Memory Diary Privacy Policy

Last updated: September 1, 2026

Memory Diary is a memory journaling and sharing app operated by NLD Tech LLC ("NLD Tech", "we", "us"). This policy explains what the app sends off your device, why we process it, who helps us provide the service, and the controls available to you.

Data We Process

To create your account and provide Memory Diary, we process:

Account and profile data: your email address, Firebase user ID, username, display name, authentication provider, account dates, and optional profile photo.
Content: memory titles and text, dates, lane and album names, personal lane-to-album organization, photos, videos (including any embedded audio or metadata), thumbnails, comments, likes, sharing settings, and collaboration activity.
Safety data: blocks, access requests, reports, report reasons, and identifiers for reported content and accounts.
Service data: device/app identifiers, App Check data, sync status, notification tokens and preferences when push is enabled, and limited operational logs.

Memories and media are stored locally on your device and, when sync is used, in Firebase Firestore and Cloud Storage. Photos are re-encoded before upload to remove source image metadata. Videos are uploaded as video files and may retain embedded audio and metadata.

How We Use Data

We use this data to authenticate accounts; store, sync, display, share, export, and delete memories; deliver account email and optional push notifications; enforce access and safety controls; investigate reports; prevent abuse; and maintain service reliability.

Sharing with Invited Members

Lanes and memories are private to their owner and invited members who sign in. A share link is only a pointer: it does not grant access, and the recipient must be a current member of the lane before the app displays any content. The web page for a share link is generic and does not retrieve or reveal the memory title, description, image, whether the link is valid, or any other account or sharing state. Memory Diary does not offer public lanes or anonymous access to user content in the current release. Removing a member prevents further in-app lane access after membership is checked, but it cannot recall copies that a member previously downloaded or exported.

Optional Usage Analytics

Usage Analytics is off by default. If you turn it on in Account Settings > Privacy > Usage Analytics, Firebase Analytics receives pseudonymous app-instance, device/app, session, approximate-location, feature-interaction, authentication-method, and reliability information.

We do not send the contents of memory titles or text, comments, lane or album names, usernames, email addresses, photos, or videos as custom Analytics event values. We do send limited derived values such as attachment counts, whether text exists, and a comment-length range.
Analytics is not anonymous: Firebase uses a pseudonymous app-instance identifier to distinguish installations and events.
You can disable Analytics at any time in Settings. The app then disables collection and resets its local Analytics identifier/data.

Push Notifications

Push notifications are off until you enable them. If enabled, Firebase Cloud Messaging and Apple Push Notification service process an installation token, a generic activity type, and generic notification text. Notification payloads do not contain lane names, memory titles, diary text, comments, actor names, or report reasons. You can disable push in the app or device settings.

Service Providers

Google Firebase and Google Cloud: authentication, database, media storage, server functions, App Check, hosting, optional Analytics, logging, and push delivery.
Apple: Sign in with Apple, push delivery, and App Store purchases if paid features are enabled.
Resend: account verification, password-reset, and email-change messages. Resend receives the destination email address and the account-action message/link. Resend also delivers an internal daily moderation summary to us when content reports are filed; that summary contains only identifiers (report, content, and account identifiers) and timestamps, and never includes memory titles, text, photos, or videos.

Paid subscriptions and external attachment providers are not active in the current app build. If activated later, RevenueCat may process subscription status, and a provider you choose (such as Google Drive, Google Photos, Microsoft OneDrive, or Dropbox) may process account identity, OAuth credentials, and selected file metadata. We will update this policy and in-app disclosures before enabling those integrations publicly.

Artificial Intelligence

The current Memory Diary app does not send your memories, photos, videos, comments, searches, or other content to an artificial-intelligence or machine-learning model. We do not use diary content to train an AI model. We will provide a separate disclosure and control before introducing any feature that sends content to an AI provider.

Retention and Deletion

Active account data and content are generally retained while your account remains active or until you delete them.
Items in Trash are scheduled for permanent deletion after 30 days and are removed when the app's cleanup process runs; they may remain longer if cleanup has not run.
Activity-feed records are scheduled to expire after 7 days. Temporary account-email queue records are scheduled to expire within 2 hours, and rate-limit records within 24 hours.
Reports and limited security/operational records may be retained longer when needed for safety, abuse prevention, legal obligations, dispute handling, or system integrity.

You can export your account data and request in-app account deletion from Settings. Account deletion starts our deletion process for the Firebase account and associated app data. Some records may remain temporarily in provider backups, logs, shared-content references, or legal/safety records until their retention periods expire or the related shared content is removed. Deleting an account does not cancel an Apple subscription; subscriptions must be managed through Apple.

How We Protect Data

Memory Diary uses safeguards commonly used by cloud-backed apps: authenticated accounts, permission rules for database and media access, App Check, server-side validation, encrypted network connections, and encryption at rest provided by Firebase and Google Cloud. Access is limited according to account ownership and lane membership, and sensitive account records are separated from public profile fields.

Memory Diary is not end-to-end encrypted. This means the service providers that store and process the data, and a limited number of authorized NLD Tech administrators, can technically access readable content when access is necessary to operate, secure, troubleshoot, moderate, or comply with law. We do not sell diary content or use it to train artificial-intelligence models. No online service can eliminate every security risk, so use sharing controls carefully and protect access to your device and account.

Children

Memory Diary is not intended for children under 13. The app requires a person creating an account to affirm that they are at least 13 before email/password or Sign in with Apple account creation can continue. We use this age affirmation instead of collecting a full date of birth. It is a self-certification, not identity or age-verification technology. If we learn that an account belongs to a child under 13, we will investigate and may delete the account and associated data.

Adults may store family memories that include children. Only upload or share a child's information when you have the right and authority to do so, and remember that invited lane members can view and export content shared with them. Contact us if you believe a child under 13 created an account.

Your Choices

You can edit or delete content, change sharing settings, disable optional Analytics and push notifications, export your account data, and delete your account from the app. You may also contact us to ask a privacy question or request help exercising applicable data rights.

Changes To This Policy

We may update this policy as Memory Diary evolves. We will post the revised date here and provide additional notice when required.

Contact

For privacy questions, support requests, or data-related concerns, contact support@memorydiary.app.