Privacy policy

1. What data and why

Account: e-mail address and, optionally, the name and picture from your Google account. Purpose: running your account (Art. 6(1)(b) GDPR).

Stories: the text, photos, dates and places you add. Purpose: providing the service (Art. 6(1)(b) GDPR). Photos are compressed in your browser and stripped of EXIF metadata, including GPS location.

Shared stories and reactions: the name, text and photos friends add through an invite link, and the recipient's messages, are passed to the story's author. Purpose: providing the service to the author (Art. 6(1)(b) and (f) GDPR).

Payments: billing details are processed by Stripe; we only keep transaction IDs and your plan. Purpose: billing and tax obligations (Art. 6(1)(b) and (c) GDPR).

Technical data: an admin action log, a story view counter (without recipient data) and a place search counter. Purpose: security and abuse prevention (Art. 6(1)(f) GDPR).

2. Who receives data

Providers processing data on our behalf: Supabase (database, sign-in, files; EU servers), Vercel (hosting), Stripe (payments), Google (Google sign-in, and place search and maps in the Memory Map template).

Some of them are based in the USA. Transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

A published story can be seen by anyone with its link (and password, if you set one). Story pages are not indexed by search engines.

3. How long

Account data and stories are kept until you delete your account. Sales and payment records are kept for the period required by tax law (5 years from the end of the tax year).

4. Your rights

You have the right to access, rectify and erase your data, restrict processing, data portability and to object. Download a copy of your data in the panel (Account → Download my data) and delete your account there in one click.

You may lodge a complaint with the Polish supervisory authority (Prezes UODO, ul. Stawki 2, 00-193 Warsaw) or the authority in your country.

5. Cookies

We only use strictly necessary cookies: your sign-in session, chosen language and access to password-protected stories. We use no advertising or analytics cookies, so there is no consent banner.

6. People in photos and recipients

If a story contains other people's data (e.g. photos), the user who added it is responsible for having their consent. Anyone concerned can ask us to remove content at the e-mail address above.