Privacy Policy
Memoiry is a personal timeline and diary. It is run by Memoiry, reachable at memoiry@googlegroups.com (the "controller"). This policy explains what we collect, why, who processes it and what you can do about it. It should be reviewed by a lawyer before you rely on it.
What we collect
Everything below is collected because you type it in. Memoiry has no analytics, no advertising and no tracking pixels.
- Account: email address, a hashed password or the identity your sign-in provider returns (Google, Facebook, GitHub or LinkedIn), your username and display name.
- Timeline: the periods and events you add, with titles, dates, places, tags, colors and descriptions.
- Diaries: the long-form text you write for an entry or a day, and notes to your future self.
- Places: the place names you type and the coordinates we look up for them.
- Music: monthly top tracks aggregated in your browser from a Spotify export. The play-by-play history never leaves your device.
- Friends: the friend requests you send and accept, and the privacy level you choose for your profile.
- Feedback: messages you send us from the envelope button, with the page you were on.
- Plan: your plan, when it expires, when you accepted these terms and when you switched AI extraction on.
- Technical: server logs with IP address and request path, kept by our hosting provider for security for a short period.
Why we process it, and on what legal basis
Under the General Data Protection Regulation (GDPR) we rely on three bases.
- Performing our contract with you (Article 6(1)(b)): storing and showing your timeline, diaries, places, music, friends and settings is the service itself.
- Your explicit consent (Article 9(2)(a)): diaries often contain health, relationships, beliefs or other sensitive matters. The AI features (extraction into the memory graph, and Ask AI on the graph) send diary text to a third-party model and are off until you switch AI on in Settings. You can switch it off at any time; doing so deletes everything derived from it.
- Our legitimate interest in keeping the service secure (Article 6(1)(f)): short-lived server logs and abuse limits.
Who processes your data
We use a small number of processors, each bound by a data processing agreement.
- Supabase (database and authentication). Your data is stored in the EU region region.
- Vercel (hosting and serverless functions). Requests are served from Vercel's network; logs are retained briefly for security.
- Anthropic (AI features, only when you have switched them on). For extraction, diary text, the entry title, its tags and the names already in your graph are sent through Anthropic's API. For Ask AI, your question and your diaries are sent the same way and the answer is shown to you, not stored. Only your own data is ever sent, never a friend's. Anthropic processes it under its commercial terms, does not use API data to train its models and retains it for a limited period for abuse monitoring.
- OpenStreetMap Nominatim (place search). Only the place name you type is sent, to find its coordinates.
- Your sign-in provider, if you chose one. We receive the identity it returns; we never see your password there.
Who can see your data
Your timeline is private by default. If you set your profile to Friends or Public, the people you accept (or anyone signed in with your link) can see your timeline entries and, if you opt in, your music. Diaries, notes, places' coordinates, your graph and your feedback are never shown to anyone but you.
We do not sell data and we do not share it with advertisers. We disclose data only when the law requires it.
How long we keep it
Until you delete it. Deleting an entry, a diary or your account removes the data immediately from the live database; encrypted backups roll off within 7 days. Server logs are kept by our hosting provider for a short period and then discarded.
Your rights
You can exercise all of these yourself, without asking us.
- Access and portability: Settings, Export downloads everything you have written as one file.
- Rectification: edit anything on your timeline or in your diaries at any time.
- Erasure: Settings, Delete account removes your account and all of its data.
- Withdraw consent: Settings, AI extraction switches every AI feature off, including Ask AI, and deletes the extracted graph.
- Restriction and objection: write to us at memoiry@googlegroups.com.
- Complaint: you may lodge a complaint with your data protection authority. Ours is the authority of Netherlands.
Cookies
Memoiry sets only the cookies needed to keep you signed in. They are strictly necessary, so no consent banner is required. There are no analytics or advertising cookies.
Children
Memoiry is for people aged 16 and over. If you are younger, please do not create an account. If we learn we hold data about a child under 16, we delete it.
Changes
We will post any change here with a new effective date. If a change reduces your rights, we will tell you inside the app before it takes effect.
Contact
Memoiry, memoiry@googlegroups.com.