Jason Lang, Marktstraße 40, 6850 Dornbirn, Austria. Email: hello [at] jware.at. Full details in the Impressum.

What the website processes

Waitlist (Brevo): Your email address, when you submit the waitlist form. No name, no other details. Legal basis: consent (Art. 6(1)(a) GDPR), confirmed by double opt-in. Purpose: occasional updates about Mneme. Retention: until you unsubscribe or the list is discontinued; every email includes an unsubscribe link.

Beta signup (/beta): When you apply to test Mneme, we process the answers you give on that form: your name, email address, operating system, and optionally your field of study, semester, current study method and a free-text note. Legal basis: consent (Art. 6(1)(a) GDPR). Purpose: selecting testers and contacting you about the beta. The application is stored on our own infrastructure (Cloudflare); a "we received your application" email is sent via Brevo. Ticking the separate newsletter box additionally adds your email to the waitlist above under its own double opt-in. Retention: until the beta programme ends, or sooner on request. Turnstile, Cloudflare's privacy-preserving bot check, runs on that page and sets no tracking cookie.

Site analytics (PostHog, EU): Aggregate, cookie-free metrics: page views, scroll depth, how long each page section was on screen, referrer, which waitlist and download steps people reach, and uncaught script errors. No cookie is set and nothing is stored in your browser. To count visits without a cookie, PostHog derives a temporary identifier on its own servers from your IP address and browser, which it rotates and discards every 24 hours; your IP address itself is not retained. Activity is therefore at most connectable within a single day, and never across days or to your email address. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in understanding and improving the page.

Site analytics (Cloudflare Web Analytics): Cloudflare, which delivers this site, also counts visits: page address, referrer, country, browser and device type, and how fast the page loaded. No cookie is set, nothing is stored in your browser, and no fingerprint is built; Cloudflare does not use your IP address to identify you. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in understanding and improving the page.

Server logs and monitoring: Every request to mneme.jware.at is logged by our web server with your IP address, time, requested page (without query parameters), status code, referrer and browser identifier, plus your tester email when you sign in on the download page. Error logs of our sign-in server, which can contain an email address, are kept the same way. These logs go to Grafana Labs (Grafana Cloud, EU region), which we use to detect outages and trace problems. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in operating the service securely and fixing faults. Retention: 14 days, then deleted automatically.

What the app processes

Study content: Decks, cards, and study history live entirely in a local SQLite database on your device and are never uploaded.

Sign-in (optional): Signing in with Google or email/password processes your email, name, and profile picture URL (Google) or email and password hash (email/password, hosted on our own server). Legal basis: performance of a contract (Art. 6(1)(b) GDPR) to provide Mneme Pro and the AI subscriptions.

License checks: Checking Mneme Pro and AI subscription status sends an access token to our server (ai.mneme.jware.at), at most every 30 days. Legal basis: performance of a contract.

AI features (optional, disclosed before first use): If you bring your own API key (OpenAI, Anthropic, a self-hosted Ollama server, or a custom endpoint), your source text and card content go directly to the provider you chose, never through our servers. If you use Mneme's hosted AI, that same content (and, for "Add spoken audio", the card text to be spoken) is sent to our server and forwarded to Mistral AI (France), which processes it on our behalf to generate a response, on servers in the EU/EEA (France, Sweden, Norway, the Netherlands, Belgium). Any access to it from outside the EEA by Mistral's own service providers (e.g. for security or network routing) relies on an adequacy decision or Standard Contractual Clauses under our data processing agreement with Mistral. Mistral does not use it to train its models and deletes it after 30 days; it keeps it that long only to detect abuse of its service. You're shown a notice in the app before the first request to any given provider. Legal basis: consent (Art. 6(1)(a) GDPR), obtained through that in-app notice before the first request to a provider.

Usage analytics (optional, off by default): With your explicit consent, the app reports anonymous feature usage and coarse error categories under a randomly generated identifier not linked to your identity (EU-hosted PostHog), together with the name of the deck involved, its tag label (e.g. "Medical"), if you've set one, and which broad subject category it falls into (e.g. Language, Medicine, Law) from a fixed list, computed on your device. What's in your cards and notes is never included. A separate, also off-by-default consent lets you additionally share screen recordings of your interaction; card and note content is technically masked in those recordings. Both are revocable anytime in Settings > Privacy. Legal basis: consent (Art. 6(1)(a) GDPR).

Recipients

Brevo (email delivery, EU), PostHog (analytics, EU), Cloudflare (delivery of this site, hosting for our server-side functions, site analytics), Grafana Labs (server monitoring and logs, EU), LemonSqueezy (payment processing as Merchant of Record), Google (if you sign in with Google), and, only when you use Mneme's hosted AI, Mistral AI (AI model provider, EU/EEA). A full list with processing purposes is kept internally in our processor record.

Cloudflare, Google, and LemonSqueezy are US companies, and Cloudflare routes requests (including those to our server) through its nearest data center, which can be outside the EU. Transfers to them rely on the EU-US Data Privacy Framework (Art. 45 GDPR) or, where a recipient isn't certified under it, Standard Contractual Clauses (Art. 46 GDPR).

Retention

Account data: until you delete your account. License and usage data kept for billing purposes: for the duration of applicable statutory retention periods. Server logs: 14 days. Local app data: solely under your own control, deletable anytime via Settings > Data.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15-21 GDPR), and the right to withdraw any consent at any time with future effect. Write to hello [at] jware.at for any of these.

You also have the right to lodge a complaint with the Austrian data protection authority: www.dsb.gv.at.

Cookies

This website sets no cookies and stores no identifier in your browser before you give consent. A cookie banner is therefore not required.

Contact

Questions about this policy or your data: hello [at] jware.at.