Mneme — Privacy Policy

What stays on your device

By default, everything. Your decks, notes, cards, scheduling history, imported media and any audio you record are stored locally. Mneme does not upload them, and there is no Mneme server holding a copy of your collection.

If you never sign in and never use the AI features, the only thing Mneme sends is the usage data described in section 1 below, and it stays anonymous — which you can switch off in Settings → Privacy. Your decks, notes and cards are never part of it.

What leaves your device, and when

1. Always: product usage analytics

Mneme sends product analytics to PostHog so it is possible to see how the app is actually used — which screens people open, how many cards get reviewed, how often imports or syncs fail, and where the app crashes.

While you are signed out this data is anonymous. Once you sign in to a Mneme account it is linked to that account — see the first two bullets below.

This never includes the content of your collection. Not the text of your cards, not your deck names, not your tags, not your note fields, not the file names you import or export, and not the text you send to AI. The app enforces this in code rather than by convention: every analytics property is a number, a true/false, or a short fixed label, and anything longer is discarded before it is sent.

What is sent:

• A random identifier for this installation, generated on your device while you are signed out. It is not derived from your hardware. It exists so that ten actions by one person are not mistaken for one action by ten people. Reinstalling produces a new one.
• Your account and email address, once you sign in. From that point the events above are keyed to your account identifier rather than to the random install identifier, and your email address is attached to your analytics profile, so usage can be understood per person rather than per installation. Signing out unlinks them, and the app goes back to the random identifier.
• Which screens you open, as route names like /review or /browse — with deck and note ids stripped out.
• Counts and outcomes: cards reviewed in a session and how long it took, number of cards added, whether an import or sync succeeded or failed, how long an AI request took and whether it errored.
• Technical context: app version, whether you are on macOS or iOS, and whether the build is a development or released one.
• Crashes: the error type and which screen it happened in. Not the error message, because error messages can quote the record that caused them.
• Approximate location — country and city — which PostHog derives from your IP address, as it does for any web request. Nothing more precise.
• Your IP address, for AI requests made through a Mneme account. Mneme's server passes it to PostHog so that the approximate location on those events is yours rather than the server's. It is used to derive country and city; Mneme does not store it.

To turn it off: Settings → Privacy → Share usage data. It takes effect immediately, and the choice is stored on that device only, so switching it off on your Mac does not change it on your iPhone. With it off, the app makes no analytics connections at all — it is not merely quieter.

One exception, stated plainly: AI requests made through a Mneme account are counted on Mneme's server, which reports them to PostHog directly (section 5). That happens whether or not this setting is on, because it is also how your monthly quota is enforced. It never includes your card text.

2. When you use AI card generation

The text you are turning into a card — the source text you typed, pasted or captured, and the surrounding context from your own note — is sent to a language model to produce the card.

• Signed in to a Mneme account: the text goes to Mneme's server, which forwards it to OpenRouter, which routes it to the model provider serving your chosen model. Mneme's server does not store the text; it passes it through and records only counts.
• Using your own OpenRouter API key: the text goes directly from your device to OpenRouter. Mneme's servers are not involved at all.

Model providers may retain prompts under their own policies. If your notes contain material you would not want a third-party model provider to process, do not run AI generation on it.

3. When you use text-to-speech

The text to be spoken is sent to Google Cloud Text-to-Speech using the API key you supply, and the returned audio is stored on your device. This happens only for cards where you request audio.

4. When you view stroke-order diagrams

Mneme fetches stroke data for the character from the public jsDelivr CDN. This reveals the character being looked up to that CDN, and nothing else — no account identifier is attached.

5. When you have a Mneme account

• Neon Auth stores your email address and a hashed password, and records whether your address is verified. This is what a Mneme account is.
• Mneme's server stores your account identifier, when the account was created, your plan, and a running count of AI requests in the current period. This is how the monthly quota is enforced.
• PostHog receives one event per AI request containing your account identifier, your email address, the model used, token counts, cost, latency, and your plan, along with your IP address so the event carries your approximate location rather than the server's. It does not receive your card text or any note content.
• Stripe handles payment if you subscribe to Pro, and holds the billing details you give it. Mneme never sees or stores your card number.

6. When you turn on AnkiWeb sync

Your collection — cards, notes and media — is sent to AnkiWeb under your own AnkiWeb account and its policy, not Mneme's. This is off by default; sync points at a local server until you change it.

What Mneme does not do

• No advertising, and no advertising identifiers.
• No selling or sharing of personal data with data brokers.
• No cross-app or cross-site tracking. The app declares NSPrivacyTracking: false in its privacy manifest and requests no tracking permission.
• No access to your device's location, contacts, photos or browsing history. Mneme never asks the operating system for your location. The only location data that exists is the country and city PostHog infers from the IP address of an analytics request (section 1). Switching analytics off removes this for everything the app sends; AI requests made through a Mneme account are still counted server-side, as described in sections 1 and 5.

Deleting your account

Your decks and cards are unaffected, because they were never on our servers to begin with.

Two things intentionally survive deletion:

• Stripe invoices, which are financial records Stripe holds as the system of record for past payments. No further charges can occur, as the subscription is cancelled.
• Aggregate analytics events already sent to PostHog. Deleting your account removes your email address from the analytics profile, leaving events tied to an account identifier that no longer resolves to anyone.

Data retention

Usage counters are kept per billing period and are not needed beyond the current one. Account records persist until you delete the account. Anything already handed to OpenRouter, Google, Stripe, PostHog or AnkiWeb is retained under their policies, linked above.

Children

Mneme is not directed at children under 13, and does not knowingly collect personal information from them.

Changes to this policy

Material changes will be reflected here with a new date at the top. Continuing to use Mneme after a change means accepting the revised policy.

Contacting us

Questions about this policy, or about data held about you: support@anki-ex.com