memo
Privacy policy
The short version. We keep only what the app needs to work: your Google account email, the things you add, and what is needed to keep you signed in. No ads, no analytics, no tracking, no selling, ever. If you join a beta waiting list, we keep your email to invite you. You can get a copy of your data or have it deleted at any time.
Who we are
faccio is run by Alain Di Chiappari, one person who makes small apps. We are the data controller for the personal data described here. You can reach us at info@faccio.app.
This policy covers memo, a spaced-repetition app for remembering what you learn, at memo.faccio.app (and its earlier address while it moves), and its beta waiting list. memo is one of the faccio apps.
Part 1: the apps
Your account
You create an account with Google sign-in. From Google we receive your Google account ID and your email address, and we keep both. We do not keep your name or profile picture. We never get your Google password and we do not get access to anything else in your Google account (no contacts, files or mail).
Once you are signed in, you can create passkeys and use them to sign in. A passkey is stored on your device or in your password manager. We keep only its public part, which cannot be used to sign in on its own, plus technical details such as when it was created.
Some apps used other ways to sign in before (email codes, and for pago a Telegram bot). Those are being switched off. While they still run, the data they use is described in each app's section below.
What each app keeps
memo
- What you add: your categories, topics and cards (questions, answers, short notes, and links to images), and your review history (when you reviewed a card and how it went). memo uses this to schedule your next reviews.
- Settings: your time zone (taken from your browser), reminder times and study preferences.
- Reminders: if you turn on notifications, we keep your browser's push address and its user agent (browser and system name), and a record of the reminders we sent. A reminder says only how many cards are due.
- Card images are not stored by us. memo shows them straight from the website you linked, so that website sees your IP address when the image loads.
- Offline: memo keeps a copy of your cards in your browser so you can study offline.
- Where: the database is in Ireland (EU).
- Export and delete: Settings has an export button for your cards and reviews. You can delete cards, topics, categories, passkeys and devices yourself. To delete your account, email us.
- Access: during the beta, only invited Google accounts can sign in.
Cookies and storage on your device
The apps use only cookies that are strictly needed to sign you in and keep you signed in: one session cookie, and short-lived cookies (a few minutes) during Google or passkey sign-in. There are no advertising, analytics or tracking cookies, so we do not ask for cookie consent.
The apps also keep some things in your browser's own storage, such as your settings and, for apps that work offline, a copy of your data so they open fast. This stays on your device. Signing out or clearing your browser data removes it.
Why we use your data, and on what legal basis
- To run the app for you (your account, sign-in, the data you add, syncing between your devices): because it is needed to provide the service you asked for (Article 6(1)(b) GDPR).
- To keep the service safe and working (short technical logs, limits against abuse, backups): our legitimate interest in a secure, reliable service (Article 6(1)(f) GDPR).
- Optional features you turn on (notifications, AI features): your consent, given when you turn them on. For the AI features this includes sending the data to DeepSeek in China (Article 49(1)(a) GDPR). You can turn them off at any time.
- Health-related data (only in mangio and sudo, see above): your explicit consent (Article 9(2)(a) GDPR). The app asks for it in a short, clear step, saying no is always possible, and you can withdraw it and delete the data at any time.
We never sell your data, never use it for advertising, and never share it with anyone for marketing. We do not look at your data unless you ask us to (for example to fix a problem you report) or the law requires it.
Who else handles it
These service providers process data on our behalf, each under its own data processing terms:
- Cloudflare, Inc. (USA) serves the apps' web pages, and all traffic to our servers passes through its network.
- Hetzner Online GmbH (Germany) runs the server where the apps' back ends work, in the European Union.
- Supabase, Inc. (USA) hosts the databases. Each app's database location is listed in its section above.
- Google LLC (USA) provides Google sign-in.
- Your browser's push service (Google, Apple or Mozilla, depending on your browser) delivers notifications, only if you turn them on.
- Other providers used by a single app (Brevo for emails, DeepSeek for AI features) are listed in that app's section.
Some of them may process data outside the European Economic Area. Where they do, the transfer is covered by the EU-US Data Privacy Framework, by the European Commission's Standard Contractual Clauses, or by an adequacy decision (for example for the United Kingdom). The one exception is DeepSeek, explained in the sections that use it.
How long we keep it
- Your account and app data: as long as you have the account. When you delete something, it is deleted from the app straight away.
- When you ask us to delete your account: we do it within 30 days.
- Backups: we take a copy of the databases twice a day and keep each copy for 30 days, then it is deleted. So deleted data can stay in a backup for up to 30 more days. Backups are kept on our own server and our own encrypted computer, and we only use them to recover from a failure.
- Technical logs: a few days to a few weeks, then they are overwritten.
Part 2: the beta waiting lists
If you sign up for a beta on the faccio website, we keep:
- your email address,
- the app or apps you want to test (for example "memo"),
- the date and time you signed up, and which of our pages you used.
We use your email only to invite you to test, to tell you when the app launches, and to ask for your feedback. We do this because you gave your consent when you ticked the box on the form (Article 6(1)(a) GDPR). You can withdraw it at any time; this does not affect what we did before.
The list is stored in Google Sheets (Google LLC, USA). The form is received by a small function on Cloudflare. The emails we write to you are sent through Brevo (Sendinblue SAS, France). When you send the form, your browser loads Cloudflare Turnstile, a check that keeps bots off the list. Reading a page does not load it. Turnstile looks at technical data such as your IP address and browser details, and never gets your email from us. We use it because we have a legitimate interest in keeping fake signups off the list (Article 6(1)(f) GDPR). Cloudflare also uses this data to improve its bot detection, as an independent controller, under its Turnstile privacy addendum.
The website sets no cookies and uses no analytics. We keep your email until the beta of the app(s) you picked has ended and the app has launched, then for at most 12 more months, so we can tell you about the launch. If you unsubscribe or ask us to delete it, we do so within 30 days at most.
Your rights
Under the GDPR you have the right to:
- see the data we hold about you, and get a copy of it (some apps also have an export button),
- correct it,
- have it deleted,
- restrict or object to how we use it,
- take it with you to another service (data portability),
- withdraw your consent at any time.
To do any of this, email info@faccio.app from the email address of your account or signup. We answer within 30 days.
If you think we handle your data wrongly, you can complain to a data protection authority. In Italy that is the Garante per la protezione dei dati personali (www.garanteprivacy.it).
Children
The apps and the betas are for people aged 16 or older. If you are younger, please do not use them.
Security
Everything travels over HTTPS. Sign-in uses Google and passkeys, so there are no passwords for us to lose. Sessions and keys are stored only as one-way hashes. The databases are private and only reachable by the apps' back ends and by us.
Changes
If we change this policy, we will update the date at the top. If a change matters, we will tell you in the app or by email before it takes effect.