Privacy Policy

Account information. When you sign in with Google, we receive authentication information through Google and Supabase, such as your user ID and, depending on Google/Supabase data available to us, your email address and display name. RevenueCat may also receive your app user ID and optional email/display name for subscription management.

Profile and onboarding. We collect profile details you provide or configure, including partner/subject name, timezone, celebration date, onboarding progress/completion status, and milestone reminder preference.

Memories and milestones. We collect the memories and milestones you choose to save. This may include preferences, gift ideas, food notes, travel notes, date ideas, bucket-list items, milestone names, event dates, recurrence settings, accomplishment status, and timestamps. Memory descriptions and milestone names are encrypted before storage on the server. The app stores plaintext locally inside an encrypted local database so it can display and sync your vault.

Voice and speech. If you use the microphone feature, the app requests microphone/speech recognition permission and uses speech recognition to convert your speech into text. The code reviewed does not upload raw audio to Anemory's backend. The resulting transcript becomes User Content only if you save it as a memory. Speech recognition may be handled by your device operating system or speech recognition provider, subject to their terms and privacy practices.

Notifications. If you enable notifications, we collect and store Expo push tokens, device platform (ios or android), notification preference, and token update timestamps so we can send milestone reminders. Device tokens are pruned after they become stale.

Subscriptions. If you view, purchase, restore, or manage a subscription, RevenueCat and the applicable app store process purchase information. We receive subscription/entitlement status, product identifiers, expiration dates, and related webhook events to determine whether Pro features are active.

Transactional email. We may process email address, display name, and email-send status for welcome and account-deletion messages through Mailtrap.

Technical information. We process authentication tokens, API request metadata, rate-limit events, sync metadata, local outbox status, app configuration, device platform, and logs needed to operate and secure the Service. Server request logs record only basic details such as the request path, status, and timing. They do not include the contents of requests or responses. We do not write request logs for the calls that return your encryption key.

Product analytics and error reports (production builds). In production builds only, we use PostHog to record product events, a small set of operational logs, and uncaught client errors. The analytics client is not created in development or preview builds.

When you sign in, we associate analytics with your account user ID and, if available, your email. When you sign out, we reset that association.

Events currently sent do not include memory text or milestone names. They include event names and limited metadata, such as whether a memory was secured, updated, or deleted; memory type and accomplished status on update; milestone create/update with recurrence kind and whether the milestone is primary; onboarding completion; subscription purchase billing period; and account-deletion request. We also send short success logs for memory capture and milestone create.

Uncaught exceptions and unhandled promise rejections may be sent to PostHog. Those reports can include stack traces and, if an error message happens to contain it, other diagnostic text.

• create and authenticate accounts;
• provide memory and milestone vault features;
• sync content between your device and backend;
• encrypt, decrypt, display, and back up your vault;
• classify memories into categories using automated systems;
• calculate milestone reminders and upcoming dates;
• send notifications if enabled;
• process and verify subscriptions;
• enforce free-plan limits, subscription entitlements, and rate limits;
• send transactional emails;
• respond to account deletion requests;
• understand production feature use and diagnose client errors (PostHog, production builds only);
• secure, debug, and maintain the Service;
• comply with law and enforce our Terms.

Anemory uses Google Gemini to classify encrypted memories after decrypting them server-side for that purpose. If AI processing fails or is unavailable, the Service may use fallback categories such as uncategorized.

The code also includes a Gemini-based reminder text helper, but current notification tray copy is deterministic and avoids passing ciphertext as notification titles. Automated outputs may be inaccurate or unavailable.

• Contract necessity: to provide accounts, vault storage, sync, subscription features, and requested app functionality.
• Consent: for push notifications, microphone/speech recognition permissions, and optional settings where consent is required.
• Legitimate interests: to secure the Service, prevent abuse, enforce rate limits, maintain logs, send service-related communications, understand production product usage, diagnose client errors, and improve reliability.
• Legal obligations: to comply with applicable law, accounting, tax, consumer protection, and app-store requirements.

If a jurisdiction requires a different basis for a specific activity, we will apply that basis as required by law.

• Local SQLCipher database encryption with per-user keys stored through device secure storage.
• Server-side enc:v1 AES-GCM field encryption for memory descriptions and milestone names.
• The per-user field key is wrapped with AES-256-GCM before storage in Supabase. The separate wrapping key is held apart from the Supabase database.
• Supabase row-level security policies so authenticated users access their own rows.
• Bearer-token authentication for backend APIs.
• Rate limits for authenticated API requests and sensitive operations.
• Incoming account notifications from Supabase are accepted only if they present a valid shared secret. Incoming subscription notifications from RevenueCat are accepted only if they present a valid shared secret and a valid signature of the request body.
• Request logs do not include request or response contents. We do not log the calls that return your encryption key.

Important limitation: after sign-in, authorized backend services can use the separate wrapping key to provide the raw field key to your app, and backend workers can unwrap it and decrypt selected fields for features such as memory classification and milestone reminder titles. The wrapped key is designed to reduce exposure from a Supabase database-only dump; it does not protect against compromise of authorized backend services or the separate wrapping key. This is not end-to-end or zero-knowledge encryption.

• Supabase: authentication, database, row-level security, and backend admin operations.
• Railway: production backend API and worker hosting.
• Google Sign-In / Google authentication: account sign-in.
• Google Gemini: memory classification and automated text helper features.
• RevenueCat: subscription offerings, purchases, restores, and entitlement status.
• Google Play and/or Apple App Store: in-app subscription billing and management.
• Expo notifications and Expo push service: push token generation and notification delivery.
• Mailtrap: transactional welcome and account-deletion email delivery.
• PostHog: production product analytics, limited operational logs, and client error reports. Hosted at https://us.i.posthog.com.
• Device/platform speech recognition and notification services: microphone, speech recognition, and notification permissions.

These providers process information under their own terms and privacy policies. Current public policies for processors named above include Google (https://policies.google.com/privacy), Expo (https://expo.dev/privacy), and RevenueCat (https://www.revenuecat.com/privacy). Supabase, Mailtrap, PostHog, Gemini, and Apple publish their own policies. Those three links are not the complete processor set.

Notifications are optional and require device permission. You can dismiss the app's consent prompt, disable milestone reminders in app settings, or disable notifications in your device settings. The app also unregisters or queues push-token revocation on logout when possible.

Subscriptions are purchased, renewed, canceled, and refunded through the applicable app store. Deleting your Anemory account does not automatically cancel app-store subscriptions. You must manage or cancel them in your Apple App Store or Google Play account settings.

You can request account deletion in the app. The current implementation schedules deletion with a 7-day grace period. During the grace period, your account may be blocked from normal access. Signing back in within the grace period may cancel the request. After the grace period, the purge process deletes the account and associated database records by deleting the auth user and cascading related data. A personal erasure receipt containing user ID and purge time is kept for 90 days, then purged.

The mobile app also deletes the local encrypted database for the user when deletion is requested.

See how to delete your account.

Uninstalling the app stops further collection from that install. It does not delete information already stored on our servers or already sent to processors. Use in-app deletion or the email path on that page.

We keep information for as long as needed to provide the Service, comply with law, resolve disputes, enforce agreements, and maintain security, unless deletion is requested or required sooner.

• Account deletion grace period: 7 days.
• Account erasure receipts: 90 days.
• Stale device token pruning: default 90 days since last signed-in token update.
• PostHog analytics and error events: 1 year.
• Other backup and operational retention periods are up to 30 days for database backups and 90 days for audit logs.

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal information, and to withdraw consent where processing is based on consent.

The code reviewed supports in-app account deletion and settings controls for notification reminders. A dedicated data-export tool and an in-app analytics opt-out were not found. To make a privacy request, including a request to restrict or delete analytics records, contact privacy@mail.anemory.com.

If you are a California resident, CCPA/CPRA gives you the right to know, delete, and correct personal information, to opt out of sale or sharing of personal information, to limit use of sensitive personal information, and to non-discrimination for exercising those rights. To exercise a California right, contact privacy@mail.anemory.com. This draft does not claim that a “Do Not Sell or Share” link or Global Privacy Control honoring is implemented.

Where processing is based on consent (for example notification permission or microphone permission), you give that consent by turning the feature on. You can withdraw it in device settings or by writing us. Withdrawal does not undo processing already done.

The Service is not intended for children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child provided information, contact privacy@mail.anemory.com so we can delete it.

Your information may be processed in countries other than where you live, including where our third-party providers operate. If applicable law requires safeguards for those transfers, we will use appropriate mechanisms. Specific clauses (for example EU Standard Contractual Clauses) are not claimed until those contracts are in place.

Safeguards we actually use are listed in How we protect information. No system is perfectly secure.

If a breach of personal information occurs, we will notify affected people and regulators as applicable law requires.

We may update this Privacy Policy from time to time. If changes are material, we will provide notice as required by law. The updated policy will be effective as of the effective date shown above or another date we specify.

Dave Arrivas, 1953-55 Adriatico St Unit #143 Manila, NCR 1004 Philippines, privacy@mail.anemory.com.