Policy

Privacy

Your files are yours. This page says what we do with them, in order, with nothing hidden.

Effective on publicationPlain-English version. Headings are for navigation and do not change the meaning of the text.

In review This is our working privacy policy. It describes what the service does today and applies now. Our legal counsel is completing a review; when it ends, the business’s registered name, mailing address and any wording counsel requires are added here and the effective date is updated.

Who we are

MemriBank ("MemriBank", "we", "us") operates memribank.com, the MemriBank apps for iOS and Android, the MemriBank Cloud and Family services, Keepsakes, and sells the MemriBank 128GB drive. We decide how and why the personal data described on this page is used, which makes us the "controller" or "business" where privacy laws use those words.

Our mailing address is published here once the business registration is complete.

Questions, requests and complaints about privacy go to the support page. We answer in plain language.

What this policy covers

This policy covers everything we run: the website, the apps, your account, the Cloud and Family services, Keepsakes, and the waitlist and support inbox. It applies whether you are a paying customer, a family member someone invited, or just visiting.

It does not cover two things, because they never pass through us:

Files on your drive or your phone. When the app copies photos to your drive, the copy goes from your phone to the drive. We only receive the files you choose to upload to the Cloud.
Payment pages run by Stripe. Checkout and the billing portal are Stripe pages under Stripe's privacy policy. We receive the outcome, never the card.

What we collect

We collect only what the product needs to work. Here is the full list, grouped by where it comes from.

Account: Email address, display name, a hash of your password (never the password itself), optional phone number, the time you accepted these terms, your email-verification state, and your sign-in sessions with the device name, app version, rough location from the IP address and the time of last use. You can see and revoke every session from your account page.
Orders and payment: What you bought, the shipping name, address and phone you entered at checkout, the tax calculated for that address, order status and tracking number. Stripe collects and stores your card details; we store only Stripe's customer and payment identifiers, the last four digits and card brand Stripe gives us for receipts, and whether a payment succeeded or was refunded. Card numbers never reach our servers.
Device and app data: The app tells us which device it runs on, the OS and app version, which backup target you chose (drive or cloud) and backup reports: counts, sizes and checksums of files copied, and any errors. Backup reports never contain the files. The app reads your photo library only with the permission you grant and never deletes anything from it.
Media you upload to the Cloud: The original photo, video or audio file, exactly as uploaded, plus anything you add to it: captions, tags, album placement, the names you type on people, and audio stories you record. People names are labels you type yourself. We do not run face recognition.
Metadata we derive: From each upload we make thumbnails and previews, compute a checksum to verify the copy, read the embedded EXIF data for the capture date and, where present, the location where the photo was taken, and build a search index over captions, filenames, tags, people labels and transcripts. If you turn transcription on for a recording, the transcript is derived data too; you can edit or delete it.
Audit events: A record of who invited whom, album permission changes, downloads, exports, sign-ins, password changes and similar actions, so you and your family can see what happened and so we can investigate abuse. The Family activity feed is built from these records.
Usage and server logs: Request logs with IP address, browser or app identifier, the endpoint called, timing and errors. Logs never contain your media or the contents of your files.
Support messages: What you write to us, your email address and the order or account it concerns.
Waitlist: Your email address and which product you are interested in. Nothing else.
Family invitations: When you invite someone, we store the email address you enter so we can send the invitation and show you whether it was accepted. If they never accept, the invitation expires and the address is removed with it.

We do not buy data about you from anyone, and we do not combine your account with data from advertising networks.

Why we use it, and on what basis

Each use below names the legal basis that applies where the law (such as the GDPR or UK GDPR) asks for one.

To deliver what you asked for (performance of a contract): Ship your drive, keep your account, store and show your media to you and the people you invite, run backups, bill your subscription, send receipts and order updates, fulfil keepsakes you approve, and answer support requests.
To keep the service safe and working (our legitimate interests): Authenticate sign-ins, detect abuse and attacks, rate-limit, debug failures, keep audit trails, and verify that every uploaded copy matches its checksum. We balance these interests against your privacy and keep the data narrow.
Things you switch on (your consent): Transcription of an audio story (off by default; we record the time you turned it on), sending a keepsake to the print partner (only after you approve the proof and confirm), reading your photo library on your device, and any future feature that sends your content to a new processor. You can withdraw consent at any time; the processing already done stays until you delete the result.
Because the law requires it (legal obligation): Keeping invoices and tax records for orders and subscriptions, responding to lawful requests, and honouring your privacy rights.

We do not use your media or your personal data for advertising, profiling or automated decisions that affect you.

Who can see your media

You. Everything you upload is private to you until you place it in a shared album.
People you explicitly invite. Sharing is per album and per person. Someone you invite sees only the albums they were granted, and only while the grant lasts. A family member sees nothing automatically just by being in the family. There are no public share links.
The person paying for a Family subscription can invite and remove members and manage the bill. They cannot see any other member's private vault or Only Me files.
Our staff: no. The console our team uses shows orders, inventory, subscriptions and job status. It has no screen, button or API that opens customer media. Engineering access to production storage is restricted to keeping the service running, is logged, and is never used to look at your photos.
Advertisers: never.
AI training: never. We do not use your photos, videos, recordings, transcripts or captions to train machine-learning models, ours or anyone else's.
Authorities: only when legally compelled. If we receive a valid legal demand, we check it, limit what we hand over to what the demand covers, and tell you unless the law forbids it.

Only Me, once it is offered, is designed so that files you place in it are protected on your device with keys we do not hold; see security for its current state.

Companies that process data for us

We use a small number of providers. Each one works under a contract that limits what they may do with your data to providing the service to us.

Amazon Web Services (AWS): Hosts our servers, database and private file storage in the United States (the us-east-1 region, in Virginia). Your originals, previews and exports live in a private bucket with public access blocked.
Stripe: Payments, subscriptions, invoices and sales tax. Stripe receives your name, email, shipping address, phone and card details on its own pages, and acts as an independent controller for payment processing and fraud prevention.
Amazon Simple Email Service (SES): Sends our transactional email: verification, receipts, shipping updates, invitations, export-ready and security notices. SES sees the recipient address and the message.
Print partner: Keepsakes are printed and shipped by a third-party print partner (currently Printify). Only after you approve the proof and confirm do we send the rendered pages, the product details and the shipping name and address to the partner. The partner keeps those files as long as needed to print, ship and handle reprints.
Transcription provider: When transcription is available and you turn it on for a recording, that recording is sent to a cloud speech-to-text provider (named here when the feature is turned on) and the text comes back to your vault. Recordings you do not opt in for never leave our storage.
App stores: If you install the app from Apple's App Store or Google Play, Apple or Google handle the download, updates and any crash reports their platform collects under their own policies. Subscriptions are billed by us through Stripe, not through the stores.

That is the whole list. We do not run third-party analytics, advertising pixels or social-media trackers on memribank.com or in the apps. If we add a provider, we update this page before the feature goes live and ask for consent where the law requires it.

Where your data is stored

Our service runs in the United States. If you use MemriBank from elsewhere, your data is transferred to and stored in the US. Where the law requires a safeguard for that transfer, for example for people in the European Economic Area, the United Kingdom or Switzerland, we rely on the approved transfer mechanism named here. You can ask us for a copy of the safeguard through the support page.

How long we keep things

The rule is simple: your content stays until you delete it, and when you delete it, it goes. The details:

Originals, previews and search entries: Kept until you delete the item or your account. Previews, checksums, transcripts and search entries are removed together with the original.
Trash: A deleted item waits in Trash for the period shown in your account settings so a wrong tap is recoverable, then is purged along with its derived data. You can empty Trash sooner.
Exports: An export ZIP and its manifest are available for download for the period shown when you request the export and then deleted from our storage.
Deleted account: When you delete your account we revoke every session, cancel subscriptions and start a grace period of the period shown in your account settings during which you can sign in and cancel the deletion. When it ends, your media, derived data, labels, audit trail and profile are purged.
Orders, invoices and tax records: Kept as long as tax and accounting law requires, even after the account is gone. These records contain your name, address and what you bought, never your media.
Audit events and server logs: Kept for a limited period for security investigation and then deleted.
Infrastructure backups: Our database and storage backups exist so we can recover from our own failures. A deleted item may persist in those backups for a short, fixed time after it is purged, and is never restored to a live account.
Keepsake print files: Rendered pages are kept only as long as needed to fulfil the order and handle a reprint, then deleted on our side and requested deleted at the partner.
Waitlist and support messages: Waitlist entries are removed when you ask or when the product you signed up for is no longer offered. Support threads are kept while the matter is open and for a limited time afterwards so we can follow up.

Your rights and choices

Most of these you can do yourself from the account page, without asking us.

Access and export. Download any original at any time, or request a full export: a ZIP with your originals and a manifest listing every file, its checksum, captions, tags, people labels and transcripts.
Correction. Edit your profile, captions, dates, tags, people labels and transcripts whenever you like.
Deletion. Delete individual items, empty Trash, or delete the whole account. Deletion propagates to previews, search entries and shared albums.
Portability. The export is in ordinary formats (your original files plus JSON and CSV manifests) that work without MemriBank.
Objection and restriction. You can object to processing based on our legitimate interests, and ask us to restrict processing while we check. You can withdraw consent for transcription or printing at any time.
Sessions and devices. Review every signed-in session and revoke any of them.
Marketing. We send marketing email only if you opted in, and every such email has an unsubscribe link. Transactional email (receipts, security notices) is part of the service.

If you live in California or another US state with a privacy law

You have the right to know what personal information we collect, use and disclose (this page is that disclosure), to access and delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of; we have not done so in the preceding twelve months. We do not use or disclose sensitive personal information for anything other than providing the service. You may use an authorised agent; we will ask the agent for proof of authority and may ask you to confirm.

If you live in the EEA, the UK or Switzerland

You have the rights of access, rectification, erasure, restriction, portability and objection described above, plus the right to lodge a complaint with your data-protection authority. Our legal bases are listed under why we use it. We do not make automated decisions with legal or similarly significant effects about you.

How to make a request

Use the account page for anything it offers; for everything else write to the support page from the email address on your account. We verify requests by confirming control of that address and may ask one more question if the request concerns someone else's data. We respond within the time the applicable law allows, and we do not charge for a reasonable request.

Children and family members

MemriBank accounts are for adults. The website and apps are not directed at children under 13, and we do not knowingly collect personal data from a child under 13 who is acting on their own. If we learn that we have, we delete it; tell us at the support page.

Families include children, and a family owner may invite a family member who is under 18. When that happens:

The adult who sends the invitation is responsible for having the authority to do so, for the child's use of the family space, and for the content shared with them.
A minor's membership gives them the same privacy as anyone else: the family owner cannot see their private vault, and they see only the albums they were granted.
The owner can remove the member at any time, which ends their access immediately.

Photos of children uploaded by an adult are that adult's content; see the terms for what you need before uploading pictures of other people.

Security

What we actually do today, each item in the state it is in. The security page keeps the live list.

All traffic to our servers and storage is encrypted in transit. Files sit in a private bucket with public access blocked and are encrypted at rest by the storage provider.
Every listing, preview and download is authorised on the server against your account and your album grants. Guessing a file ID returns nothing. We test this for cross-account access as part of every release.
Preview and download links are signed per file and expire quickly.
Passwords are stored as salted hashes. Password resets use single-use links. You can revoke sessions device by device.
The staff console cannot open customer media, and its data model has no field for file links. Staff actions are audited.
Every upload is verified against its checksum before it counts as a copy.

Only Me In review

Only Me is a separate vault designed so that files are protected on your device with keys we do not hold, so that an email-and-password login alone cannot open them, and so that no server process (previews, search, transcription, printing) sees their contents. The design, key handling and recovery flow are with an independent reviewer. Until that review is complete we describe it only as "in review" and make no stronger claim. If you lose both your recovery phrase and every enrolled device, we cannot recover those files.

What we do not claim

No system is perfectly secure, and we do not say otherwise. We do not claim certifications we have not earned, and we are not a bank, an insurer or an insured financial service. If we discover a breach affecting your personal data we tell you and, where required, the relevant authority, without undue delay. Found a vulnerability? Please report it to the support page before anyone else.

Cookies and local storage

memribank.com does not use advertising or tracking cookies, and there is no cookie banner because there is nothing to consent to. What the site and web app keep in your browser:

Sign-in tokens in your browser's local storage, so you stay signed in. They are removed when you sign out or revoke the session.
Upload progress and a few preferences (such as which recordings you have already listened to) in local storage, so an interrupted upload can resume and the app remembers small choices. This data stays on your device.
Stripe cookies on Stripe's own checkout and billing pages, used by Stripe for the payment and for fraud prevention.

The mobile apps keep your session and backup state in the OS keychain or app storage on the device. Clearing them signs you out and does nothing to your files.

Changes to this policy

When we change this policy we update the effective date at the top. For changes that matter (a new processor, a new use of your data, a change in retention) we email account holders before the change takes effect and, where the law requires it, ask for consent. Old versions are available on request.

Contact

MemriBank · the support page

Our mailing address is published here once the business registration is complete.