privacy policy

last updated · 30 september 2026

Memento.sky ("Memento") is a private journal of the people you've met. This policy explains what data the app touches, where it lives, and what we can and cannot see.

who we are

Memento is built and published by Rahul M (slowpress), an indie developer. Rahul M ("we", "us") is the data controller for the personal data described in this policy. Contact: team.slowpress+memento@gmail.com.

what's stored on your device and in your icloud

The diary itself — names, moments, photos, scribbles — never leaves your devices and your private iCloud account. Specifically:

• People you log — names, the moment-of-meeting timestamp, the mascot pick, an optional photo, an optional sketch.
• Moments you attach to those people — text and timestamps.
• Linked contacts. If you link a person in your sky to someone in your phone's contacts, the details you pick (name, phone number) are copied into that person's entry. The picker is Apple's own contact-picker screen — out-of-process — so Memento only ever sees the one contact you select, never your whole address book, and it never reads your contacts in the background. You can also type a phone number or add social-media handles (Instagram, Facebook, Snapchat) by hand; those live in the same private diary entry.

This data syncs only through Apple's CloudKit private database tied to your Apple ID. We have no servers and no access to it. If you enable Apple's Advanced Data Protection in iCloud settings, your data is end-to-end encrypted such that not even Apple can read it.

what we collect off your device

Three small streams, each described below:

• Usage analytics (PostHog). From first launch, on every install, the app records a small set of key actions (first_spot_saved, paywall_shown, etc.) plus basic app-lifecycle events (launches, foreground/background), so we can see how the app is used and improve it — no screen views, no autocapture, no PII. These events are not linked to your identity: they're tied to a random per-install id that is never joined to your name, email, or Apple ID, your IP address is discarded on receipt, and no location or GeoIP lookup is performed. Your diary — people, moments, notes, photos, scribbles — is never collected.
• Subscription state (RevenueCat + Apple StoreKit). When you subscribe or restore, Apple processes the payment; RevenueCat records the subscription state and outcome. No card data — Apple never shares it with us.
• Ad measurement (Meta). Memento uses Meta's SDK to measure which of our ads bring people to install the app — nothing else. There is no Facebook login and nothing in Memento shares to Facebook. When it is on, Meta receives: the app's install and app-opens, logged automatically; App Store purchases, subscriptions, free-trial starts and restores, logged automatically by Meta's SDK, with an automatic "checkout started" event for each new purchase (the product's ID, name and description, price, currency and quantity, whether it is a one-time purchase or a subscription, the subscription period and any free-trial or introductory-offer details, the App Store transaction IDs and dates, and technical details such as the SDK and StoreKit versions — never card data); and two moments in the app, first_spot_saved (sent as Meta's standard "tutorial completed" event, with nothing attached) and paywall_shown (with only whether it was the first-run or the lapsed screen). These events carry an identifier for this installation of Memento, so they are linked to you in the sense Apple's privacy labels use. If you tap Allow on Apple's tracking prompt, they also carry your device's advertising identifier (IDFA), which is tracking: it lets Meta connect your activity here with other companies' apps and websites. If you don't allow it, no IDFA is sent. Like any network request, sending an event also reveals your IP address and basic device details. Your diary — people, moments, notes, photos, scribbles, contacts — is never sent to Meta.
  
  Whether anything is sent depends on where you are and on a switch you control, settings → privacy → ad measurement (meta):
  • On a first launch nothing is sent to Meta — Meta's SDK is not even started.
  • In the EEA, the UK and Switzerland (decided from your App Store country; if it can't be read, we treat you as being in one of these regions) it stays off until you turn the switch on, or tap Allow on the tracking prompt, which we show once, after you save your first star.
  • Everywhere else it turns on by itself once two separate launches have read an App Store country that doesn't require consent — normally from your second launch, or one launch later if you have just moved from one of the regions above — and the switch turns it off.
  • Turning it off stops our events at once and holds back what Meta's SDK has queued; Meta's SDK stops entirely the next time you open Memento, and that launch deletes the queue. Meta's SDK cannot be switched off inside a session that already started it, so until you next open the app it may still record an app-open or a purchase (held back, then deleted unsent), make its own configuration requests to Meta, and — only if this installation's one-time install notice to Meta has never gone through — send that notice, without the advertising identifier. Turning it on takes effect the next time you open Memento.

Diagnostics: none collected by the app. Memento has no crash reporter or diagnostics collector of its own. (When ad measurement is on, Meta's SDK may report crashes in its own code to Meta, under Meta's terms.) If you opt in to sharing analytics with app developers in iOS Settings (Privacy & Security → Analytics & Improvements), Apple may share aggregated crash and performance data with us; that is Apple's feature, governed by Apple's privacy policy.

why

• The diary stays on your device because it's yours.
• Analytics tells us what to improve.
• Subscription processing keeps the lights on.
• Ad measurement tells us which of our ads actually bring people to Memento, so we stop paying for the ones that don't.

legal basis (gdpr)

• Legitimate interest — product analytics (pseudonymous; not linked to your identity).
• Contract performance — subscription.
• Consent — ad measurement (Meta) in the EEA, the UK and Switzerland: the switch or Allow on Apple's tracking prompt. You can withdraw it at any time with the same switch. Tracking with the advertising identifier happens anywhere only with your Allow on that prompt.

sharing

• Apple — controller for the App Store, iCloud, and StoreKit. Apple's privacy policy applies to those.
• PostHog — processor, US region. PostHog, Inc. processes the usage analytics in the United States. EU/UK/Swiss→US transfers rely on PostHog's participation in the EU-US Data Privacy Framework (and its UK and Swiss extensions), with the Standard Contractual Clauses in our signed Data Processing Agreement as an additional safeguard.
• RevenueCat — processor, US region. Standard contractual clauses on file.
• Meta — Meta Platforms Ireland Ltd. (in the EEA, UK and Switzerland) or Meta Platforms, Inc. (elsewhere) receives the ad-measurement events above and processes them under its own terms and privacy policy. Data may be transferred to the United States.

We never sell data. The only advertising-related processing is the Meta ad measurement described above, and cross-app tracking happens only if you tap Allow on Apple's tracking prompt.

retention

• On-device + iCloud — until you delete (settings → about → delete everything).
• PostHog — 12 months rolling.
• RevenueCat — per their retention policy.
• Meta — per Meta's data policy; on your device, events queued while ad measurement was off are deleted on the next launch.
• Apple receipts — per Apple and tax law (typically 7 years).

your rights (gdpr / similar)

• Access — settings → your sky → export your sky exports a ZIP with everything.
• Erase — Settings → about → delete everything wipes local + cloud copies of your sky, removes any data-export file the app left on your device, cancels any pending reminder notifications, and resets the app's settings on this device — including the ad-measurement (meta) switch, which goes back to its default for where you are — and deletes what Meta's SDK has stored on this device (its install identifier and anything it had queued). Two small non-personal records are kept on purpose: a "finished onboarding" flag (so you are not sent back through setup on your other devices) and your purchase record (so you are never asked to pay again for what you already bought).
• Portability — the ZIP is JSON + raw photos + scribble PNGs, machine-readable.
• Object to analytics — usage analytics run under legitimate interest. Because the events aren't linked to your identity, we can't single out and delete one person's data, and there's no per-user switch. To stop future collection entirely, delete the app; you can also write to team.slowpress+memento@gmail.com with any objection.
• Withdraw consent / object to ad measurement — settings → privacy → ad measurement (meta). You can also change the tracking permission any time in iOS Settings → Privacy & Security → Tracking.
• Object / restrict — write to team.slowpress+memento@gmail.com and we'll honor it.

security

• iCloud at-rest encryption (Apple-held keys) by default.
• End-to-end encryption when you enable iCloud's Advanced Data Protection.
• TLS in transit for analytics, subscription and ad-measurement telemetry.
• No Memento-side servers ever handle your diary data.

changes

This policy is versioned in our public repository (memento-legal). Changes ship with a new "last updated" date.

complaints

You can complain to us first (team.slowpress+memento@gmail.com), or directly to your local data-protection authority — for EEA / UK users, your national regulator (such as the ICO) is the typical authority.