Privacy Policy

2. What we collect

You give us

Created as you use the app

We do not collect

• Advertising or tracking identifiers. The apps contain no advertising or third-party analytics tracking of any kind.
• Your location. We never request it, and photographs you upload have the camera and location information embedded by your phone removed before they are stored (see section 7).
• Your payment card details. See section 6.
• Contacts, calendar, microphone or health data.

Camera and photo library access are requested only when you choose to photograph or select a page, and only for that purpose.

3. Why we use it, and our legal basis

Where the GDPR or comparable law applies, our legal bases are:

We do not use your content to train AI models, and we do not permit our providers to do so on our behalf. See section 4.

4. AI processing

Answering a question requires sending data to a third-party AI provider. Specifically, we send:

• the question you typed;
• the passages retrieved from the textbook you selected;
• the recent part of that conversation, so the answer follows on;
• for a book you photograph, the page images themselves, so their text can be read back.

Our AI providers are Alibaba Cloud and Google. They process this data as our sub-processors, under contract and on our instructions, solely in order to return a result. They are not permitted to use it for their own purposes or to train their models.

Please do not photograph or type anything you would not want processed by a third party, including pages containing personal information about you or anyone else.

5. Who else we share with

We share personal data only with service providers acting on our instructions:

We also disclose data where we are legally required to, or where it is necessary to establish or defend legal claims, or to protect someone's safety.

We do not sell personal data, and we do not share it for cross-context behavioural advertising, as those terms are used in the CCPA/CPRA.

6. Payments

Subscriptions are sold through the Apple App Store, Google Play, or Stripe, depending on the platform you use.

Your card details never reach us. They are handled entirely by the store or by Stripe under their own privacy policies. What we receive and store is: which plan you hold, whether it is active, when the current period ends, and an opaque identifier the store uses to refer to the purchase. Apple and Google never tell us the email address behind a purchase.

To cancel, use the store you bought through — Apple, Google Play, or the Stripe billing portal linked in the app. Deleting your Mamopedia account does not cancel a store subscription; only you can end it with the store that bills you.

7. How we protect it

• All traffic is encrypted with HTTPS/TLS.
• Passwords are handled by Firebase Authentication and are never visible to us.
• Your conversations, quizzes and books are readable only by your account. This is enforced on the server, not merely hidden in the app.
• Photographs of your pages are stored privately, keyed to your account identifier, and are not reachable by a public URL.
• Every uploaded image is re-processed before storage, which removes the metadata your phone embedded in it, including camera details and any location coordinates.
• Support conversations and reported content are readable only by the operator accounts that must act on them.

No system is perfectly secure, and we cannot guarantee absolute security.

8. How long we keep it

9. Your rights and how to use them

Depending on where you live, you may have the right to access, correct, delete, export, restrict or object to our processing of your data, and to withdraw consent. Two of these are built into the app:

Erase your content. Settings → Your data lets you erase your conversations, quizzes and books — separately or together. This is immediate and irreversible.

Delete your account. Settings → Your data → Delete account. Your account is scheduled for deletion after a 15-day grace period, and you are signed out of every device. Signing in again during those 15 days cancels the deletion — there is nothing else to click. After that, your account and its content are permanently removed.

For anything else — access, correction, export, or a complaint — contact info@keyu.tech. We will respond within the period the applicable law requires (one month under the GDPR).

You also have the right to complain to a supervisory authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia — www.aki.ee. If you live in another EU or EEA country, you may complain to your local authority instead.

10. Children and students

Mamopedia is a study tool built for school students, so we expect many of our users to be minors.

You must be at least 13 years old to create an account. If you are under 13, a parent, guardian or school must create and manage the account and consent to this policy on your behalf. Where the law of your country sets a higher age for consent to online services, that higher age applies instead.

We do not knowingly collect personal data from a child below the applicable age without the consent that the law requires. If you believe a child has provided us with personal data without that consent, contact info@keyu.tech and we will delete the account and its content.

Children have the same rights as everyone else under section 9, and a parent or guardian may exercise them on the child's behalf.

11. International transfers

We are established in Estonia, in the European Union, so the GDPR governs our processing — including for users outside the EU.

Our infrastructure sits in the United States, and AI processing may take place outside the EEA as well (section 4). Your data is therefore transferred out of the European Economic Area to countries whose data protection laws differ from the EU's.

For those transfers we rely on the European Commission's Standard Contractual Clauses, incorporated into our agreements with the providers named in section 5, together with any additional safeguards those agreements require. Where a provider is certified under the EU–US Data Privacy Framework, we rely on that adequacy decision instead. You may request a copy of the relevant safeguards by writing to info@keyu.tech.

12. Changes to this policy

We will update this page when our practices change, and revise the "Last updated" date above. If a change materially affects your rights, we will give notice in the app before it takes effect.

13. Contact

KeyU Tech OÜ
Registry code 17525103
Lõõtsa tn 5, Lasnamäe linnaosa
11415 Tallinn, Estonia

info@keyu.tech