Legal
Privacy policy
This is a draft that a lawyer is still reviewing. It may change before Mementa launches.
This policy explains what personal data Mementa collects, why we collect it, who else handles it, how long we keep it, and how you can use your rights under Indian law.
On this page 13 sections
In short
- We store your photos and videos to back them up and organise them for you. We use them for nothing else.
- Our servers read your photos to power search, people and places. Mementa is not end-to-end encrypted.
- No ads. We don't sell your photos or information about them.
- You can download everything at any time, and deleting your account deletes your library.
Who we are
Mementa is run by [Registered business name], [Street address], [City], [State] [PIN code], India ("we", "us"). We decide why and how your personal data is processed, so under India's Digital Personal Data Protection Act, 2023 (the DPDP Act) we are the data fiduciary for it.
This policy covers the Mementa apps for Android and iPhone, the web app at photos.cloud-app.work.gd and this website at cloud-app.work.gd. It forms part of our Terms of service.
What we collect
When you create an account
- Your name and email address.
- If you sign in with Google or Apple: the account ID they give us, and the name and email address they share. If you use Apple's Hide My Email, we only see the relay address.
- If you sign in with email and a password: a one-way hash of the password (Argon2id). We never store the password itself.
- A profile photo, if you add one.
What you back up
- Your photos and videos, in their original quality.
- The details saved inside them, such as the date and time, the camera and its settings, and the location if your camera recorded one.
- What you add: albums, favourites, descriptions, the names you give people, and who you share with.
What we create from your photos
- A search index of what appears in each photo, groups of similar faces, place names worked out from locations, and memories. See Search, people and places.
From your devices
- For each device you use: its name, whether it is Android, iPhone or the web, the app version, its language setting, and a token for push notifications.
- When you last opened Mementa, and on which device. This decides whether a free account is still active (see Storage rules).
- Technical logs from our servers, such as IP addresses, browser or app details, the time of each request, and errors.
When you pay
- Your plan, billing period, payment status and renewal dates, and the payment reference from Google Play, the App Store or Razorpay. We never see your full card number, your bank password or your UPI PIN.
When you contact us
- What you write to us, any files you attach, and our replies.
On this website
- This website sets no cookies and loads nothing from other companies. Like any web server, ours records the IP address, browser details, time and page of each request.
How we use it
- To provide Mementa: store your files, show them on your devices, keep them in sync, and share them the way you choose.
- To organise your library: search, people, places and memories.
- To run your plan: apply it, renew it, and handle cancellations and refunds.
- To tell you what matters: sign-in codes, backup and payment problems, and storage reminders. If a free account goes unused, reminders come on days 60, 75 and 87; after a paid plan ends, they come on days 1, 8, 21 and 28.
- To keep Mementa secure: protect accounts, spot misuse, and keep a record of actions taken in our admin panel.
- To follow the law: keep tax and accounting records and respond to lawful requests from authorities.
We don't show ads, we don't sell your personal data, and we don't use your photos to train AI models.
We process your personal data with your consent, which you give when you create an account and use Mementa, and, where the DPDP Act allows it without consent, to meet a legal duty. You can withdraw your consent at any time, as easily as you gave it, by deleting your account or by writing to us. Withdrawing doesn't affect what we did before, and without consent we can't keep providing Mementa to you.
Search, people and places
Mementa organises your library automatically, on our own servers:
- Search. Each photo is analysed for what it shows, so you can find it by typing "beach" or "red car".
- People. We detect faces and group the ones that look alike. Face groups are made separately for each account, from that account's photos only, and are never matched across accounts.
- Places. We turn the location saved in a photo into a place name and show it on a map.
This is done by software models running on our servers. No person looks at your photos to do it, and we don't send your photos to other companies for it. Face groups may count as biometric data under Indian law, so we use them only to organise your own library, and they are deleted with your account.
Who we share it with
We don't sell personal data. We share it only in these cases.
People you choose
When you share an album, a link or your library with someone, they can see what you share. Anyone who has a share link can open it, so share links with care.
Companies that process data for us
These providers handle personal data only to provide their service to us, and only on our instructions:
- OVHcloud Runs our servers and databases, and this website. Everything we store passes through these servers.
- Hetzner Online or Cloudflare Object storage for the original files of your photos and videos.
- Brevo or SendGrid Delivers our emails, such as sign-in codes and reminders. Receives your email address, your name and the message.
- Google Firebase Cloud Messaging, with Apple Push Notification service on iPhone Delivers notifications to your phone. Receives a device token and the text of the notification.
- Razorpay Processes payments made on the web. Receives what you enter at checkout, such as your name, email address, phone number and payment details.
- Our map image provider When you open the map, your device loads map images directly from this provider, which sees your IP address and the part of the map you look at.
Google and Apple
If you sign in with Google or Apple, or pay through Google Play or the App Store, that company handles it under its own privacy policy and tells us only what we need, such as your account ID or whether a payment went through.
When the law requires it
We disclose personal data when Indian law requires it, for example under a valid order of a court or an authorised government agency, and only what that order covers.
If our business changes hands
If [Registered business name] merges with or is acquired by another company, your data would move to it and stay covered by this policy. We would tell you before that happens.
Where your data is stored
Our providers run data centres outside India, so your data may be stored and processed outside India. The DPDP Act allows this except to countries that the Government of India restricts, and we will follow any such restriction.
How long we keep it
- Your account and library: for as long as your account exists, unless you delete things sooner.
- Free accounts that go quiet: if you don't open Mementa on any device for 90 days, we delete your backed-up photos and videos, after reminders on days 60, 75 and 87. Your account stays.
- When a paid plan ends: on day 30 we remove files above the free 10 GB, keeping your favourites first and then your newest photos and videos. See Storage rules.
- Things you delete: deleted photos and videos go to the trash first, and are gone for good once the trash is emptied.
- When you delete your account: your photos and videos are deleted right away. Our database backups, which hold account details and photo information but not the photos or videos themselves, are deleted automatically after 30 days. We keep a short record of the closed account, payment records and security logs where the law requires it. Details: Delete your account.
- Support and grievance messages: as long as we need them to resolve your request and keep a record of it.
- Technical logs: for security and to fix problems, and for as long as the law requires us to keep them.
Your rights
You have these rights, which the DPDP Act also gives you:
- Get a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
- Have it corrected, completed or updated, and have it erased once it is no longer needed or you withdraw consent.
- Have your complaints heard by our grievance officer.
- Nominate someone to use these rights for you if you die or become unable to act.
- Withdraw your consent at any time.
You can do most of this yourself in Mementa: change your name, download any photo or album, delete photos, or delete your account. For anything else, write to support@yourdomain.com from the email address you sign in with, so we can confirm it's you.
If you are not satisfied with how we handle a complaint, you can take it to the Data Protection Board of India after using our grievance process.
Children
Mementa is for adults. You must be 18 or older to create an account, and we don't knowingly collect personal data from children. If you think a child has created an account, write to us and we will delete it. Photos of your family, including your children, are part of your library like any other photo, and only you decide who sees them.
How we protect it
- Every connection to Mementa uses HTTPS with TLS 1.2 or newer, and browsers are told to always use it.
- Email passwords are stored only as Argon2id hashes, never as readable text.
- Sign-in tokens are replaced each time they are used. If an old token shows up again, that session is signed out.
- Only the people who run Mementa have technical access to our servers, and actions in our admin panel are recorded in an audit log.
- Mementa is not end-to-end encrypted: our servers can read your photos, which is how search, people and places work.
If a personal data breach affects you, we will tell you, and the Data Protection Board of India, as the law requires. More in Privacy and security.
Cookies and browser storage
This website sets no cookies. The web app at photos.cloud-app.work.gd keeps you signed in using your browser's storage, not cookies. The apps and the web app contain no advertising or analytics trackers.
The web app may load parts of its display engine, and fonts for some languages, from Google's servers. When you use those features, it also loads Google's sign-in, Google Firebase and the Razorpay checkout from their servers. These companies may set their own cookies under their own policies.
Changes to this policy
When we change this policy, we update the date at the top of this page. If a change affects how we use your personal data in an important way, we will tell you by email or in the app before it takes effect.
Contact and complaints
- Questions
- support@yourdomain.com
- Grievance officer
- [Grievance officer name], Grievance Officer
grievance@yourdomain.com
+91 00000 00000 - Post
- [Registered business name], [Street address], [City], [State] [PIN code], India
How to raise a complaint, and how quickly we answer: Grievance officer.