Privacy policy

Who is responsible

Remember This is run by Pauline Vos, who is the data controller for everything described here. For anything about your data, including the requests covered below, write to privacy@remember-this.io.

The service is in closed beta. It is small, and so is the operation behind it.

What is collected

Your account. An email address, a display name, and a hashed password. The password itself is never stored, only a hash that cannot be turned back into it. If you asked for access before you had an account, the email address you left is kept until an account is handed over or the request is dropped.

What you remember. The notes you type, the voice notes you record, and the photos you add, together with when you saved them and technical details such as file size, format and duration. Nothing is inferred about you beyond what you put in.

What makes recall work. Each message is turned into a numeric representation of its meaning, which is what a search is matched against. These are stored separately from your memories and carry no readable copy of them.

Session data. A session cookie so you stay logged in, and an API token if you choose to create one. There is no analytics, no tracking, no advertising identifiers, and no third-party cookies.

Encryption at rest

Voice notes and photos are encrypted at rest. The file is encrypted before it is written to storage and is stored under a filename that reveals nothing about its contents, when it was made or whose it is. Reading the stored file without the key gets you nothing.

Typed notes are not encrypted. The text of a written note is stored as readable text, as are the numeric representations of meaning and the technical details listed above. That means whoever operates the database could read a typed note. This is stated plainly rather than buried, because it should shape what you choose to put in: notes, ideas and reminders, yes; passwords, recovery codes, card numbers or other people's sensitive details, no.

Encrypting note text as well is intended, but it is not in place today, and this page will say so until it is.

Traffic between your device and the service is encrypted in transit. Links that play back a voice note or show a photo are signed and expire after fifteen minutes, so a copied URL stops working.

What it is used for

Your data is used to run the service and nothing else: to store what you asked to be remembered, to find it again when you ask for it, to keep you logged in, and to contact you about your account.

Your data is never sold to anyone. It is not sold, rented, licensed or handed to third parties for their own purposes, and it is not used to train anyone's models, including ours. There is no advertising here and no plan to introduce any.

The lawful basis is the contract between you and the service: you cannot be given a memory keeper without the memories being stored.

Who else processes it

A few suppliers process data on our behalf, under contract and on our instructions only:

• Google (Gemini). To make a memory findable by meaning, its contents are sent to Google's embedding service: the text of a typed note, and the audio or image file itself for a voice note or photo. The same happens to a search query when you ask for something back. Files are decrypted for the moment of that request and sent over an encrypted connection.
• Hosting, database and storage suppliers. The application, the database holding your memories, and the storage holding your encrypted files are run on infrastructure operated by third-party providers.
• An email provider, for invitations and account email.

Some of these operate outside the European Economic Area, in which case transfers rely on the safeguards offered by that provider, such as standard contractual clauses.

How long it is kept

Memories are kept until you delete them. Nothing expires on its own, because that would defeat the purpose of a memory keeper.

Invitation links last seven days. Voice playback and image viewing links last fifteen minutes. A login session lasts two hours of inactivity. Server logs, which record requests but not the contents of your memories, are kept for about a fortnight.

Your rights

Under the GDPR you have the right to see the personal data held about you, to have it corrected, to have it erased, to restrict or object to how it is used, and to receive a copy in a portable form. You can also complain to your national data protection authority.

One of these you can exercise yourself, immediately, without asking anyone:

• Forget everything deletes every memory in your account. The notes, the recordings, the photos and the stored representations of their meaning all go, and your account stays open and empty. It is not a soft delete, it does not leave a copy in a bin somewhere, and it cannot be undone — so be sure before you confirm.

For any other requests regarding your data — a copy of your data, a full account deletion, or a question about any of this — write to the address at the top of this page.

Changes

If this policy changes in a way that matters, the date at the top changes and account holders are told by email.