MemoryBoxMemoryBox is a private place to save memories — writing, photos, and voice recordings — and share them with the people you choose. This policy explains what we collect, why we collect it, who we share it with, and what control you have.
The app is operated by [ LEGAL ENTITY NAME ], [ REGISTERED ADDRESS ] ("we", "us"). We are the data controller for the information described here.
1. Information we collect
Account information
When you create an account we collect your email address and a password credential, handled by our authentication provider. Your profile may also include a display name, username, avatar image, short bio, and phone number, depending on what you choose to provide. Only your email and a credential are required.
Content you create
The memories you save: written text, photographs, voice recordings, titles, and the date an event occurred. This content is stored so we can show it back to you and to the people you share it with. We treat it as private to you by default.
Your connections
Who you are connected to and how: friend requests, circles you belong to or create, and who a given memory is shared with.
Interactions
Comments and reactions you leave, and those left on your memories.
Device and notification data
If you enable notifications, we store a push token for your device so we can deliver them. You can turn notifications off at any time in Settings, or revoke the permission in your device's system settings.
Usage information
We record which screens are viewed within the app so we can understand which features are used and where people get stuck. When a memory is shared through a public link, we count how many times that link has been viewed.
We also use a product analytics service and a crash reporting service. The analytics service receives events such as saving a memory (and whether it is audio, photo, video, or text), sending or accepting an invitation, creating a circle, starting a recording, or opening a notification, together with your user ID, the app version, and your device model. The crash reporting service receives error and crash reports with your user ID, the app version, and your device model. These never include the content of your memories, their titles, your comments, or anyone's name or email address. You can switch both off at any time in Settings → Privacy & Security → Help improve MemoryBox. [ LEGAL REVIEW: confirm wording, legal basis (consent or legitimate interests), retention period, and the region where each provider stores this data ]
Reports
If you report a memory, we record which memory was reported, that you were the reporter, the reason you selected, and any detail you wrote. Reports are visible only to our moderators — never to the person you reported.
2. Voice transcription and AI features
Please read this section carefully. Some MemoryBox features work by sending your content, through our own server, to Google's Gemini AI service for processing. These features are optional. They stay off until you allow them: the app asks the first time you save a memory, and you can change your mind at any time in Settings → Privacy & Security → AI suggestions. If you do not allow them, MemoryBox works as before, and you write your own titles. When you have allowed them, this is sent:
- Record or add a voice memory. The audio recording is sent to be turned into a written transcript.
- Add a photo or a video. The photo, or one still picture taken from the video (never the whole video), is sent to suggest a title and description.
- Use suggested titles, Lifestory ideas or project questions. The text you have written for that memory or Lifestory is sent. For Lifestory ideas this can include the name and relationship of a tagged person if you chose one.
- See personalized writing prompts. A summary of how you have used the app, as counts of screens and events only, with no titles, transcripts or personal text.
Google's Gemini processes this content only to return a result to us, which we show you. We do not use your content to train our own models. Google's handling of the data is governed by its own terms and privacy policy. [ LEGAL REVIEW: confirm the wording of this section and of the in-app consent card (components/AiConsentHost.tsx), and that the Gemini API is used under paid terms that do not allow Google to train on this content ]
3. How we use your information
- To provide the app: storing your memories and showing them to you and the people you share them with.
- To operate social features: friend requests, circles, comments, and reactions.
- To send notifications you have enabled.
- To transcribe voice recordings and generate suggestions, as described above.
- To review reports and act on content that breaches our Terms.
- To diagnose faults, prevent abuse, and improve the app.
- To comply with legal obligations.
Our legal bases for processing, where the GDPR or similar law applies, are: performance of our contract with you (providing the app), your consent (notifications, AI features, optional profile fields), and our legitimate interests (security, abuse prevention, product improvement).
4. Who we share information with
We do not sell your personal information, and we do not share it for advertising. We use the following service providers, who process data on our behalf:
| Provider | Purpose | What it processes |
|---|---|---|
| Supabase | Authentication, database, and media storage | Account data, memories, photos, audio, connections, interactions |
| Google (Gemini API) | Voice transcription, title and description suggestions, Lifestory ideas, writing prompts (only when you have allowed AI features) | Audio recordings, photos or one still picture from a video, text you submit to those features, and counts of your app usage for prompts |
| Google Firebase | Push notification delivery | Device push token and notification content |
| PostHog | Product analytics | Usage events (such as a memory being saved, by type), user ID, app version, device model |
| Sentry | Crash and error reporting | Crash and error reports, user ID, app version, device model |
| Apple | App distribution and push delivery on iOS | Device push token |
We may also disclose information where we are legally required to, or where it is necessary to protect the rights and safety of our users.
Some of these providers operate outside your country, including in the United States. Where data leaves the [ UK / EEA — DELETE AS APPLICABLE ], transfers are made under appropriate safeguards such as Standard Contractual Clauses.
5. Public memory links
MemoryBox lets you create a public link to an individual memory. Anyone who has that link can view that memory without an account. Links are unlisted rather than secret — treat sharing one as making that memory public. You can revoke a link at any time, after which it stops working. We count views on public links.
6. Keeping and deleting your information
We keep your account and content for as long as your account is open.
You can delete an individual memory at any time from within the app. You can delete your entire account and its content in the app under Settings → Delete account, or by contacting us at admin@memory-bx.com. See how to delete your account for details. When you delete your account we remove your content and profile within [ RETENTION PERIOD, e.g. 30 days ], except where we are required to keep something longer by law. Backups are purged on our normal backup cycle.
Reports are retained after resolution so we have a record of moderation decisions. If the reported account is deleted, the report remains but is no longer linked to that account.
7. Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent where we rely on it.
To exercise any of these, email admin@memory-bx.com. We will respond within the time your law requires, and within one month at the latest. If you believe we have handled your information improperly, you may complain to your local data protection authority[ NAME THE AUTHORITY, e.g. the UK ICO ].
8. Security
Data is transmitted over encrypted connections and stored on infrastructure with access controls that restrict each account to its own content. Access to production data is limited to people who need it to operate the service. No system is perfectly secure, and we cannot guarantee absolute security.
9. Children
MemoryBox is not intended for children under [ AGE — must match your App Store age rating ]. We do not knowingly collect information from children under that age. If you believe a child has given us information, contact us and we will delete it.
10. Changes to this policy
We may update this policy. When we make a material change we will update the date at the top of this page and, where the change significantly affects you, give notice in the app.
11. Contact
Questions about this policy or your information:
admin@memory-bx.com
[ LEGAL ENTITY NAME AND REGISTERED ADDRESS ]