Memora Privacy Policy

In short

Your screenshots are read on your phone first. If you allow it, the ones Memora can’t sort on its own are shown to AI as a small copy; ones that look private never leave your phone. Memora asks on the last page of its introduction, and you can change your answer any time in Settings → Privacy.
Online look-ups also need your permission. They send a few lines of text with phone numbers, emails, codes, card numbers and IBANs masked first. You can switch them off any time.
Vault cards (passwords, codes, health) never leave your phone.
No ads, no tracking, no analytics kits, and we never sell your data. An account is optional.
You can delete your account in the app at any time, and your cards whenever you like.

Who we are

This policy covers the Memora app for iPhone and Android and this website, memorashelf.com (together, “Memora”, “we”, “us”). Memora is made and run by an independent developer, who is the controller of the personal data described here.

Questions or requests about privacy go to privacy@memorashelf.com.

What stays on your phone

Most of what Memora does happens on your device, and this data never reaches us:

Your screenshots and photos. With your permission, Memora reads your screenshots (and any picture you share to it) using the text recognition and image labeling built into your phone: Apple’s Vision framework on iPhone, and Google ML Kit’s on-device models on Android. Your photo library is never uploaded. Only if you allow picture reading (below) are screenshots Memora can’t sort on its own shown to AI as small copies.
Your library. Cards, shelves, statuses, notes and the search index are stored in a database on your phone.
Pictures you share to Memora are saved to your photo library so they can be sorted with your screenshots.
Vault cards. Anything on the Codes & Passwords or Health shelves, and any screenshot that looks like it contains a card number, an IBAN or a password, is processed on the device only. It is never sent for look-ups, never previewed on your shelves, and kept out of widgets and recommendations.
Aura (your type, mix and nudges) is worked out on your phone from what you save.
Your Aura card. The name, sex, age and photo you give your card after signing up are kept on your phone, for that account. Memora checks the photo on your phone, with the same Apple Vision or Google ML Kit models, to make sure it shows one real person, and keeps only a small copy of your head and shoulders. Your age only goes on the card and into its drawing.
Widgets and notifications are prepared on your phone.
Your monthly and weekly counts. On iPhone, the number of screenshots organized this month and of social links sorted this week are also kept in the iOS Keychain, so the Free plan’s allowances carry over if you delete Memora’s data or reinstall. Each is just a month or a week and a number, and it never leaves your phone.

On Android, Google’s ML Kit may send Google anonymous performance and usage metrics about the text-recognition feature. This doesn’t include your images or their text.

What leaves your phone, and why

Some features need the internet. Here is everything Memora sends, where it goes, and when.

Online look-ups and picture reading only happen if you allow them. On the last page of its introduction, Memora asks whether it may use AI services such as Google’s Gemini: Allow turns both on, and Not now keeps sorting on your phone. You can change either one any time in Settings → Privacy. The AI assistant (Pro) asks separately before your first question.

When	What is sent	Where it goes
Online look-ups Only if you allow it; Settings → Privacy	Up to 24 short lines of text recognised in a screenshot, after masking phone numbers, emails, 6-digit codes, card numbers, IBANs, ID numbers and passwords; a guessed title; labels such as “book” or “food”; the app the screenshot came from; numbers that look like an ISBN, a price or a date; and links or @handles in the text. Never the image.	Our server, which may ask the catalogs and AI services below to identify the item and write a short summary.
Picture reading Only if you allow it; Settings → Privacy	A small copy (about 1000 pixels on its long side) of a screenshot or shared picture Memora couldn’t sort with confidence, with the masked text your phone read in it and the shelf it guessed. Never a screenshot on a private shelf (Chats, Bills & Receipts, Tickets, People & Contacts, Notes, Codes & Passwords, Health) or one that looks like it contains a card number, an IBAN or a password. Earlier screenshots Memora wasn’t sure about are looked at too, under the same rules.	Our server, which passes the picture to Google’s Gemini API to recognise what it shows (a book, a place, a product) and then discards it. When Gemini is busy, one of the other AI services listed below may be asked instead. We keep the answer, not the picture, for up to six hours so a retry doesn’t ask twice.
Sharing a link to Memora With online look-ups on	The link, plus any title or text the other app shared with it (such as a caption).	Our server, which fetches the public page (title, description, pictures), sometimes through the platform’s public embed service. For Instagram, TikTok, YouTube and similar posts it may send the post’s public pictures (a carousel’s slides, a video’s cover image) and text to an AI service to work out what the post shows and pick a shelf. For a public video it reads the video’s own captions or, when there are none, sends the video’s sound to an AI service to write down what is said. The words are kept with your card, and on our server for 30 days under the video’s address. To apply the Free plan’s weekly allowance of social links, the server also notes each social link you share with your device ID or account and the week: as a one-way fingerprint, not the link itself, kept for about a month. Nothing from your phone is sent: not your screenshots, not your photos.
Opening a card With online look-ups on	The card’s title, subtitle and summary and a few of its facts (such as the author, the city or the brand). For a shared post, its caption, the words on its pictures and what is said in its video. For a screenshot, its text after masking. Never the picture, your note, a Vault card, or a card on Chats, Bills & Receipts, Tickets, People & Contacts, Notes, Codes & Passwords or Health.	Our server, which asks the catalogs and AI services below to write the card’s page: what it is, why it’s worth your time, its good and bad sides, or what a video covers. The page is kept on your card. Our server keeps it for 30 days under a one-way fingerprint, not linked to you, so the same page isn’t written twice.
Moving a card to another shelf	The card’s random ID and the old and new shelf.	Our server, to improve sorting.
Recommendations (Pro) With online look-ups on	Titles and creators of cards on a shelf. Never images, notes or Vault cards.	Our server, which may ask catalogs and AI services for related titles.
Asking the AI assistant (Pro) Only if you allow it, before your first question; Settings → Privacy	Your question, the last few messages of the conversation, and the cards the question needs: their shelf, title, subtitle, status, the day you saved them, a few facts (such as the author, the year or the city) and a short summary, after masking phone numbers, emails, 6-digit codes, card numbers, IBANs, ID numbers and passwords. Never a picture, your notes, a Vault card, or a card on Chats, Bills & Receipts, Tickets, People & Contacts, Notes, Codes & Passwords or Health.	Our server, which passes them to one of the AI services below to write the answer and keeps none of it: not your question, the cards or the answer. For the daily limit it keeps a count of your questions (not what they say) with your device ID or account, for two days.
Drawing your Aura card (Pro) Only if you add a photo or choose a drawn character	The small copy of your photo (480 pixels square, your head and shoulders) with the sex you chose. If you’d rather not use a photo, only your sex and your age in years, for a character drawn to match. Either way, the two kinds of things you save most (such as books or recipes, never a private shelf), so the drawing gets a detail or two that fits them. Never your name, your birthday or what you saved.	Our server, which passes it to Cloudflare Workers AI’s image model to draw you in the card’s style and sends the drawing back to your phone, where it’s kept. Neither our server nor Cloudflare keeps your photo, and Cloudflare doesn’t train on it. A drawn character (without a photo) is kept on our server, not linked to you, so others of the same gender and age can get the same one. For the daily limit we keep a count of your drawings with your device ID or account for two days.
Using the app at all	A random device ID created by Memora (not an advertising or hardware ID), the app version, your language, your platform (iOS or Android), and the phone model and OS version.	Our server, to answer requests, apply your plan, show the right messages and prevent abuse.
When the app hits an error or crashes On by default; Settings → Privacy → Send crash reports	What went wrong and where in the app’s code, the app version, phone model and OS version, and the app’s recent technical log with personal details masked. Never your screenshots or their text.	Our server, to find and fix the problem.
Sending feedback	Your message and its kind (problem, idea, other), the app version and platform, and, only if you choose, the same masked technical log. If you’re signed in, your account, so we can reply.	Our server.
Creating an account Optional	Your email and, if you give it, your name; your password as a salted hash; or the account ID Apple or Google confirms for you. Sign-in times and language. To confirm an email address before the account is made, we email it a six-digit code; if the address already has an account, we email it a note saying so instead.	Our server. Apple and Google handle their own sign-in screens.
Buying Pro in the app	You pay Apple through the App Store, or Google through Google Play. The app sends our server the store’s signed record of the purchase (the product, transaction ID, purchase and renewal dates, price and currency, the store’s country, and whether it renews), which we check with Apple or Google, together with your account or the phone’s random device ID. Apple and Google then tell our server about renewals, cancellations and refunds. We never see your card or your Apple ID or Google account details.	Apple or Google, and our server.
Buying Pro with a card	On our website, or in the app in the United States when the App Store or Google Play can’t sell Pro, you pay on Stripe’s secure checkout page, where the purchase is sold through Link, Stripe’s checkout service. Stripe and Link collect your payment details, email and billing address there (the address works out any sales tax or VAT). We receive your Stripe customer ID, plan, subscription status and dates, and amounts paid. We never see your full card number.	Stripe, Link and our server.
Refer & earn and invites If you invite friends, or join with an invite	When you open Refer & earn, your account gets an invite code for its link. When a friend joins with an invite, in the app or on our website, the code goes to our server with the friend’s account if they’re signed in and, from the app, the phone’s random device ID. For each friend who joins we keep the inviter’s account, the friend’s account or random device ID (or both), the platform (iOS, Android or web), the days of Pro each of you got, and when. The invite page on our website shows what an invite gives, never who sent it.	Our server. When a friend’s joining earns you Pro, our email provider sends you a short note that doesn’t say who they are.
Redeeming a promo code	The code, with your account if you’re signed in and, from the app, the phone’s random device ID. We keep which code was used, by which account or device (or both), on which platform (iOS, Android or web), when, and when the Pro it gave ends.	Our server.
Signing in on our website To redeem a code, buy Pro, or use the account pages	The email address you type, and your password when you sign in with one. If you choose Continue with Google or Continue with Apple, you sign in on Google’s or Apple’s own page, which sends an identity token back to our server, as the app does; Google and Apple handle their own sign-in screens under their privacy policies. For a sign-in with an emailed code, we email a six-digit code to the address if it belongs to a Memora account; the code is stored only as a hash, expires after 15 minutes and works once. On the redeem and Pro pages the sign-in lasts up to an hour and is kept only in the open page, never in cookies or browser storage. On the account pages (memorashelf.com/login, /dashboard and /account) it is kept in your browser’s local storage until you sign out, for up to 30 days with a password and up to an hour with an emailed code, so you don’t have to sign in on every visit. It never leaves your browser except to our server.	Our server and our email provider.
Resetting your password	Your email address and a one-time code that expires after 15 minutes.	Our email provider.
Emails about your account	Your email address and first name, to send a welcome email, sign-up codes, security notices (such as a changed password), sign-in codes for our website, a note when a friend’s joining earns you Pro, and plan and billing notices (such as Pro starting or ending). We keep a record of which of these emails went out and when for 90 days.	Our email provider and our server.
Maps, covers and fonts	Ordinary web requests for map tiles, cover pictures and typefaces. To place a saved address on your map, the app asks your phone’s built-in geocoding service for its coordinates.	Esri (map tiles); the catalog a picture came from, such as Open Library, TMDB, TheMealDB, Wikimedia or Apple; Google Fonts; Apple (iPhone) or Google (Android) for geocoding.

Like any website or app server, the services above can see the IP address a request comes from.

How we use information

We use the information above only to:

Provide the features you ask for: look-ups, link previews, recommendations, sign-in, your plan across devices, promo codes and invites. Legal basis: performing our contract with you.
Keep Memora secure and available: rate limits, stopping abuse (including of promo codes and invites), fixing errors. Legitimate interests.
Improve sorting, using which shelves cards get moved between. Legitimate interests.
Take payments and keep the records tax law requires. Contract and legal obligation.
Send account emails: a welcome, password reset codes, sign-in codes for our website, security notices, a note when an invite earns you Pro, and plan and billing notices. We don't send marketing emails. Contract.

Access to your photos and notifications is based on the permission you give in your phone’s settings, which you can withdraw at any time. Online look-ups and picture reading are based on the permission you give when you tap Allow in Memora, which you can withdraw at any time in Settings → Privacy.

Services we rely on

These providers process data for the purposes above and only as needed to provide their service:

Apple (App Store) and Google (Google Play): payments and subscriptions bought in the app; they confirm each purchase to our server and tell it about renewals, cancellations and refunds.
Stripe and Link, Stripe’s checkout service: card payments on our website, and in the app in the United States when the store can’t sell Pro. Link sells these purchases on our behalf, handles their sales tax or VAT, receipts and payment questions, and lets you manage the subscription at link.com.
Groq and Google (Gemini API): AI models that read masked look-up text, link details and the public pictures of shared posts, and, if you allow picture reading, the screenshots Memora sends, and, if you use the AI assistant, your questions and the masked cards they need, to name items, write summaries and card pages, suggest shelves and answer your questions. Groq also writes down what is said in shared public videos. Anthropic (Claude) may be used for the same purpose. Google’s free Gemini tier may use what it’s sent, pictures included, to improve Google’s products, and people at Google may review it; that’s why personal details are masked, private screenshots are never sent, and picture reading only happens if you allow it.
Cloudflare Workers AI, OpenRouter and Mistral: other AI services we may use for the same purposes, pictures included, when the ones above are busy. Cloudflare Workers AI also draws Pro Aura cards from the photo you add to yours. Cloudflare doesn’t keep that photo or use what it’s sent to train models; through OpenRouter we only use hosts that neither keep nor train on what they’re sent; Mistral is used only with its training option switched off.
Public catalogs: Open Library (Internet Archive), Google Books, The Movie Database (TMDB), TheMealDB, Wikipedia and Wikiquote (Wikimedia), Apple’s iTunes Search, OpenStreetMap’s Nominatim and ZenQuotes. We send them titles or search words from a look-up, never your account or device details.
Link platforms: when you share a link, our server may ask that platform’s public embed service (for example YouTube, TikTok, Vimeo, Spotify, SoundCloud, X, Reddit, or Meta for Instagram and Facebook) for the post’s title and preview.
Email delivery: the mail service that sends our account emails.
Apple and Google: Sign in with Apple and Google Sign-In, if you use them.
Esri (map tiles) and Google Fonts (typefaces in the app).
Cloudflare: our domain’s DNS, and forwarding of email sent to @memorashelf.com.
Our hosting provider, which runs our servers.

What we never do

Upload your photo library, or send a screenshot without your permission. Even with it, screenshots that look private and ones Memora can sort on its own stay on your phone.
Show ads, use advertising IDs, or track you across other apps and websites.
Include third-party analytics or crash-reporting kits. Crash reports go only to our own server, and you can turn them off.
Sell or rent your personal data, or “share” it for cross-context behavioral advertising.
Build a profile of who you are. Aura describes your interests and is computed on your phone.
Train our own AI models on your content.

How long we keep it

On your phone: until you delete it. Settings → More → Delete all Memora data removes your cards, notes and search index; uninstalling does the same. Only the monthly count described above stays in the iOS Keychain, and it starts over each month. Your photos are never touched.
Your account: until you delete it. When you do, we immediately erase your email, name, password hash and Apple or Google account ID, sign you out on every device and detach your devices from the account. We send one email to confirm the deletion; the address is removed from our email records as soon as it has gone out. A de-identified record of the account (its ID, plan history and dates) remains.
Payment records: kept as long as tax and accounting law requires. Apple, Google and Stripe keep their own records under their privacy policies.
Device records and look-up logs carry only the random device ID, never the text you sent, and are kept while needed to run and secure the service.
Crash reports, technical logs and feedback are kept while we need them to fix problems and answer you, and deleted once they’re no longer useful.
Look-up results about public items (like a book’s details) are cached under a one-way fingerprint of the request, so repeat look-ups are fast. The cache isn’t linked to your account or device. Card pages and the words of shared public videos are kept the same way, for 30 days.
Your Aura card: its details, the small copy of your photo and your drawing stay on your phone until you change or remove them in Edit card, or delete Memora’s data. Our server keeps neither your photo nor your drawing.
Invites and promo codes: the records described above are kept while the accounts involved exist. When an account is deleted, its invite link stops working, and these records stay only with its de-identified record, like its plan history.
Password reset codes, sign-up codes and website sign-in codes are stored only as hashes, expire after 15 minutes and work once. Sign-in sessions in the app, and on our website’s account pages, last up to 30 days unless you sign out; a sign-in with an emailed code on our website lasts up to an hour.

Security

All connections use HTTPS. Passwords are stored only as salted scrypt hashes. Sign-in tokens expire and are revoked when you sign out or delete your account. Personal details are masked on your phone before a look-up is sent, and Vault content never leaves it. No system is perfectly secure; if you find a vulnerability, please email security@memorashelf.com.

Your rights and choices

Use Memora without an account, and without online look-ups or picture reading: tap Not now when Memora asks, or switch them off any time in Settings → Privacy.
Stop crash reports with Settings → Privacy → Send crash reports.
Delete your account in the app: open Settings, tap your profile at the top, then Delete account. Other ways are explained here.
Access, correct, export or delete the personal data we hold, object to or restrict how we use it, or withdraw consent, by emailing privacy@memorashelf.com from the address on your account. We answer within 30 days.
If you’re in the EEA, the UK or Switzerland, you can also complain to your local data protection authority.
California residents have the right to know, delete and correct personal information, and to opt out of its sale or sharing. We don’t sell or share it, and we won’t treat you differently for using your rights.

Children

Memora is only for people aged 18 and over, and we don’t knowingly collect personal data from anyone younger. If you believe someone under 18 has created an account, email us and we’ll delete it.

International transfers

Our servers and the providers above may be located in the United States and other countries. When data moves from the EEA, the UK or Switzerland, we rely on the safeguards those providers offer, such as the European Commission’s Standard Contractual Clauses.

This website

memorashelf.com uses no cookies, no analytics and no third-party scripts, fonts or embeds. Our web server may briefly keep basic request logs (IP address, time, page and browser) to keep it secure.

The invite page (memorashelf.com/r/…), the redeem and Pro pages, and the account pages (memorashelf.com/login, /register, /dashboard and /account) talk to our server through memorashelf.com itself. The invite page only asks what an invite gives. The redeem and Pro pages send what you type there, as described above, and keep your sign-in in the open page only, so it’s gone when you close it. The account pages keep your sign-in in your browser’s local storage, as described under “Signing in on our website”, until you sign out or it expires. Choosing Continue with Google or Continue with Apple takes you to Google’s or Apple’s own sign-in page, which brings you back here; this site still loads nothing from them. Nothing else is stored in your browser.

Changes to this policy

If we change this policy, we’ll update this page and the date at the top. If a change is significant, we’ll also let you know in the app before it takes effect.

Contact

Email privacy@memorashelf.com about anything in this policy. For help with the app, write to support@memorashelf.com.