FermemoPrivacy Policy
Last updated: November 14, 2026
This policy explains how your personal data is processed when you use Fermemo (fermemo.com). It serves as our privacy notice under both the EU General Data Protection Regulation (GDPR) and Turkey's Personal Data Protection Law No. 6698 (KVKK). The Turkish version has the same content.
1. Data controller
Email: [email protected]
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: email, name, a one-way hash of your password; with Google sign-in, the name, email and profile photo shared by Google | Creating your account and letting you sign in | Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)) |
| Your content: notes, categories, uploaded files and images, routines, review and learning history, preferences | Providing the service: storing, searching, scheduling reviews, syncing across your devices | Performance of a contract |
| Notification subscription: your browser's or device's push address, time zone | Sending review and routine reminders (only if you turn them on) | Performance of a contract / your consent |
| Security records: IP address, sign-in attempts, request counts | Protecting accounts against brute-force attacks and abuse | Legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Visit statistics: page views, referring site, browser/device type, country and city, IP address | Improving the site and seeing which pages are useful | Only if you accept cookies: your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)) |
| Waiting list: the email you enter in a "Notify me" box | Telling you once when a paid plan goes on sale | Your consent; you can ask us to delete it at any time |
| Support correspondence | Answering your questions and requests | Legitimate interest / legal obligation |
| AI assistant connection records (only if you connect Fermemo to Claude or ChatGPT): the connecting app's name and callback address, the access level, one-way hashes of the time-limited access tokens; for each action, the tool name, the time and the related note ID | Running the connection, showing connected apps in Settings, preventing abuse and troubleshooting | Performance of a contract; legitimate interest in security |
Locked notes are encrypted on your device with a lock password that only you know. We, the search system and the AI features cannot see their content; if you forget the password, we cannot open them either.
We do not use your data for advertising, we do not sell it, and we do not use it to train AI models.
3. AI features
Question generation, answer grading and "Ask my notes": When you ask for quiz questions about a note, the note's text, hint and images are sent to our AI provider Anthropic (USA). When you have open-ended answers graded, the question, the model answer and your answer are sent; when you use "Ask my notes", your question and the most relevant note excerpts are sent. This happens only when you press the corresponding button ("Generate questions", "Finish quiz", "Ask my notes"); nothing is sent automatically when you save a note. The data is processed only to produce the requested questions, grading or answer and, under Anthropic's commercial terms, is not used to train AI models. Our logs keep only the note ID and usage/cost information, not note content. You can turn question generation off per category (category menu → Turn off question generation).
Search and category suggestions run on our own servers (Germany); your note content is not sent to a third party for them.
AI-generated content is labelled in the app and may contain mistakes. Locked notes are never sent to any AI feature.
External semantic search (Settings → Search & Privacy) is off by default. If you turn it on, note text is sent to OpenAI (USA) to compute numeric search representations (embeddings). This option is based on your consent and can be turned off at any time.
AI assistant connections: Claude and ChatGPT
If you connect Fermemo to an AI assistant (Claude by Anthropic or ChatGPT by OpenAI, through the MCP connector), the assistant searches and reads your notes based on what you ask it, and the note content it retrieves is passed to that assistant's provider (Anthropic for Claude, OpenAI for ChatGPT) and processed under your account with that service. The connection only works if you set it up; otherwise no data reaches these providers this way.
- Access level: you choose it when connecting: Read only (search and read) or Read and write (additionally create and edit notes and categories). The connector can never delete notes or categories and can never see the content of locked 🔒 notes.
- Authentication: the assistant receives time-limited access tokens that are specific to your account (access token valid for 1 hour, refresh token for at most 90 days); your password is never shared. We store the tokens only as one-way hashes.
- Access records: for each action we record the connecting app, the tool name, the time and the related note ID; note content and search text are not recorded. These records are deleted automatically after 90 days.
- Your controls: you can see connected apps, when they were last used and their access level in Settings → AI assistant connections, and remove a connection there at any time; its tokens stop working immediately. You can also remove the connection in the assistant's own settings.
- Processing on Anthropic's and OpenAI's side is governed by that company's own privacy policy and your settings with that service.
Details: Claude connector · ChatGPT connector.
4. Who we share data with
We share your data only with the following service providers, and only as far as needed to run the service:
| Provider | Purpose | Location |
|---|---|---|
| netcup GmbH | Server hosting (all your data is stored here) | Germany (EU) |
| Cloudflare, Inc. | Delivering site traffic, attack protection | Global / USA |
| Google LLC | "Sign in with Google" (only if you choose it); delivering notifications in Chrome/Android | USA |
| Apple, Mozilla, Microsoft | Delivering notifications, depending on your browser | USA |
| Anthropic PBC | AI question generation, open-ended answer grading and "Ask my notes" (only when you use these features); notes the assistant reads through the Claude connection (only if you connect Fermemo to Claude) | USA |
| OpenAI | External semantic search (only if you turn it on); notes the assistant reads through the ChatGPT connection (only if you connect Fermemo to ChatGPT) | USA |
Notes and categories you share publicly on the marketplace can be seen and copied by other users. We may share data with competent authorities when legally required (e.g. a court order).
5. International transfers
Your data is stored in Germany. Transfers to the providers outside the EU listed above rely on European Commission adequacy decisions (e.g. the EU-US Data Privacy Framework) or standard contractual clauses, and, under KVKK, on the safeguards of Article 9. For users in Turkey, storage in Germany is also an international transfer.
6. How long we keep data
- Account and content: as long as your account exists. If you delete your account it is removed immediately, and from backups within 30 days at the latest.
- Notes in the trash: until you delete them permanently or delete your account.
- Visit statistics: 90 days, then deleted automatically.
- Sign-in attempts: 30 days.
- Waiting list email: until the announcement is made or you ask us to delete it.
- AI assistant connection (Claude, ChatGPT) access records: 90 days, then deleted automatically.
- Connection access tokens: access token 1 hour, refresh token at most 90 days; invalidated immediately when you remove the connection.
7. Your rights
Under the GDPR (Art. 15-22) and KVKK (Art. 11) you have the right to:
- Find out whether your data is processed and get a copy: Settings → Download my data
- Ask for incorrect data to be corrected
- Ask for deletion: Settings → Account & privacy → Delete account
- Restrict or object to processing and move your data to another service (JSON export)
- See and remove AI assistant connections: Settings → AI assistant connections
- Withdraw your consent at any time (cookies: )
- Object to a decision based solely on automated processing that significantly affects you (Fermemo makes no such decisions)
Send requests to [email protected] from your account's email address; we reply within 30 days at the latest. You can also complain to a supervisory authority: in Turkey the Personal Data Protection Authority (kvkk.gov.tr), in the EU the data protection authority of your country.
8. Security
Connections are encrypted with HTTPS, passwords are stored as one-way hashes, locked notes are encrypted on your device, sign-in attempts and requests are rate-limited, and the database is backed up regularly. If a data breach occurs, we notify the authorities and you within the legal deadlines.
9. Children
Fermemo is not designed for children under 16. If you are under 16, you need the permission of a parent or guardian to open an account.
10. Changes
We may update this policy. We announce important changes in advance in the app or by email. The current version is always on this page.
This translation is provided for information only. If there is any discrepancy between the translation and the original Turkish text, the Turkish version prevails.