How we look after your data

What data we process

• Your account: email, name, language and time zone. If you sign in with a password, we keep only a hash, never the password itself. If you sign in with Google, we receive your email, your name and an identifier for your Google account.
• What you save: voice notes, photos and text, your answers to Memba’s questions and the questions you ask it. Photos are kept as they are, with their metadata (for example the date or location, if the camera recorded them).
• What Memba builds from it: transcripts, photo descriptions, titles, the people, places and dates that come up, and the answers it gives you.
• Usage data: which screens you open, how many memories you save or whether a question got an answer, along with your user id, your phone’s model and operating system, its language and time zone, the app version and an approximate location (country and city) inferred from your IP. Never the content of your memories or what you type.
• Technical data: when the app or the website talks to our server or to PostHog, they receive data such as your IP address. We also keep the token your phone uses to receive notifications.

What we use it for

• To provide the service: keep what you send, transcribe it, organize it, ask you what’s missing and answer your questions citing what you saved.
• To send you notifications, for example when Memba has new questions. Their text never includes the content of your memories.
• To improve Memba: our team may review your questions, the answers and the memories they cite. Never the memories you marked as sensitive, nor those of accounts pending deletion. What we review stays within our systems: if a case is useful, we rewrite it with made-up data.
• To understand how the app is used, with the usage data.
• To keep Memba secure and comply with the law.

We don’t sell your data, we don’t use it for advertising and we don’t track you across other apps or websites.

Who we share it with

We work with providers that process data on our behalf, only for what we ask them to do:

• Anthropic (United States): its Claude models read your text, transcripts and photos to organize them, write the questions and answer your queries.
• ElevenLabs (United States): transcribes your voice notes.
• PostHog (United States): stores usage data. It receives no content.
• Expo, Apple and Google: deliver notifications to your phone.
• Google: if you sign in with Google, it confirms the account is yours.
• Our server provider, where the database and your encrypted files live.

Beyond that, we only share data when the law requires it or to protect rights. If Memba Ltd merges or is sold, your data passes to the new company under this same policy, and we’ll let you know beforehand.

How we protect it

• Your original files are stored encrypted with a key unique to your vault.
• The database keeps each vault apart: one account can’t read another’s data.
• Everything travels over HTTPS, and passwords are stored as hashes.

No system is foolproof. If an incident ever affects your data, we’ll let you know.

How long we keep it

• For as long as you have your account.
• If you delete a memory, it’s really deleted, with its photos and audio.
• If you delete your account, you have 30 days to change your mind. After that we destroy your vault’s key, which makes any encrypted copy of your files unreadable, and we delete your files and your account.
• Usage data stays linked to a user id that, once your account is deleted, no longer identifies you. If you’d like us to delete it too, write to us.
• We keep a minimal record, with no content, that your vault was deleted.

Your rights

• See and take everything: from Settings you can export all your memories, with the originals, in open formats.
• Correct: you can edit your memories in the app.
• Delete: a single memory or your whole account. The steps are in “Delete your account”.
• Limit review: if you mark a memory as sensitive, our team doesn’t review it.

Depending on where you live (for example California, the European Union or Brazil), the law may give you more rights, such as knowing what data we hold or objecting to a use. To exercise them, write to support@memba.app: we reply within 30 days.

Children

Memba isn’t meant for children under 13, and we don’t knowingly keep their data. If you think a child has given us data, write to us and we’ll delete it.

Cookies and tracking

The website uses no tracking cookies: the home page counts visits without cookies and without storing anything in your browser. The app doesn’t use your phone’s advertising identifier. Since we don’t track you across sites, the Do Not Track signal changes nothing.

Where it’s processed

Memba Ltd is in the United States, and our providers process data there and in other countries. If you use Memba from another country, your data travels to the United States so the service can work.

Changes

If we change this policy, we update the date at the top. If the change is significant, we’ll tell you in the app or by email before it takes effect.

Contact

Memba Ltd, United States. Write to us at support@memba.app.