Stemory

Privacy Policy

Last updated November 10, 2026

In short: we collect only what Stemory needs to work. The app downloads lessons from our server using an anonymous device ID, without sending personal information. Questions and photos you send to the AI tutor are answered with Google Gemini and are not stored on our servers. We do not sell your personal information or track you across apps. Stemory has lessons for grades 6 to 12; when the App Store or Google Play tells the app that a user is under 13, the AI tutor and photo solving are turned off (section 6).

1. Who we are

ArtArray Company Limited (“ArtArray”, “we”, “us”) publishes Stemory, an app for learning math and science. This policy covers the Stemory app on iOS, iPadOS, and Android and the website stemory.app (together, the “Service”). ArtArray is responsible for the information described here.

2. What we collect

Content you send us

Photos of problems and text questions or chat messages you send to the AI tutor, after you accept the one-time AI notice in the app. Before a photo leaves your device or our server, metadata such as EXIF and GPS location is removed. Our server holds your question, photo, and the AI answer in memory only to complete that request and does not save them to our databases or logs. Your recent chat conversations and viewed lessons stay on your device until you clear them in Settings. If you report a problem with a lesson, we store the lesson ID, content version, problem type, and any note you write; if you report a problem with an AI answer, we store the answer’s request ID, AI mode, any related lesson ID or step number, problem type, and any note you write, without linking the report to your device ID.

Anonymous device ID and settings

You can use the app without an account. When the app connects to our server, the server creates a random anonymous device ID and a signed session token kept in your device’s secure storage. With that device ID, the server stores creation and last-seen timestamps, a device public key used to wrap lesson pack keys for your device, and your language, curriculum type (US curriculum or learn by topic), and math notation preference. Your selected grade or course and your lesson progress stay on your device.

Lesson downloads and usage counts

The app downloads lesson packs from our server and caches them on your device. Downloading lessons does not send personal information. Our server records the anonymous device ID to sign short-lived download links and to count hourly downloads and daily free-tier usage (lessons opened, AI questions, and reports) to deliver lessons and prevent bulk scraping. When starting a session or unlocking a lesson, the app also sends a Firebase App Check token (using Apple App Attest on iOS and iPadOS and Google Play Integrity on Android) so our server can verify in memory that the request comes from the genuine app. If a lesson unlock request does not have a valid App Check token, our server records a daily cryptographic hash of the connecting IP address (never the raw IP address) to cap daily unlocks from that network. Server request logs record the request path, status code, duration, anonymous device ID, App Check verification status, and token counts and cost for AI requests.

Purchases

If you subscribe through the App Store or Google Play, the app uses your anonymous device ID as your user ID with our subscription provider RevenueCat, which shares your subscription status, plan, and renewal dates with us. Apple or Google processes the payment. The app and ArtArray never see your payment card or billing details.

Crash reports

If the production app crashes or encounters an unhandled error, Firebase Crashlytics collects crash traces (including native and sanitized JavaScript stack traces), your device model, operating system version, app version, device state at the time of the crash (such as orientation and free memory and storage), a Crashlytics installation UUID, a Firebase Installation ID, and App Quality Sessions identifiers (session IDs used to measure crash-free sessions). Crash reports do not include your app device ID, device keys, tokens, URL parameters, or any questions or photos you send to the AI tutor.

Messages to support

Your email address and what you write when you contact us.

We do not ask for your name, email address, phone number, or age in the app. We do not collect your precise location, contacts, or photos in your library that you do not choose to send.

3. How we use it

  • To provide the Service: deliver lessons, answer your questions with AI, and enforce daily free limits.
  • To manage subscriptions and restore purchases.
  • To detect and fix app crashes and errors, and to fix errors in lessons when you send a problem report.
  • To reply to you when you contact support.
  • To prevent scraping and abuse, keep the Service secure, and meet legal obligations.

We do not sell your personal information. We do not use your photos or messages to train AI models.

4. Who we share it with

We share information only with service providers that help us run the Service, and only what each one needs:

  • AI model provider: Google (Google Gemini API), which receives the metadata-stripped photos and messages you send so the Service can answer them.
  • Cloud hosting and content delivery: Cloudflare, which hosts our website, API, databases, and lesson packs.
  • App attestation: Google (Firebase App Check), Apple (App Attest), and Google (Play Integrity), which verify that requests come from the genuine app on a real device.
  • Crash reporting: Google (Firebase Crashlytics), which receives crash traces, device model, operating system version, a Crashlytics installation UUID, a Firebase Installation ID, and App Quality Sessions identifiers so we can diagnose and fix app crashes and measure crash-free sessions.
  • Subscription providers: Apple (App Store), Google (Google Play), and RevenueCat, which process and confirm your subscriptions.

These providers must protect your information at least as well as this policy does, and may use it only to provide their services to us. We may also disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a merger or sale of our business, in which case this policy continues to apply.

5. Tracking

We do not track you across other companies’ apps or websites, we do not collect advertising identifiers, and we do not share data with advertising networks.

6. Children

Stemory has lessons for grades 6 to 12, so some learners are under 13. The app has no accounts and does not ask for anyone’s age. Where the App Store or Google Play shares an age range with the app, the app uses it only on the device, and does not store it or send it to our servers.

When the App Store or Google Play tells the app that the user is under 13, chat with the AI tutor, photo solving, and free-text notes in problem reports are turned off, while lessons, practice, Explore mode, and plans stay available. From these users we collect no personal information other than persistent identifiers: the anonymous device ID and session token, the device public key, the App Check token, the Crashlytics installation UUID and Firebase Installation ID, the anonymous device ID used as the RevenueCat user ID, and the IP address of the connection, which our server uses only in memory or as a daily cryptographic hash. As the U.S. Children’s Online Privacy Protection Act (COPPA) allows, we use these identifiers only to support the internal operations of the Service: to deliver lessons and remember language, curriculum, and notation settings; to count daily free use and limit downloads; to verify that requests come from the genuine app and protect the Service from scraping and abuse; to detect and fix crashes; to process and restore subscriptions bought through the App Store or Google Play; and to meet legal obligations. We do not use them to contact a child, to build a profile of a child, or for advertising.

To keep these identifiers to those uses, the app never asks for a name, email address, or age; we do not combine the identifiers with other information about a person; access to our servers and crash reports is limited to the people who run the Service; our service providers (section 4) may use the information only to provide their services to us; and our server deletes these records on the schedule in section 7, after at most 90 days.

A parent or guardian can ask us to review or delete information about their child, or to stop collecting it, by writing to support@stemory.app. Because the app has no accounts, tell us roughly when the app was used and on which device, so we can find the records. Deleting the app stops any further collection from that device. If you believe a child under 13 has sent us other personal information, for example in a message to support, write to us and we will delete it.

7. How long we keep it

Photos, questions, AI answers, and App Check tokens are held in memory only during the request and are not stored on our servers. Chat history and lesson progress stay on your device until you clear them in Settings or delete the app. Daily IP hashes for unverified lesson unlocks apply only to that UTC day, and entries from before yesterday are deleted when later unverified unlock requests are checked. Server logs, counters, and inactive device records (including the device public key) tied to an anonymous device ID are kept for up to 90 days. Firebase Crashlytics keeps crash reports and associated Crashlytics installation UUIDs, Firebase Installation IDs, and App Quality Sessions data for 90 days. We keep other information, such as support emails and subscription records, only as long as needed for the purposes above or as required by law. When you ask us to delete your data, we delete it from our systems.

8. Your rights

Depending on where you live, including California and other US states, the European Economic Area, and the United Kingdom, you may have the right to:

  • know what personal information we hold about you and get a copy of it;
  • correct it or have it deleted;
  • object to or limit some uses, and withdraw consent you gave;
  • opt out of the sale or sharing of personal information for targeted advertising (we do not sell or share personal information for targeted advertising).

To use these rights, write to support@stemory.app. We will not treat you differently for using them. If you are in the EEA or the UK, you may also complain to your local data protection authority. Where the GDPR applies, we process information to provide the Service you asked for and for our legitimate interests in keeping it secure and running it reliably.

9. Security and transfers

We protect information with encryption in transit, stripped image metadata, and access controls. No system is perfectly secure, so we cannot guarantee absolute security. ArtArray is based in Vietnam, and our providers may process data in the United States and other countries. When we transfer data from the EEA or the UK, we rely on safeguards such as the European Commission’s Standard Contractual Clauses.

10. Changes to this policy

If we change this policy, we will update the “Last updated” date above. If a change is significant, we will tell you in the app or on this page before it takes effect.

11. Contact

ArtArray Company Limited
169/8 Hàm Nghi, Nam Đông Hà Ward, Quảng Trị Province, Vietnam
Phone: +84 399 204 341
support@stemory.app