Privacy Policy

1. Introduction

Memento (“we,” “our,” or “us”) operates the Memento application and website located at mementosite.me (collectively, the “Service”). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you access or use our Service. By using the Service, you consent to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide

• Account Registration: Email address and an Argon2id hash of a sign-in hash that your device makes from your password. Your password is never sent to us, so we never store or have access to it.
• Profile Information: Optional display name and avatar that you choose to provide.
• Support Communications: Information you provide when contacting us for support, including your email and the content of your message.

2.2 Encrypted User Content

User content — including notes, vault items, AI prompts, and attachments — is encrypted on your device using XChaCha20-Poly1305 before transmission to our servers. We store that content only as ciphertext. Some information is stored unencrypted so the Service can organize it: note titles, tags, folder names, vault item names and field labels, prompt titles and descriptions, attachment file names and sizes, saved links (including links saved from the browser extension), and notes created by email-to-notes. Under our zero-knowledge architecture, we do not possess the cryptographic keys necessary to decrypt your content and therefore cannot access, read, or process it. The one exception is easy recovery, which is off unless you turn it on: if you do, we hold a sealed copy of your account key that our operators, or anyone who controls our servers together with the escrow key file, could open to decrypt your content (see Section 5).

2.3 Automatically Collected Information

• Device Information: Browser type, operating system, and device type for compatibility and debugging purposes.
• Server Logs: IP address, access timestamps, requested addresses, referring URLs and browser type, recorded by our servers for operations, security monitoring and abuse prevention. These logs are rotated automatically.
• Activity Log: Security-relevant events on your account (such as sign-ins, device changes and share-link creation), with the IP address and browser involved. Searches that run on our server are also recorded here, limited to the first 100 characters of the search text. You can review this log in the app.
• Devices and Share Links: The name, type, IP address and browser of devices signed in to your account, and the IP address and browser of each visit to a note you share by link.
• Web Analytics: Our website and app use Cloudflare Web Analytics, which records page views, the pages visited, the referring site, browser and device type, country and page load times. It does not use cookies or identify individual visitors.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Contract Performance: Processing necessary to provide the Service you requested (Article 6(1)(b) GDPR).
• Legitimate Interests: Security monitoring, fraud prevention, and service improvement, where our interests do not override your fundamental rights (Article 6(1)(f) GDPR).
• Consent: Where you have given explicit consent for specific processing activities, such as optional marketing communications (Article 6(1)(a) GDPR).
• Legal Obligation: Where processing is required to comply with applicable law (Article 6(1)(c) GDPR).

4. How We Use Your Information

• To provide, operate, and maintain the Service
• To authenticate your identity and secure your account
• To synchronize your encrypted data across your authorized devices
• To send essential transactional communications (password resets, security alerts, account verification)
• To detect, prevent, and respond to security incidents, fraud, and abuse
• To improve the Service based on aggregated page-view and performance statistics
• To comply with legal obligations and respond to lawful requests

5. Zero-Knowledge Encryption Architecture

Memento employs a zero-knowledge encryption model. Encryption keys are generated locally on your device and are never transmitted to or stored on our servers in unencrypted form. Notes, vault items, AI prompts, and attachments are encrypted client-side using XChaCha20-Poly1305 with unique per-item nonces before any network transmission occurs.

As a consequence of this architecture, unless you turn on easy recovery, we have no technical capability to decrypt, access, or recover your content. If you lose access to your device encryption keys and have not set up a recovery key or another recovery method (Settings → Security), your encrypted data will be permanently inaccessible.

Easy recovery is optional and off by default. If you turn it on, your browser seals a copy of your account key to a key held by our servers, and we store that sealed copy. For accounts that use it, the encryption is not zero-knowledge: our operators, or anyone who controls our servers together with that key file, could open the copy and decrypt your content. Every recovery started through the Service waits 12 hours and notifies your signed-in devices, but those safeguards do not stop someone who holds both our database and the key file. You can turn easy recovery off in Settings, which deletes the copy. Our Security page describes it in full.

6. Data Sharing and Disclosure

We do not sell, rent, trade, or otherwise share your personal information with third parties for their marketing purposes. We may disclose information only in the following limited circumstances:

• Service Providers: Third-party vendors who help us operate the Service: Cloudflare (website hosting, network protection, web analytics and file storage), Backblaze (storage of encrypted files), Oracle Cloud (the servers that run our API), MongoDB Atlas (our database, which holds your encrypted content and the account data described above), Sender, Brevo and Mailgun (email delivery), and Google Fonts (web fonts, which receive your IP address when the fonts load). If you choose to connect them, we also exchange data with Google (Sign in with Google, Google Drive backups, Gmail import), Dropbox (backups) and Microsoft (OneDrive backups, Outlook calendar). Backups are encrypted on your device before they are sent; a backup you save to, or restore from, your drive passes through our servers without being stored.
• Legal Requirements: When required by law, regulation, legal process, or enforceable governmental request.
• Safety and Rights: To protect the rights, property, or safety of Memento, our users, or the public, as required or permitted by law.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with prior notice to affected users.

Due to our zero-knowledge architecture, even in the event of a lawful data request, we can only provide encrypted ciphertext and account metadata — never the plaintext content of your notes, vault items, or other encrypted data. This does not apply to accounts that have turned on easy recovery: for those accounts we hold a sealed copy of the account key that we are able to open, so we could be compelled to decrypt and disclose their content.

7. Data Retention

• Account Data: Retained for the duration of your active account.
• Encrypted Content: Retained until you delete it or delete your account.
• Activity Log: Entries are deleted automatically after 90 days.
• Share Link Visits: Kept until the share link expires or you delete it.
• Backups: We do not keep backups. A backup is made and encrypted on your device with your account key, the same key that protects your other content, and is then downloaded to your device or saved to your own Google Drive, Dropbox or OneDrive. Scheduled backups run in the Memento app while it is open and unlocked, not on our servers. Copies in your drive are stored in your account there, and you control their retention. Backups that were previously kept on our servers have been deleted.
• Account Deletion: When you delete your account, you are signed out everywhere and all associated data (account information, encrypted content, attachments, metadata, keys and backup schedules) is permanently deleted. If a storage provider is temporarily unavailable, deletion is retried automatically until it completes. Activity log entries are kept until they expire after 90 days, as a security record. Backups you sent to your own cloud storage are not affected; delete them there.

8. Cookies and Tracking Technologies

We use strictly necessary cookies only: a secure, HttpOnly cookie that keeps you signed in, and short-lived cookies that protect the Sign in with Google and Gmail connection flows. We do not use advertising cookies, tracking pixels, or analytics that track individual users. Our website and app use Cloudflare Web Analytics, which measures page views and load times without cookies (see section 2.3).

9. Security Measures

We implement industry-standard security measures, including:

• XChaCha20-Poly1305 client-side encryption for notes, vault items, prompts, and attachments
• On-device Argon2id sign-in hashing with per-account random salts, hashed again with Argon2id on the server
• TLS 1.2+ encryption for all data in transit
• Rate limiting and brute-force protection on authentication endpoints
• Strict Content Security Policy (CSP) and security headers

While no system can guarantee absolute security, our zero-knowledge architecture ensures that even in the unlikely event of a server breach, your content remains encrypted and inaccessible without your device keys. If you have turned on easy recovery, a breach that obtains both our database and the escrow key file could expose your content (see Section 5).

10. Where Your Data Is Stored

Our API servers run in India (Oracle Cloud, Hyderabad) and our database is in India (MongoDB Atlas on Amazon Web Services, Mumbai). Encrypted file attachments are stored with Backblaze in the United States, with Cloudflare R2 as backup storage. Our website is served through Cloudflare's global network, and the other providers listed in section 6 may process data in other countries, including the United States.

Your information may be transferred to and processed in countries other than your country of residence. Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms.

11. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate personal data.
• Right to Erasure: Request deletion of your personal data and account.
• Right to Data Portability: Export your data in standard, machine-readable formats (JSON, Markdown).
• Right to Restrict Processing: Request limitation of processing in certain circumstances.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, please reach out to us using the contact details provided at the end of this policy. We will respond within 30 days (or sooner as required by applicable law).

12. Children's Privacy

The Service is not directed to children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information promptly.

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete it, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your California privacy rights, please reach out using the contact details at the end of this policy.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting the updated policy on our website with a revised "Last Updated" date and, where appropriate, by sending an email notification. Your continued use of the Service after such changes constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: