Privacy policy
Version 1 · Effective October 23, 2026
This policy explains what personal data Mementum collects, why, who we share it with, how long we keep it, and the choices and rights you have. It covers:
- the Mementum app on iPhone and Android and the services behind it (the "app"); and
- our online store at mementum.io (the "store").
Where something applies to only one of them, we say so.
1. Who we are
Mementum, Inc., a Delaware corporation, 1600b Southwest Dash Point Road #2171, Federal Way, WA 98023, United States, is responsible for your personal data (the "controller" under the EU and UK GDPR). Contact us about privacy at team@mementum.io.
2. The short version
- We collect what you give us (your account and memories in the app, your order details in the store) and some technical information needed to run them.
- Memories on a piece can be seen by anyone who scans that piece while it is unlocked. Memories kept only in your account are private to you.
- We remove location data from photos on your phone before they are uploaded.
- We analyse content with automated tools to understand how people use Mementum and to improve it. No person at Mementum looks through your photos, except to handle a report or a support request you send us.
- In the app, we do not sell your data, we do not show ads, and we do not track you across other companies' apps or websites.
- In the store, we use cookies and advertising tools from Google and Meta to measure and advertise our jewelry, which you can turn off (sections 4 and 9).
- We never use your content in marketing without asking you first.
3. What we collect
In the app
Your account - Email address, display name and password. We store only a secure hash of your password, never the password itself. - If you sign in with Apple or Google: the identifier and email address they give us. - When you created your account, confirmed your email, and which versions of our terms and this policy you accepted, and when.
Your memories - The photos, videos, sound recordings and text you add, with their captions, titles, dates and any place name you type. - Which piece each memory belongs to, who added it (your display name is shown with it), and its order in the story. - Memories you deleted, for 30 days (section 7). - Before a photo or video leaves your phone, the app re-encodes it and removes its location data, keeping only the date it was taken.
Pieces and scans - The pieces you own and have named. - Each time you scan a piece: which piece, your account, the time and the app version.
Safety - Reports you make (which memory, and any reason you give), people you block, and any action we take on reports, such as hiding a memory or closing an account.
Technical information - The app version, your phone's platform (iPhone or Android) and operating system version, recorded with your sign-in session and when you last used the app. - Your IP address, which our servers see with every request. We use it only in memory, for security such as limiting sign-up abuse, and do not store it. - Crash and error reports: the app version, device model, operating system and what the app was doing when the error happened. They are not linked to your account.
When you contact us - Your email address and what you write to us.
The app does not collect your contacts, precise location, payment details, health data or advertising identifiers.
In the store
- Orders: your name, email, phone number, shipping and billing addresses, what you bought, and order and delivery history. Payments are handled by Shopify Payments and PayPal; we never see your full card number.
- Email sign-ups: your email address and, if you choose, your name and birthday, when you sign up for our emails.
- Reviews: the name, rating, text and photos you post in a product review.
- Browsing: cookies and similar tools record the pages you view, items you add to your cart, your device and browser, approximate location from your IP address, and how you reached us (for example from an ad).
- Messages you send us.
4. Why we use it, and our legal basis
| What we do | Data used | Legal basis (EU/UK GDPR) |
|---|---|---|
| Run your account, store and show your memories, sign you in | Account, memories, pieces, technical | Contract: it is what you asked us to do |
| Take and deliver your order, handle returns, refunds and support | Order data | Contract |
| Send account email (confirmation, password reset, important notices) | Contract | |
| Keep the app secure, stop abuse, enforce the terms, handle reports and blocks | Account, technical, safety, memories that are reported | Legitimate interests: keeping people and the service safe |
| Analyse content and usage automatically to understand how people use Mementum and to improve it (section 5) | Memories, pieces, scans, usage | Legitimate interests: improving the product; you can object (section 9) |
| Run and secure the store, understand how it is used, detect fraud | Order data, browsing | Legitimate interests; non-essential cookies only with your consent where the law requires it |
| Advertise our jewelry and measure our ads, including with Google and Meta | Browsing, order events | Your consent through the store's cookie banner, where the law requires it |
| Send marketing email | Email sign-up | Your consent; unsubscribe at any time |
| Use your content in marketing | Only content you say yes to | Your consent, which you can withdraw at any time |
| Keep records the law requires, and respond to lawful requests | As needed | Legal obligation |
5. Automated analysis of content
To learn how Mementum is used, such as what occasions pieces mark and who they are given to, we analyse memories with automated tools. For example, a tool may describe what a photo shows (how many people, the kind of occasion) or summarize a piece's story.
- No human review: no one at Mementum looks through people's photos or memories, except to handle a report or a support request you send us.
- Not used to train others' tools: your content is not given to anyone else to build or train their own products.
- What comes out: results are used in aggregate, to make product decisions. They are not used to make decisions with legal or similarly significant effects on you, and not to target ads.
- Your choice: you can object to this analysis of your content (section 9).
6. Who can see your data, and who we share it with
People using the app - Memories on a piece: anyone with a Mementum account who scans the piece while it is unlocked can see them, with the display name of the person who added each one. - Memories kept in your account and not attached to a piece: only you. - We are adding locked pieces and ways to share memories between people and pieces. Before any such change affects who can see your memories, we will update this policy and tell you in the app.
Service providers who process data for us, under contracts that limit them to doing so on our instructions:
| Provider | What they do |
|---|---|
| Fly.io | Runs our servers |
| PlanetScale (on Amazon Web Services) | Hosts our database |
| Cloudflare (R2) | Stores photos, videos and recordings, and our backups |
| Resend | Sends account email |
| Sentry | Collects crash and error reports from the app |
| Apple, Google | Sign in with Apple and Google sign-in, when you use them |
| Google Firebase | Hosted the earlier Mementum app. Used only to move your existing account to this app at your first launch, then retired |
| Shopify | Runs the store and checkout, sends store email, and hosts these policies |
| Shopify Payments, PayPal | Take payments in the store |
| TaxJar | Calculates sales tax on store orders |
| ShipHero, Shippo, shipping carriers | Pack, label and deliver your order |
| Judge.me | Collects and shows product reviews |
| UpPromote | Runs our affiliate program, recording which affiliate link brought you to the store |
Advertising partners (store only). If you allow it in the cookie banner, or where the law does not require consent, the store sends Google (Analytics, Ads and Merchant Center) and Meta (Facebook and Instagram) information about your visit, such as pages viewed, items added to cart and purchases. They use it to measure and show our ads, and also under their own privacy policies. You can say no in the cookie banner or in "Your privacy choices" at the bottom of the store.
Others, only when needed: if the law requires it, to protect someone's safety, to investigate abuse, or if Mementum is sold or merged, in which case we will tell you before your data is covered by a different privacy policy.
We do not sell or rent personal data for money. The app never shares data for advertising. The store's use of Google and Meta advertising tools can count as "sharing" for cross-context behavioural advertising, or a "sale", under some US state laws; you can opt out (section 9).
7. How long we keep it
- Your account: while you have it. When you delete your account, we remove your email, name, password and sign-in links at once, and end every session.
- Memories you added to pieces stay with those pieces after you delete your account, still showing the name you used, because they are part of that piece's story (see the Terms of Service). Delete any you want gone before you delete your account, or ask us at team@mementum.io to remove your name from them.
- Memories you delete: recoverable in "Recently deleted" for 30 days, then erased, including their files.
- Backups: deleted files are fully gone within 30 days. Database backups are kept for up to 12 months and are used only to restore the service after a failure, so removed data can remain in them until they expire.
- Uploads that never finished: removed after 7 days.
- Scan, report and session records: while your account exists; reports for as long as needed to handle them and to keep the service safe.
- Server logs (which record app version and platform, not your content): up to 30 days.
- Analysis results are kept in aggregate form and are not linked to your account.
- Store orders: as long as tax and accounting law requires, usually 7 years. Email sign-ups: until you unsubscribe. Cookies: as set out in the store's cookie banner.
8. Where your data is processed
Mementum is based in the United States, and our providers process data mainly in the United States and Canada; some store providers and shipping carriers process it in other countries. When we transfer personal data from the EU, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum), or on the provider's certification under the EU-US Data Privacy Framework.
9. Your rights
Wherever you live, you can: - see and get a copy of your data (Settings → Download my data, or write to us); - correct it (most of it you can edit in the app); - delete it (delete memories, or delete your account in Settings); - object to our automated content analysis, or any other use based on legitimate interests, by writing to us; - withdraw consent you have given, such as for marketing use, at any time.
If you are in the EU, the UK, the EEA or Switzerland, you also have the rights to restrict processing and to data portability, and you can complain to your local data protection authority. We would appreciate the chance to fix it first.
We answer requests within one month. We may need to confirm it is really you.
California and other US states. We collect the categories of personal information in section 3 (identifiers, contact and order details, user content, and internet or app activity) for the purposes in section 4. The app does not sell or share personal information. The store shares browsing and purchase events with Google and Meta for advertising, which these laws may treat as a sale or sharing; you can opt out in "Your privacy choices" at the bottom of the store, and the store honours the Global Privacy Control signal from your browser. We do not knowingly sell or share data of anyone under 16, and we do not use sensitive personal information to infer characteristics about you. You have the rights to know, delete and correct, and we will not treat you differently for using them.
Brazil. Under the LGPD you can confirm whether we process your data, access, correct, anonymize, port or delete it, learn who we share it with, and withdraw consent. Our privacy contact, team@mementum.io, acts as our data protection officer (encarregado).
Other countries may give you further rights. Write to us and we will honour them.
10. Children
Mementum is not for children under 13, or under the higher age at which your country lets you agree to online services on your own (up to 16 in parts of the EU). Younger children may use it only through a parent or guardian's account. If we learn we hold an account of a child below that age without a parent's involvement, we delete it. Parents can contact us at team@mementum.io.
11. Security
Data travels encrypted between the app and our servers. Media is stored privately and shown through short-lived links. Passwords are stored as secure hashes. Access to production systems is limited to the people who run Mementum. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.
12. Changes to this policy
We will post any change here with a new version number and date. If a change is material, for example new uses of your data or new people who can see your memories, we will tell you in the app first and ask you to accept it. Earlier versions are available on request.
13. Contact
Mementum, Inc. · 1600b Southwest Dash Point Road #2171, Federal Way, WA 98023, United States · team@mementum.io