Privacy Policy

Last updated · 29 July 2026

This policy explains how the Maxmed iOS app ("Maxmed", "we", "us") handles your information. By using Maxmed you agree to this policy.

What we store, and where

Maxmed is a local-first app. The following is stored only on your iPhone, in the app's private storage:

• Your study progress, review history, and streaks
• Your daily target, reminder time, appearance, and other settings
• Your stated goal and (optional) exam date
• Your Maxmed Pro subscription status

Your study progress, review history, streaks, settings, goal and exam date never leave your device. We have no servers that receive them, and we cannot see them. If you delete the app, this data is removed with it.

Two narrow exceptions, both described in full below: the optional AI deck maker sends text you choose to paste, and — if you subscribe to Maxmed Pro — that request also carries Apple's signed subscription receipt so our service can confirm the subscription is valid.

What we do not collect

• We do not require an account, email, name, or login to use Maxmed.
• We do not use third-party analytics, advertising, or tracking SDKs.
• We do not track you across apps or websites, and we do not build advertising profiles.
• We do not access your contacts, photos, location, microphone, or camera.

Subscriptions and payments

Maxmed Pro is sold through Apple's In-App Purchase. Apple processes the transaction; we never receive or store your name, card number, or payment details. Apple shares aggregate, anonymized sales data with us. Apple's handling of your purchase is governed by Apple's Privacy Policy.

Your subscription status is stored on your device. When a subscriber uses the AI deck maker, Apple's signed subscription receipt is sent with that request so our service can confirm the subscription is valid — that is the only time it leaves the device, and it is not stored.

Deck content

Maxmed downloads its flashcard decks — both the packs built into the app and any new decks we publish — over a secure (HTTPS) connection. This is a one-way download of public study content: the request carries no account, no identifiers, and none of your personal data or study history. As with any request on the internet, the server that delivers the content may briefly record technical information such as your IP address in standard logs for security and delivery. That is not linked to your identity, not used to track you, and never combined with your study data — which stays on your device.

AI deck maker

Maxmed includes an optional feature that builds a flashcard deck from material you provide. It runs only when you name a topic, type or paste text, or import a document, and then tap to generate — nothing is sent automatically, and the feature is never triggered in the background.

When you use it, what you submitted is sent over a secure (HTTPS) connection to our AI service, which uses it to extract vocabulary and return cards. If you import a document, Maxmed reads the text out of that file on your device and sends that text; the file itself is never uploaded. The request carries no account, no name, and none of your study history — nothing beyond the topic or text you chose to submit and the two technical tokens described below. We do not store it after your deck is built, and it is not used to train models. As with any internet request, the server may briefly record technical information such as your IP address in standard security logs, which is not tied to your identity.

Who processes the text. Our AI service does not run the language model itself — it passes your text to a third-party model provider, currently Google (Gemini), processing in the United States. We do not store your text after the deck is built, and we do not use it to train anything. Google's handling is governed by the Gemini API terms. If we change providers we will update this page. No other third party receives the text.

What else the request carries. Two technical tokens travel with it, neither of which identifies you:

• A Firebase App Check device-attestation token (Google) — proves the request came from a genuine copy of Maxmed rather than a script, so we are not paying for someone else's traffic.
• For Maxmed Pro subscribers only, Apple's signed subscription receipt — used solely to confirm the subscription is active. It contains a transaction identifier, not your name or Apple ID.

We do not combine either token with your study data, and neither is used for advertising or tracking.

You control what is sent. Only submit material you are comfortable having processed. Do not paste or import patient-identifiable information or confidential clinical records into the AI deck maker.

Pronunciation

Pronunciation playback uses Apple's on-device speech synthesis. The word being spoken is processed on your device and is not sent to us or to any third party.

Notifications

If you turn on a daily reminder, Maxmed schedules a local notification on your device. No data is sent off the device to deliver it. You can turn reminders off at any time in the app or in iOS Settings.

Children

Maxmed is intended for clinicians and adult learners and is not directed to children under 13. We do not knowingly collect data from children.

Your control over your data

Because your data lives on your device, you are in full control. Open Settings → Delete all data in the app to permanently remove your profile, subscription record, and review history from the device. You can also delete the app to remove everything.

Future cloud features

We plan to offer optional cloud sync and sign-in in a future update. These features will be opt-in: your data stays local until you choose to enable them. When they ship we will update this policy and describe exactly what is synced before you turn it on.

Changes to this policy

If we change this policy we will post the new version here and update the date above. Material changes will be surfaced in the app.

Contact

Questions about privacy? Email contact.dariaiap@gmail.com.