Privacy Policy

MemoryMaps (“we,” “us,” “our”) is the data controller for the personal data described in this policy. We are an independent project operating the website at memorymaps.app and the MemoryMaps mobile applications (collectively, the “Service”).

For privacy questions or to exercise any of the rights described below, contact hello@memorymaps.app.

We collect the following categories of data:

• Account data. Email address, password hash, displayName, username, optional bio, optional avatar image. If you sign in with Google or Apple, the identity-provider subject identifier and the email address they share with us.
• Content. Photos and videos you upload, with embedded location coordinates. Image metadata (EXIF / IPTC / XMP) is stripped server-side before the image is stored. Captions, tags, places, and any other text you attach to a memory. Adventures (collections of memories) and stories (24-hour ephemeral memories).
• Social interactions. Follows, blocks, mutes, likes, comments, saved memories, conversations, messages, and notification settings.
• Device data. A push-notification token issued by Apple or Google when you opt in to push. Device type and OS version when relevant for support.
• Usage data. API request logs (IP address, user-agent, timestamps) for security, abuse prevention, and rate-limiting. Error logs.
• Auth identifiers. When you sign in with Google or Apple, we receive only the subject identifier and the email address (no broader scopes).

We use personal data to:

• Operate the Service: authenticate you, render your maps, deliver content, route messages.
• Prevent abuse: detect spam, harassment, illegal content (including automated screening for child sexual abuse material — see Section 10), enforce rate limits, suspend accounts that violate our terms.
• Send notifications you’ve enabled: in-app, push, and email.
• Personalize the discovery feed: rank suggested memories based on what you interact with, follow, and tag.
• Respond to support requests and legal obligations.
• Improve the product: aggregate, de-identified analytics about how features are used.

For users in the European Economic Area, the United Kingdom, and other GDPR-aligned jurisdictions, we rely on the following legal bases under Articles 6 and 9 GDPR:

• Contract performance (Art. 6(1)(b)) — for account creation, content storage and display, messaging, and other features you sign up for.
• Legitimate interests (Art. 6(1)(f)) — for safety moderation, abuse prevention, fraud detection, security logging, and basic product analytics. We balance these against your rights and freedoms; you can object at any time (see Section 8).
• Consent (Art. 6(1)(a)) — for push notifications, marketing email, and any optional analytics cookies. You can withdraw consent at any time from in-app settings.
• Legal obligation (Art. 6(1)(c)) — for CSAM detection and reporting, responding to lawful requests from law enforcement, and tax / record-keeping requirements.

We share personal data with the following categories of recipients:

• Hosting and infrastructure: Amazon Web Services (AWS, US-East-1) for compute, storage, and automated content moderation. Vercel for web hosting and Speed Insights.
• Maps: Mapbox for map tile rendering.
• Push notifications: Expo Push Notification Service for relaying push tokens to Apple Push Notification service / Firebase Cloud Messaging.
• Authentication: Apple and Google, when you sign in via OAuth.
• Email: Amazon Simple Email Service for transactional email (verification, password reset, data exports, notifications).
• Payments: Stripe for the optional MemoryMaps Premium subscription on web and Android. Apple In-App Purchase for iOS Premium subscriptions.
• Analytics (when enabled): Google Analytics 4. Disabled by default; when enabled, the script is subject to the cookie banner and our analytics consent flow.

We do not sell personal data to third parties. We disclose personal data to law enforcement only when legally compelled (subpoena, court order) or to protect user safety. As required by U.S. federal law, we report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC).

MemoryMaps is a location-aware service. When you create a memory, the GPS coordinates from the photo or video are stored alongside the content. The coordinates appear on your map and, depending on visibility settings, on the maps of people who can see the memory.

You control visibility. Each memory is tagged Public, Followers-only, or Private, and you can schedule posting up to three days in the future. We recommend using delayed posting for sensitive locations like your home or workplace.

Device-level location permission is independent of MemoryMaps. You can revoke it at the operating-system level at any time, and the photos you take after that point will not have GPS coordinates available.

• Active accounts: retained until you delete them.
• Soft delete (grace period): when you request account deletion, your profile and content are hidden immediately and queued for hard deletion 30 days later. You can cancel the deletion at any point during the grace period.
• Username reservation: after hard deletion, your username is reserved for 90 days to prevent impersonation.
• Unverified accounts: if you create an account but never verify your email, the account and its data are automatically deleted after 72 hours.
• Server logs: request logs are retained for 30 days for security and abuse-prevention purposes.
• Operational backups: we maintain backups for disaster recovery. Deletion of personal data may take longer to fully propagate to backups, but backups are not used to restore deleted data outside of a disaster-recovery scenario.

Depending on your jurisdiction, you have some or all of the following rights regarding your personal data:

• Access & portability. Request a copy of your data in machine-readable JSON via Settings → Data Export. The export is generated asynchronously and emailed to you when it’s ready. Rate-limited to one request per seven days.
• Rectification. Update profile information from Settings.
• Erasure.Delete your account from Settings → Account → Delete Account. The 30-day grace period applies; you can cancel during that window.
• Restriction. Deactivate your account (hides your profile and content) from Settings; you can reactivate at any time.
• Objection.Opt out of marketing email or push notifications from Settings → Notifications. Object to specific legitimate-interest processing by emailing hello@memorymaps.app.
• Lodge a complaint. EEA / UK residents may lodge a complaint with their local data-protection supervisory authority.

California residents. The CCPA / CPRA gives you the same rights described above (access, deletion, correction, opt-out of sale or sharing — we do neither). To submit a request, email hello@memorymaps.app.

We implement industry-standard security practices, including:

• HTTPS-only transport with HTTP Strict Transport Security (HSTS) and standard security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy).
• Passwords are hashed with bcrypt before storage and never logged. Email-verification and password-reset tokens are SHA-256 hashed before storage.
• Authentication uses signed JWT tokens. Email verification is required before any content creation.
• Photo metadata (EXIF, IPTC, XMP) is stripped server- side before the image is stored, so embedded location, camera, or device metadata never persists with the public image.
• Automated scanning of uploaded images for child sexual abuse material; flagged content is hidden pending review.
• Rate limiting on public endpoints, sharded counters to prevent throttling-based denial-of-service, idempotency keys on critical write paths, and admin audit logs for moderation actions.

No system is perfectly secure. If you believe you have found a security issue, please email hello@memorymaps.app with details.

MemoryMaps is not directed at children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children under that age. If we learn that we have done so, we delete the data and the associated account.

We use automated tools and human review to detect apparent Child Sexual Abuse Material (CSAM). Accounts posting CSAM are immediately suspended and may be permanently banned. As required by 18 U.S.C. § 2258A, we report apparent CSAM to the National Center for Missing & Exploited Children (NCMEC).

Personal data is processed and stored on Amazon Web Services in the US-East-1 region (United States). For users in the European Economic Area, the United Kingdom, and other jurisdictions with cross-border data-transfer requirements, we rely on Standard Contractual Clauses with our sub-processors where applicable.

We store authentication tokens in your browser to keep you signed in across visits. These are strictly necessary for the Service to function and do not require consent under GDPR.

We do not use third-party advertising cookies. We do not share data with ad networks or data-broker pixels.

Optional cookies are subject to the cookie banner that appears on your first visit:

• Analytics (Google Analytics 4) — loaded only when GA is enabled, and then only subject to the cookie banner and analytics consent flow. GA is not enabled today.
• Premium subscription processing — Stripe sets cookies during checkout if you start a Premium subscription on web. These are functional cookies tied to the payment flow.

We may update this policy from time to time. For material changes, we will notify you by email and in-app at least seven (7) days before the change takes effect. The “Last updated” date at the top of this page always reflects the most recent material revision. Non-material changes (clarifications, formatting, corrections) may be made without prior notice.

For privacy questions, data-rights requests, or any other concern about how we handle your information, contact hello@memorymaps.app.