Privacy policy
The short version: your location history stays on your phone. The web never holds one. We don’t sell data, don’t train AI on it, and put no trackers on any page.
Signed in? Your controls are in the privacy center: pause filing, excluded places, your authorization, export and delete.
What the website uses
- Browser location, only while a place or nearby page is open and only if you allow it. It’s used to answer one question — are you here, or what’s near you — and then discarded. It is not stored or logged.
- A venue QR code you scan opens that place’s page. It sets no cookie and doesn’t count as being there: only your location, checked as above, does.
- Your account: a display name, and the account id you get by signing in with your phone number, the same account as the iPhone app. Your number goes to Google’s Firebase, which texts you the code; our servers never store it. If you add a passkey, we keep its public key; the private half never leaves your device.
- What you leave: audio layers you record on the web, with the place and a GPS point inside it.
- Payments for listings, storage and commissions are handled by Stripe. We keep amounts and status, not card numbers.
What’s on near you
The calendar shows public events around where you are. To find them, our server reads organizers’ public calendars and asks event listing services (Wikidata, and others when we switch them on) what’s on in an area several kilometres across around you, never your exact point and never who you are. If you haven’t shared your location, it may use the rough area your connection comes from, and says so. Nothing about the search is kept with your account.
If you send us your events at /events/submit, we keep the calendar link or event, where it is, and an email address to ask a question before listing it. The address is never shown to anyone.
Films and requests
Tracing and filing happen only in the iPhone app. The server keeps what filing needs — who was asked, when, the deadline, the answer — and not your route. The full text of each request is encrypted so only you can read it. Returned footage and films are encrypted per user and play through links that expire within minutes. Opening films on the web needs a fresh sign-in: a new code texted to your number.
Camera owners
Each request link shows an owner only what that one request needs: the time windows, camera locations and a reference photo. Never your name or wider route. Links expire and can be revoked. Uploads are scanned before anything processes them.
No trackers
No third-party analytics or ad pixels. The one outside script is Google’s Firebase, the iPhone app’s service (with reCAPTCHA to check you’re a person when you sign in). It loads when you sign in and, once you’re signed in with your phone number, on the app’s pages, so your browser can open what you left with the iPhone app, at the place you’re in. What it opens goes from Google to your browser, not through our servers. Fonts and maps load without cookies.
Your controls
- Pause filing, edit excluded places, revoke your authorization, export everything and delete your account on the Privacy page.
- Deleting your account withdraws pending requests and deletes your films.
Law enforcement
Nothing routes to police. We hold as little as possible so a legal demand yields little, and we’ll publish a transparency report.
Contact
privacy@mementote.co · Mementote, Inc., San Francisco