Privacy Policy

1. Who We Are

The Memory Palace is operated from Belgium. We built this app to help you preserve and share your most precious memories: safely and privately. We are committed to protecting your personal data in full compliance with the General Data Protection Regulation (GDPR) and applicable Belgian and EU law.

For any privacy-related questions, you can always reach us at: privacy@thememorypalace.ai

Data controller. The controller responsible for the processing of your personal data is The Memory Palace, Leuven, Belgium. Contact: privacy@thememorypalace.ai

We are not legally required to appoint a data protection officer (DPO) and have not appointed one; all privacy enquiries are handled through the address above.

2. What We Collect

We only collect what we need to provide you with a great experience. Here is what we gather:

• Profile information: your name, email address, and profile photo when you create an account.
• Your memories: the photos, videos, stories, and other content you upload to your Memory Palace. This is the heart of the service.
• Device information: basic details like your browser type and screen size, so we can make the app look and work its best on your device.
• Subscription and billing data: your plan, subscription status, billing period end date, and payment references (an Apple original transaction ID for App Store purchases, or Stripe customer and subscription IDs for web purchases). We never see or store your payment card details: payments are handled by Apple or Stripe.
• Push token (mobile app): if you allow notifications in the iPhone or Android app, we store a push token: a code that Apple or Google gives this app on your device, together with the platform (iOS or Android) and the app version. We use it only to send you an occasional reminder when your palace has been quiet for a while. The token is kept as long as the app may send you notifications on that device. It is deleted when you turn off “Reminders” (Settings, Notifications, Reminders), when Apple or Google tells us the token is no longer valid (for example because you removed the app or blocked notifications), and when you delete your account. If you have unsubscribed from our emails, you will not get these reminders either.

Special Categories of Data (Art. 9 GDPR)

Memories can contain sensitive data (for example health information, religious or philosophical beliefs, or family history that may reveal genetic or ethnic information). You share such data voluntarily; our legal basis for processing it is your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time by deleting the content. We ask you to record only sensitive data you consciously want to preserve.

3. How We Use Your Data

We use your data solely to provide and improve The Memory Palace. Specifically:

• To store, organize, and display your memories in your palace.
• To authenticate your account and keep it secure.
• To send you important service-related messages (such as email confirmations, security alerts, or legacy notifications).
• To improve the app based on your feedback and support requests.

We will never use your data for advertising, and we will never sell it to anyone.

Legal Basis for Processing (Art. 6 GDPR)

We process your personal data under the following legal bases:

• Contract performance (Art. 6(1)(b)): storing your memories, account management, providing core app functionality, and managing your subscription and billing status.
• Consent (Art. 6(1)(a)): AI-powered features (tagging, context generation, interviews), optional cookies, and marketing communications.
• Legitimate interest (Art. 6(1)(f)): security monitoring, abuse prevention, and service improvement based on aggregated usage patterns.
• Legal obligation (Art. 6(1)(c)): responding to lawful requests from authorities and maintaining required records.

4. Where We Store Your Data

Your core data is stored within the European Union:

• Database: Supabase PostgreSQL, hosted in Ireland (EU). Your memories, profile data, and account information all live here, encrypted at rest with AES-256.
• Application hosting: Vercel, with servers in the EU. All connections are encrypted with TLS 1.2+.
• File storage: Cloudflare R2, located in Western Europe and encrypted at rest; files uploaded before April 2026 may still sit in Supabase Storage (EU region). Your photos and media are only accessible through authenticated, time-limited links.
• Cross-border transfers: some data is processed by US-based services: Anthropic (AI features), Replicate (AI photo restoration), Stripe (web payments), Apple (App Store purchases, Sign in with Apple and push notifications in the iPhone app), Resend (email), Google (Sign in with Google, if you use it, and push notifications in the Android app via Firebase Cloud Messaging), Meta/WhatsApp (only if you use WhatsApp capture), OpenStreetMap/Nominatim (geocoding place names you add to memories), and, when you explicitly connect them, Dropbox, Microsoft (OneDrive), and Box. Additionally, Vercel and Supabase are US-headquartered companies with EU data processing regions. These transfers are protected by the EU-US Data Privacy Framework (Apple, Google and Stripe are certified under it) and/or Standard Contractual Clauses (SCCs), together with each provider's data processing agreement or equivalent contractual safeguards, ensuring your data remains protected to EU standards.

Your database is hosted in the EU and your files in Western Europe, protected by European data protection laws. Where data is processed outside the EU, appropriate safeguards are in place.

5. Who We Share Your Data With

We do not sell, rent, or trade your personal data. Period. We only share data with a small number of trusted service providers who help us run The Memory Palace:

• Supabase: database hosting, file storage, and authentication.
• Vercel: application hosting and content delivery.
• Resend: sending transactional emails (such as password resets and notifications).
• Stripe: processing payments securely. We never see or store your credit card details.
• Anthropic (Claude AI): powering AI features such as memory tagging, interview summaries, and context generation. Data sent to Anthropic may include interview responses, memory titles and descriptions, file metadata, and image thumbnails. Anthropic does not use API data to train its models by default and processes data in accordance with its data processing agreement.
• Google (Sign in with Google): optional. Only if you choose to sign in with Google. Google then shares your name, email address, profile picture and an ID for your Google account with us. We do not ask for access to Google Photos or to any other Google data. See "Data from Google" below.
• Dropbox: optional integration for importing photos and files. Data is only transferred when you explicitly connect your Dropbox account and initiate an import.
• Microsoft (OneDrive): optional integration for importing photos and files. Data is only transferred when you explicitly connect your Microsoft account and initiate an import.
• Box: optional integration for importing files. Data is only transferred when you explicitly connect your Box account and initiate an import.
• Apple: Sign in with Apple authentication and, for purchases made in the iOS app, the independent payment party (merchant of record). Apple processes your payment under its own terms and privacy policy and sends us App Store Server Notifications about the status of your subscription (such as purchases, renewals, and refunds). We never receive your payment card details from Apple.
• Mistral AI (EU): speech to text for voice recordings (Voxtral), on servers in the EU. Used only when the owner of the palace has switched on AI features; a recording in that palace, also one a relative sends in through the weekly question or a collection link, is sent to Mistral to produce a text transcript. The recording itself stays unchanged and the transcript is marked as made with AI. According to Mistral, API data is not used to train its models.
• OpenStreetMap / Nominatim: geocoding the place names you add to memories (turning typed locations into map coordinates). Only the text you enter is sent.
• Meta (WhatsApp): optional WhatsApp capture (“Kep”). Used only if you connect WhatsApp; the messages and media you send to the capture number are processed to create memories. The Memory Palace is not affiliated with or endorsed by WhatsApp or Meta.
• PostHog: first-party account and usage statistics, hosted in the EU. Our servers send PostHog your account ID and a small number of events. About your account: when you created it, the sign-up method (email, Google or Apple), whether you have signed in since, when you last opened the app, the platform, the country and the language of your browser at sign-up (taken from that request; your IP address itself is not stored) and, if you came through one of our own links or from another website, which link or website. We add your display name as a person property, so that we can recognise accounts in our own dashboard. We never send your email address, and these account events do not contain your IP address. About use: which steps you reach in the app, such as the stages of the welcome tour, entering a wing or a room, opening the upload panel, and using core features like photo restoration, sharing, or imports. These events never contain the content of your memories: no titles, photos, or text. If you arrived through one of our own links, a short random code in that link lets us connect that visit to your new account; it is never derived from your email, never stored in a cookie, and never linked to anything outside our own site. The legal basis is our legitimate interest in knowing how many people join, where they come from and where new members get stuck, so we can improve the app (Art. 6(1)(f) GDPR). If you decline analytics in the cookie banner or in Settings, we do not record the steps you take in the app. We still count your account (that it exists, when it was created, the sign-up method, the platform and whether you have signed in), because we need that count to run the service, but without your name, without the link or website you came through and without when you last opened the app. In the mobile app there is no cookie banner; you can object at any time by writing to us, and we will then treat your account in the same way. Separately from all of this, we count visits to our public pages without cookies: for each visit we keep only a code made from the day, your IP address and your browser type, which changes every day and from which neither can be recovered, plus the page, the country, the language of your browser and whether you came from one of our own links. Your IP address itself is never stored. This lets us count how many people came by, not who. The legal basis is our legitimate interest in knowing whether anyone visits (Art. 6(1)(f) GDPR); you can object at any time by writing to us. In the same way, without cookies and without any identifier, we count clicks on our links to the App Store and Google Play, and the Android app reports once after installation which of our links, if any, led to it. Everything else on the web, including page-by-page behaviour, is measured only after you consent to analytics. When you delete your account, this profile (including your name) is deleted from PostHog as well. Separately, for each member we keep on which days the app was opened and on which platform (web, iPhone or Android), without IP address, device identifier or pages, for 13 months, to measure how many members come back. This is our own record of the use of our service, kept on our servers, and it is also kept when you decline analytics; the legal basis is our legitimate interest in knowing whether the service is useful (Art. 6(1)(f) GDPR). You can object at any time by writing to us.
• Replicate: AI photo restoration. Used only when you opt into AI features and start a restoration yourself; the photo is sent to Replicate (US) for processing, and Replicate automatically deletes inputs and outputs from its systems within about an hour.
• Cloudflare R2: storage and delivery of the photos, videos, and audio files you upload.
• Apple Push Notification service and Google Firebase Cloud Messaging: delivering push notifications to the iPhone app (Apple) and the Android app (Google). Only if you allow notifications in the app. For each reminder we send them the push token of your device and the short text of the notification, which can include your display name. Never your memories, photos or email address.

All these providers are bound by data processing agreements or equivalent contractual safeguards and comply with GDPR. The cloud storage integrations (Dropbox, Microsoft, Box) are entirely optional and only process your data when you explicitly connect them. Beyond these providers, your data is only shared when:

• You choose to share: when you invite family members to view rooms or memories, the shared content becomes accessible to those people.
• The law requires it: we may disclose data if required by law or valid legal process.

Data from Google (Sign in with Google)

You can sign in with your Google account instead of a password. This is entirely optional. We do not ask for access to Google Photos, Google Drive or any other content in your Google account. If you want to keep photos from Google Photos in your palace, you download them yourself from Google Photos and add them from your device, like any other photo.

What we receive. When you sign in with Google, we ask Google only for your basic profile and your email address. Google then shares your name, your email address, your profile picture and an ID for your Google account. Nothing else: no photos, contacts, files or other Google data.

How we use it. We use your email address and the Google ID to create your account and sign you in, and the email address also for the emails about your account. Your name becomes the display name of your palace, which you can change at any time. We do not use your Google profile picture.

Who receives it. These details are processed for us by Supabase (sign-in and database) and Resend (emails to your address). As described above, PostHog receives your display name, never your email address. We do not pass data from Google on to anyone else, and we never send it to AI services.

Where it is stored. With your account in our database (Supabase in Ireland, EU, encrypted at rest). We do not keep Google access tokens: once you are signed in, you use our own session.

What we never do. We do not sell data from Google. We do not use it for advertising, for profiling, or to train or improve AI or machine learning models, ours or anyone else's. Our staff do not look at it unless you explicitly ask us to (for example in a support request), unless it is needed for security, or unless the law requires it.

Limited Use. The Memory Palace's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access and deleting. We keep these details as long as your account exists. You can remove The Memory Palace from the apps that have access to your Google account at any time at myaccount.google.com/permissions. When you delete your account, we delete these details as described under "Data Retention". An older version of the app could connect Google Photos; if you did that, you can disconnect it in Settings, Connections, and we then revoke that access at Google and delete the tokens.

How we protect it. The encryption, access rules and deletion that apply to data from Google are described below under How we protect your data.

How We Protect Your Data

Your palace can hold sensitive data: family history, personal stories and photos of the people close to you. We protect all of it, including the details Google shares when you sign in with Google, with the following measures.

• Encryption in transit: every connection to our website, our app and our servers uses HTTPS with TLS 1.2 or higher. Our website sends HSTS, so browsers never fall back to an unencrypted connection. Our servers also connect to the database, to file storage and to the other services we use only over encrypted connections.
• Encryption at rest: our database (Supabase PostgreSQL) is encrypted at rest with AES-256. Photos, videos and recordings are stored with Cloudflare R2, which encrypts all stored files at rest. Passwords are never stored in plain text, only as a bcrypt hash. This is not end-to-end encryption: our server can read what you store, because features such as sharing, previews and export need that. That is why the access rules below apply.
• Access control: Row Level Security is switched on for every table in our database. The database itself only returns the rows a signed-in user may see: your own data, and what others have shared with you or published. The keys that can bypass these rules (our database service key and the storage keys) are kept as secrets on our servers and are never included in the website or the app.
• Private files: your photos, videos and recordings are not publicly accessible. Before a file is shown, our server checks that it is yours, that it has been shared with you or that its owner has published it. Only then does it issue a signed link that expires automatically.
• Data from Google and connected drives: Sign in with Google asks Google only for your basic profile and your email address. We do not ask for access to Google Photos or to any other Google data, and we do not keep Google tokens. If you connect OneDrive or Dropbox yourself, that connection uses OAuth 2.0 with PKCE and a state check against forged requests, and we only copy the files you choose. Those tokens are stored in our database, encrypted at rest, and can only be read by our server; your own session cannot read them. When you disconnect a drive in Settings, Connections, or delete your account, we delete its tokens and, where the provider offers this, ask it to revoke our access.
• Access within our team: access to our production systems (hosting, database and file storage) is limited to the small team that runs the service. We do not look at the content of your palace or at data from Google, unless you ask us to (for example in a support request), unless it is needed for security or to handle a report of illegal content, or unless the law requires it.
• Deletion: when you disconnect a drive, we delete its tokens and the linked email address straight away. When you delete your account, we delete your data and files and remove your login, as described under "Data Retention". Backup copies are purged within 30 days at the latest.
• Security incidents: if a breach of personal data poses a risk to your rights, we notify the competent supervisory authority within 72 hours and inform affected users without undue delay (Articles 33 and 34 GDPR).

Contributions from people without an account

A member can send family and friends a link to send in memories, name a person in a photo or answer a question. If you do this without an account, you give us the name you enter and the contribution itself (text, photo, video or recording). We store these in the EU, in the member's palace, for as long as the member keeps them. The legal basis is your consent, which you give with the checkbox or by saying yes to the invitation. We only keep your internet address in a form that cannot be traced back, to limit abuse. You can withdraw your consent at any time: for the weekly question with the stop link under every email, and for any contribution through the contact page. We then delete your contribution. These services are meant for people aged sixteen and over.

Sharing with a QR code

If you make a book of a wing or a monthly letter, every voice and video gets a QR code. Anyone who scans it can view or listen to that memory without an account. A QR code therefore works like public sharing with whoever gets the paper. You can always withdraw the codes by making new ones; the old ones then stop working, also on paper. We only count how often a code is used, not who uses it. We keep the link itself (the code and that count) for as long as your account exists.

6. Your Rights

Under the GDPR (Articles 15-20 and beyond), you have strong rights over your personal data. Here is what you can do:

• Access your data: request a complete copy of everything we hold about you.
• Export your data: download all your memories, stories, and photos as a JSON file with a ZIP of your media, directly from your account settings.
• Correct your data: update or fix any information that is inaccurate or incomplete.
• Delete your data: request complete deletion of your account and all associated data. When you delete your account, everything is permanently removed.
• Data portability: receive your data in a structured, machine-readable format that you can take to another service.
• Object to processing: object to the processing of your personal data at any time.
• Withdraw consent: change your mind about optional processing at any time.
• Restrict processing (Art. 18): request that we limit how we use your data while a dispute or verification is pending.

To exercise any of these rights, email us at privacy@thememorypalace.ai. We will respond within 30 days, as required by law.

Data Breach Notification

In the event of a data breach that poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay, as required by GDPR Articles 33 and 34.

Automated Decision-Making (Art. 13(2)(f))

Our AI features (memory tagging, context generation, interview summarization) use automated processing to generate suggestions. These features are entirely optional, require your explicit consent, and do not produce decisions with legal or similarly significant effects. You can disable AI features at any time in your account settings.

7. Data Retention

Your data is kept for as long as your account is active. You are in control:

• Active account: your memories and data stay safely stored for as long as you use The Memory Palace.
• Account deletion: when you delete your account, all personal data and uploaded content is permanently removed immediately upon request. Backup copies are purged within 30 days at the latest (the point-in-time recovery window of our infrastructure provider).
• Legacy delivery: if you have set up legacy contacts, your memories will be delivered to your chosen family members according to your settings. This is entirely optional and under your control.
• Service logs: basic server logs (for security and debugging purposes) may be retained for up to 12 months after account deletion.
• Billing records: subscription and payment records are kept for the duration of your subscription plus 7 years, as required by statutory accounting and tax rules.
• WhatsApp number: if you connect Kep on WhatsApp, we store your phone number to match your messages to your palace. It is kept while the connection is active and removed as soon as you disconnect Kep in Settings or delete your account. The one-time link code expires after 24 hours and is then deleted.
• Legacy: if you set up a legacy plan, we check whether you are still active. If you have not signed in for twelve months (or the period you chose yourself), we first send you a message and wait thirty days. If you do not respond, the plan takes effect and each chosen contact receives a personal, permanent access link to the memories you designated. Anyone holding that link can view, download and keep the content. The link does not expire; you withdraw access by removing that contact or deleting your account.

8. Cookies

We keep cookies to an absolute minimum:

• Essential cookies: required for logging in and core functionality (authentication session, CSRF protection). These cannot be disabled, as the app would not work without them.
• Preference cookies: store your language preference, your display settings, and your choice about analytics, so we can respect it on our servers too. They contain no identifier.

We do not use advertising cookies or third-party trackers of any kind. A first-party analytics cookie (PostHog, hosted in the EU) is only set after you agree to it, and you can withdraw that at any time in Settings.

9. Children's Privacy

The Memory Palace is designed for adults and is not intended for children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will promptly remove it.

10. Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will notify you by email or with a clear notice inside the app. Your continued use of The Memory Palace after any changes means you accept the updated policy.

11. Contact Us

If you have questions about this privacy policy, want to exercise your rights, or simply want to know more about how we protect your data, we would love to hear from you:

• Email: privacy@thememorypalace.ai
• Company: The Memory Palace, Leuven, Belgium

You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit) if you believe your rights have been violated.