Privacy Policy

1. Who We Are

The Memory Palace is operated from Belgium. We built this app to help you preserve and share your most precious memories — safely and privately. We are committed to protecting your personal data in full compliance with the General Data Protection Regulation (GDPR) and applicable Belgian and EU law.

For any privacy-related questions, you can always reach us at: privacy@thememorypalace.ai

Data controller. The controller responsible for the processing of your personal data is The Memory Palace. Contact: privacy@thememorypalace.ai

We are not legally required to appoint a data protection officer (DPO) and have not appointed one; all privacy enquiries are handled through the address above.

2. What We Collect

We only collect what we need to provide you with a great experience. Here is what we gather:

• Profile information: your name, email address, and profile photo when you create an account.
• Your memories: the photos, videos, stories, and other content you upload to your Memory Palace. This is the heart of the service.
• Device information: basic details like your browser type and screen size, so we can make the app look and work its best on your device.
• Subscription and billing data: your plan, subscription status, billing period end date, and payment references (an Apple original transaction ID for App Store purchases, or Stripe customer and subscription IDs for web purchases). We never see or store your payment card details — payments are handled by Apple or Stripe.

Special Categories of Data (Art. 9 GDPR)

Memories can contain sensitive data (for example health information, religious or philosophical beliefs, or family history that may reveal genetic or ethnic information). You share such data voluntarily; our legal basis for processing it is your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time by deleting the content. We ask you to record only sensitive data you consciously want to preserve.

3. How We Use Your Data

We use your data solely to provide and improve The Memory Palace. Specifically:

• To store, organize, and display your memories in your palace.
• To authenticate your account and keep it secure.
• To send you important service-related messages (such as email confirmations, security alerts, or legacy notifications).
• To improve the app based on your feedback and support requests.

We will never use your data for advertising, and we will never sell it to anyone.

Legal Basis for Processing (Art. 6 GDPR)

We process your personal data under the following legal bases:

• Contract performance (Art. 6(1)(b)): storing your memories, account management, providing core app functionality, and managing your subscription and billing status.
• Consent (Art. 6(1)(a)): AI-powered features (tagging, context generation, interviews), optional cookies, and marketing communications.
• Legitimate interest (Art. 6(1)(f)): security monitoring, abuse prevention, and service improvement based on aggregated usage patterns.
• Legal obligation (Art. 6(1)(c)): responding to lawful requests from authorities and maintaining required records.

4. Where We Store Your Data

Your core data is stored within the European Union:

• Database: Supabase PostgreSQL, hosted in Frankfurt, Germany (EU). Your memories, profile data, and account information all live here, encrypted at rest with AES-256.
• Application hosting: Vercel, with servers in the EU. All connections are encrypted with TLS 1.2+.
• File storage: Supabase Storage (EU region), encrypted at rest. Your photos and media are only accessible through authenticated, time-limited links.
• Cross-border transfers: some data is processed by US-based services: Anthropic (AI features), OpenAI (voice-note transcription), Replicate (AI photo restoration), Stripe (web payments), Apple (App Store purchases and Sign in with Apple), Resend (email), Meta/WhatsApp (only if you use WhatsApp capture), OpenStreetMap/Nominatim (geocoding place names you add to memories), and — when you explicitly connect them — Google (Google Photos), Dropbox, Microsoft (OneDrive), and Box. Additionally, Vercel and Supabase are US-headquartered companies with EU data processing regions. These transfers are protected by the EU-US Data Privacy Framework (Apple and Stripe are certified under it) and/or Standard Contractual Clauses (SCCs), together with each provider's data processing agreement or equivalent contractual safeguards, ensuring your data remains protected to EU standards.

Your database and files are hosted in the EU and protected by European data protection laws. Where data is processed outside the EU, appropriate safeguards are in place.

5. Who We Share Your Data With

We do not sell, rent, or trade your personal data. Period. We only share data with a small number of trusted service providers who help us run The Memory Palace:

• Supabase — database hosting, file storage, and authentication.
• Vercel — application hosting and content delivery.
• Resend — sending transactional emails (such as password resets and notifications).
• Stripe — processing payments securely. We never see or store your credit card details.
• Anthropic (Claude AI) — powering AI features such as memory tagging, interview summaries, and context generation. Data sent to Anthropic may include interview responses, memory titles and descriptions, file metadata, and image thumbnails. Anthropic does not use API data to train its models by default and processes data in accordance with its data processing agreement.
• Google (Google Photos) — optional integration for importing photos. Data is only transferred when you explicitly connect your Google account and initiate an import.
• Dropbox — optional integration for importing photos and files. Data is only transferred when you explicitly connect your Dropbox account and initiate an import.
• Microsoft (OneDrive) — optional integration for importing photos and files. Data is only transferred when you explicitly connect your Microsoft account and initiate an import.
• Box — optional integration for importing files. Data is only transferred when you explicitly connect your Box account and initiate an import.
• Apple — Sign in with Apple authentication and, for purchases made in the iOS app, the independent payment party (merchant of record). Apple processes your payment under its own terms and privacy policy and sends us App Store Server Notifications about the status of your subscription (such as purchases, renewals, and refunds). We never receive your payment card details from Apple.
• OpenAI — voice-note transcription (Whisper). Used only when you opt into AI features and record audio; the recording is sent to OpenAI to produce a text transcript. OpenAI does not use API data to train its models by default.
• OpenStreetMap / Nominatim — geocoding the place names you add to memories (turning typed locations into map coordinates). Only the text you enter is sent.
• Meta (WhatsApp) — optional WhatsApp capture (“Kep”). Used only if you connect WhatsApp; the messages and media you send to the capture number are processed to create memories. The Memory Palace is not affiliated with or endorsed by WhatsApp or Meta.
• PostHog — first-party account statistics, hosted in the EU. When you create an account, our servers send a single event to PostHog containing your account ID, the sign-up method, the time of registration, and your display name (stored as a person property), so we can see how many people join and whether sign-up works properly. This happens entirely server-side — no cookies, advertising identifiers, or device data are involved. The legal basis is our legitimate interest in first-party account statistics (Art. 6(1)(f) GDPR). In addition — only after you have consented to analytics cookies — we also measure page views and the use of core features (such as photo restoration, sharing, and imports), without the content of your memories: no titles, photos, or text are included. Our servers also record the completion of a purchase (plan and platform only); the legal basis for this is the performance of our contract with you and our legitimate interest in understanding how The Memory Palace is used (Art. 6(1)(b) and (f) GDPR). When you delete your account, this profile (including your name) is deleted from PostHog as well.
• Replicate — AI photo restoration. Used only when you opt into AI features and start a restoration yourself; the photo is sent to Replicate (US) for processing, and Replicate automatically deletes inputs and outputs from its systems within about an hour.
• Cloudflare R2 — storage and delivery of the photos, videos, and audio files you upload.

All these providers are bound by data processing agreements or equivalent contractual safeguards and comply with GDPR. The cloud storage integrations (Google, Dropbox, Microsoft, Box) are entirely optional and only process your data when you explicitly connect them. Beyond these providers, your data is only shared when:

• You choose to share: when you invite family members to view rooms or memories, the shared content becomes accessible to those people.
• The law requires it: we may disclose data if required by law or valid legal process.

6. Your Rights

Under the GDPR (Articles 15-20 and beyond), you have strong rights over your personal data. Here is what you can do:

• Access your data: request a complete copy of everything we hold about you.
• Export your data: download all your memories, stories, and photos as a JSON file with a ZIP of your media — directly from your account settings.
• Correct your data: update or fix any information that is inaccurate or incomplete.
• Delete your data: request complete deletion of your account and all associated data. When you delete your account, everything is permanently removed.
• Data portability: receive your data in a structured, machine-readable format that you can take to another service.
• Object to processing: object to the processing of your personal data at any time.
• Withdraw consent: change your mind about optional processing at any time.
• Restrict processing (Art. 18): request that we limit how we use your data while a dispute or verification is pending.

To exercise any of these rights, email us at privacy@thememorypalace.ai. We will respond within 30 days, as required by law.

Data Breach Notification

In the event of a data breach that poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay, as required by GDPR Articles 33 and 34.

Automated Decision-Making (Art. 13(2)(f))

Our AI features (memory tagging, context generation, interview summarization) use automated processing to generate suggestions. These features are entirely optional, require your explicit consent, and do not produce decisions with legal or similarly significant effects. You can disable AI features at any time in your account settings.

7. Data Retention

Your data is kept for as long as your account is active. You are in control:

• Active account: your memories and data stay safely stored for as long as you use The Memory Palace.
• Account deletion: when you delete your account, all personal data and uploaded content is permanently removed immediately upon request. Backup copies are purged within 30 days at the latest (the point-in-time recovery window of our infrastructure provider).
• Legacy delivery: if you have set up legacy contacts, your memories will be delivered to your chosen family members according to your settings. This is entirely optional and under your control.
• Service logs: basic server logs (for security and debugging purposes) may be retained for up to 12 months after account deletion.
• Billing records: subscription and payment records are kept for the duration of your subscription plus 7 years, as required by statutory accounting and tax rules.

8. Cookies

We keep cookies to an absolute minimum:

• Essential cookies: required for logging in and core functionality (authentication session, CSRF protection). These cannot be disabled, as the app would not work without them.
• Preference cookies: store your language preference and display settings. These are optional but improve your experience.

We do not use analytics cookies, advertising cookies, or third-party trackers of any kind.

9. Children's Privacy

The Memory Palace is designed for adults and is not intended for children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will promptly remove it.

10. Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will notify you by email or with a clear notice inside the app. Your continued use of The Memory Palace after any changes means you accept the updated policy.

11. Contact Us

If you have questions about this privacy policy, want to exercise your rights, or simply want to know more about how we protect your data, we would love to hear from you:

• Email: privacy@thememorypalace.ai
• Company: The Memory Palace, Belgium

You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit) if you believe your rights have been violated.