Privacy Policy

Rumemo · Last updated: 8 November 2026

Rumemo turns your study material into flashcards and helps you learn them. Your material and your cards belong to you. That's why as much as possible stays on your iPhone.

The short version

• No account, no sign-up, no ads, no tracking.
• Your decks, cards, material and learning progress are stored on your iPhone and, if you use iCloud, in your private iCloud. We have no access to them.
• Text recognition, the scanner, read-aloud, import and export all run on your iPhone.
• Only if you agree and let the AI make cards: the recognized text of the pages you selected (plus an image of the page for pages with a chart or figure), or the topic you typed, is sent via our server to an AI provider. None of it is stored, and none of it is used to train AI.
• For purchases, anonymous purchase data is shared with Apple and our service provider RevenueCat – never your material.
• Crash reports contain technical details only. You can turn them off in Settings.

1. Controller

Sunay Yetim
Martin-Luther-Str. 7
95615 Marktredwitz
Germany
Email: hello@rumemo.com

2. What stays on your iPhone

To work, the app stores on your device:

• your decks and cards, including the ones you write yourself or bring over from Anki, Quizlet or spreadsheets,
• the pages of your material as recognized text and, for pages with a chart, figure or table, as an image – so you can see where each card comes from,
• your learning progress (when you knew which card and how well), your study goal and your exam date,
• your settings (e.g. reminder, rating buttons).

The app reads the files you open (PDF, Word, PowerPoint, photos, text) on your iPhone. The files themselves are never sent to us or to anyone else. Text recognition (Apple Vision), the document scanner, reading vocabulary aloud and language detection also run on your iPhone.

Sharing: When you share something with Rumemo from another app (e.g. Safari, Notes, Files, Photos), the share extension only places it in an area on your iPhone that the app picks up the next time you open it.

iCloud: If iCloud is turned on, the app syncs your decks, cards, material and progress between your devices through your private iCloud database at Apple. Only you have access to it, we don't. Apple's privacy policy applies. Without iCloud, everything stays on the device.

Deleting: You can delete decks and cards in the app at any time. To delete everything, delete the app and, if you used iCloud, remove Rumemo's data in iPhone Settings under "[Your Name] → iCloud → Manage Storage".

3. Reminders

The daily reminder is scheduled on your iPhone. There is no server involved.

4. Cards made by AI (only with your consent)

An AI makes cards from your material or from a topic. Before anything is sent for the first time, the app explains what happens and asks for your permission. Without your consent, nothing is sent. Learning, your own cards, import and export all work without it. You can withdraw your consent at any time in Settings under "Let AI make cards".

What is sent:

• the recognized text of the pages you selected in the preview, in chunks of at most three pages,
• for pages with a chart, figure or table, also a reduced image of that one page,
• or, when you make cards about a topic, the topic you typed,
• the language of the material (detected on your iPhone) and how many cards should be made,
• a random identifier for the deck (it reveals nothing about the content),
• for free pages and purchases: a random identifier the app creates on your iPhone on first launch, and the anonymous identifier of your app installation at RevenueCat (see section 6).

No names, no email address, no device or advertising ID are sent.

Where the data goes:

1. To our own server (run by us, hosted by Contabo GmbH, Welfenstraße 22, 81541 Munich, Germany). It counts your pages, forwards the request and checks the answer before it reaches you.
2. From there to OpenRouter, Inc. (USA) as an intermediary, which passes the request to exactly one provider of the language model: Together AI, Inc. (USA) or DeepInfra, Inc. (USA) with the DeepSeek model, or as a fallback Google Cloud (Google Ireland Ltd.) with the Gemini model in a data centre in the EU. The AI provider receives no identifier of yours, only the content of the request.

We have configured OpenRouter to use only providers that do not store requests and do not use them for training ("zero data retention"). Transfers to the USA are based on the EU Standard Contractual Clauses.

What our server stores: no text, no images, no topics and no cards. It only stores:

• for each processed page a fingerprint (a checksum created with a secret key, from which the text cannot be recovered) together with the day and month. We use it to count your free pages and purchases, and the same page isn't counted twice,
• your identifiers (see above) only as such a checksum, never in plain text,
• for "Just this document", the transaction number of the purchase and the random identifier of the deck it applies to, so that a purchase can only be redeemed once,
• technical logs without content: time, result, type of request, number of pages and cards, model, cost and duration. No IP address, no text. We delete these logs after 14 days.

Your IP address is processed in memory for at most one minute to make the connection and protect against overload, but it is not stored. We need the fingerprints for as long as we offer the AI feature, because the free pages are a one-time allowance that does not refill.

AI-generated cards: Cards are created automatically by an AI and may contain mistakes. Cards from your material show the passage they come from. Cards about a topic are marked "From AI knowledge – no source".

Legal basis: your consent (Art. 6(1)(a) GDPR) for sending to the AI. For counting free pages and redeeming purchases, performance of the contract (Art. 6(1)(b) GDPR). We have data processing agreements with our service providers. Processing carried out before you withdraw your consent remains lawful.

Please note: Don't send material containing particularly sensitive information about other people (e.g. patient data, personnel files) unless you are entitled to do so.

5. Crash reports

If the app crashes or freezes, iOS creates a report (Apple MetricKit). The app sends it to our server the next time you open it, so we can fix the problem. The report contains technical details only: the location in the program, app version, iOS version and device type. Never your material, your cards or any identifier of yours. We keep reports for at most 90 days.

The legal basis is our legitimate interest in an app that works without errors (Art. 6(1)(f) GDPR). You can object at any time by turning off "Send crash reports" in Settings. Nothing more is sent after that, and collected reports are deleted.

6. Purchases and subscriptions

Purchases and subscriptions are handled by Apple's App Store. We don't receive any payment details. Apple's privacy policy applies to the payment.

To check whether Pro is active or whether you bought "Just this document", we use RevenueCat (RevenueCat, Inc., USA) as a processor. Our server only asks RevenueCat whether a purchase exists. The following is processed:

• a randomly generated, anonymous identifier of the app installation (no device or advertising ID),
• purchase receipts from Apple (product, purchase date, price, currency, country, transaction number, subscription status),
• technical details needed for the connection (e.g. app version, operating system, language setting, IP address).

No material, no cards. The legal basis is performance of the purchase contract (Art. 6(1)(b) GDPR). We have a data processing agreement with RevenueCat. Transfers to the USA are based on the EU Standard Contractual Clauses. The data is kept as long as needed to manage the purchase and then deleted, unless statutory retention obligations apply.

7. Emailing us

If you write to us from the app, your own mail app opens. The subject line contains the app version and nothing else about your device. We only receive the email, including your email address, once you send it. We use it only to reply to you and delete it once your request is resolved, at the latest after 12 months. The legal basis is Art. 6(1)(b) and (f) GDPR. Our mailbox is hosted by Migadu-Mail GmbH in Switzerland (Switzerland is covered by an EU Commission adequacy decision).

8. No other services

Apart from the services named here, we use no ad networks, no analytics or tracking services and no social media integrations. The app doesn't ask for your location, your contacts or your microphone. It only uses the camera when you photograph your material; the photos stay on your iPhone.

Visiting this website: When you visit rumemo.com, our server necessarily processes your IP address, date and time, the address requested and your browser identifier to deliver the page. For security and troubleshooting, these details are logged with a shortened IP address (last block removed) for at most 14 days and then deleted automatically. No cookies are set. This applies only to the website: the app's requests to our server are not logged this way (see section 4). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website.

9. Age

Rumemo is intended for people aged 16 and over. You may only consent to the AI feature from the age of 16, or from the higher age at which you may consent to the processing of your data yourself in your country.

10. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to withdraw consent at any time. Since we store nothing apart from checksums and purchase data, and none of it is linked to you as a person, we can only match a request if you give us the transaction number of your purchase. We don't have your material or your cards; they are only with you. Write to hello@rumemo.com.

You can also lodge a complaint with a data protection authority, for example the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany) or the authority in your country.

11. Changes

We update this privacy policy when the app or the legal requirements change. The version published on rumemo.com applies.

This is a translation. The German version (rumemo.com/de/datenschutz/) is legally binding.