In plain English
Memento is built to turn only the photos you choose into a personal editorial recap. It is not designed to scan your full photo library, build an advertising profile, or sell your personal information. Your Memento stays private unless you deliberately create a share link.
What Memento handles
Photos you select
You choose 50–150 images through Apple’s system photo picker. On-device preparation may load those selections, remove duplicates, identify screenshots or likely private documents, make small thumbnails and contact sheets, and strip unnecessary metadata. Original full-resolution photos are not uploaded or stored by Memento.
Generation evidence and your deck
Smaller contact sheets, permitted timestamps, dimensions, computed quality facts, and occasional compact hero crops may be sent to create your Memento. The service stores the resulting deck, its access origin, and operational records needed to resume work, prevent duplicate generation, and provide support.
Share links you create
Public-link sharing is optional. When you confirm that anyone with the link may view, save, screenshot, and reshare your Memento—and that you have the right to share it—Memento uploads exactly 12 flattened, metadata-sanitized 1080 × 1920 PNG cards for safety review and hosting. A public share never includes your original photos, photo-library identifiers, source metadata, private generation evidence, editable deck data, account identity, or private storage address.
The link is a high-entropy bearer link: anyone who receives or forwards it can open and save the cards without signing in. Shared pages ask search engines not to index them, but that is not an access-control guarantee. A recipient may retain a copy after you replace or stop the link.
Account, purchase, and technical data
Memento may process privacy-preserving installation or Apple continuity identifiers, StoreKit transaction records, job state, cost and latency measurements, and tightly limited product events. For public-link safety, Memento also keeps moderation decisions, reports, and a one-way publisher pseudonym that lets a visitor block links from the same publisher without revealing the publisher’s account. Reporter network context is converted server-side into a keyed one-way fingerprint for abuse prevention; raw network addresses are not stored in the report record.
General analytics must not contain photo bytes, raw private copy, OCR, prompts containing private evidence, signed URLs, share-link tokens, public-card copy, or StoreKit payloads.
How information is used
- Prepare the selected roll and generate the requested 12-card Memento.
- Validate safety, accuracy, supported layouts, and generation authorization.
- When you opt in, review and host the flattened cards behind the share link you control.
- Resume interrupted work, prevent duplicate bills, restore eligible paid decks, and answer support requests.
- Protect the service from abuse and measure reliability without using private photo content for general analytics.
Retention
- Original photos: never stored by Memento.
- Temporary generation evidence: deleted when recovery no longer requires it, with a 24-hour hard target.
- Included-first deck data: may remain server-side for up to 30 days for same-install recovery, duplicate protection, and support. Rendered cards remain local.
- Paid or subscription-created decks: retained for recovery until you delete the Memento or all Memento data.
- Public-link cards: retained while the link is active. Stopping the link or deleting its Memento removes public access and schedules the hosted copies for deletion, but it cannot recall copies someone already saved or reshared.
- Moderation, report, and security records: retained only as needed to review reports, prevent abuse, meet legal obligations, and demonstrate safe operation.
- Operational and purchase records: kept only as required for product operation, security, accounting, and legal obligations.
Service providers
Memento uses Apple for photo selection and purchases, Supabase for private storage and database services, Vercel for the API and public viewer, and OpenAI for server-side editorial generation and public-card safety review. Providers process information only for the services Memento asks them to perform and under their applicable terms. Memento does not claim Zero Data Retention unless an approved provider agreement actually guarantees it.
Your choices
If payment is required for a later generation, you can dismiss the offer and keep the protected unfinished draft. You decide whether to publish a read-only share link and can remove public access from the app at any time. You can also delete an individual Memento or request deletion of all Memento data from Settings. Apple manages App Store purchase and subscription controls. Already exported, downloaded, screenshotted, or reshared files cannot be recalled after deletion, revocation, or refund.
Contact
Privacy questions and deletion issues can be sent to support@makeamemento.com.