Privacy Policy

Version 2026-08-18 · MemoriaCastle

MemoriaCastle records what you say, turns it into searchable memories, and reminds you about things. This policy describes exactly what happens to that data. Every statement here describes what the app does today, not what it is intended to do.

Controller: {{CONTROLLER_NAME}}, {{CONTROLLER_ADDRESS}}
Privacy contact: {{PRIVACY_CONTACT}}

Age requirement

MemoriaCastle is not intended for anyone under 18. We do not knowingly collect data from anyone under 18. If we learn that we have, the account and all its data are deleted.

What we do not collect

• No location. The app requests no location permission and stores no location data. You can verify this in your device's app settings.
• No analytics, crash reporting, or advertising. The app contains no analytics SDK, no crash-reporting SDK, and no advertising SDK.
• No contacts, photos, files, or browsing data.
• We do not sell your data, and we do not use it to train AI models.

The app requests two permissions: microphone, to record; and notifications, to deliver reminders. Nothing else.

What we collect

Account: your email address, your display name, and a one-way cryptographic hash of your password. We never store your password itself.

Memories: the audio you record, the transcript of that audio, and the structure extracted from it — tags, people and places you mention, dates, and reminder times. Also any corrections you make.

Operational: your language preference, a push notification token for your device, and counters for how many captures and searches you have made.

At signup: the country you declare, the version of this policy you accepted, and when. You tell us your country; we never infer it from your IP address or your device language.

Lost-recording records: for a recording lost before it reached us — when it was made, how long it was, where known how large, and why it was lost. Never its content.

Who else processes your data

Producing a memory from a recording requires four external services. Each receives only what it needs, and none of them may train models on it.

Reminders are delivered through Google's Firebase Cloud Messaging.

Three of the four are reached through OpenRouter, which routes the request. We are contracted with OpenRouter, not with those three providers directly. OpenRouter reports each provider's retention terms and enforces our instruction never to route to a provider that trains on request data or that stores it — but the underlying retention commitments are those providers' own.

Details, including where each operates and what it retains, are on the subprocessors page.

Where your data is processed

Servers in Germany. All four AI providers listed above are US-based and process in the United States. Reminder delivery is handled by Google. If you are in Türkiye, this means your data is transferred outside Türkiye.

How long we keep it

Your memories are kept until you delete them. There is no automatic expiry.

ElevenLabs keeps audio and transcripts under its own policy — up to three years after last interaction. We send a zero-retention flag with every request; that flag only takes effect on service tiers we do not currently hold, so it has no effect today. This is the one part of the chain where we have no lever, and we state it plainly rather than implying otherwise.

Server logs record activity for troubleshooting and security. Application logs are kept up to 14 days and include your email address on sign-in events. Web server logs record the IP address of every request for up to 14 days and are used to rate-limit abuse. Error logs are kept by count rather than by date, so they can span longer during quiet periods.

Backups are encrypted and kept offsite for up to eight weeks.

Recordings waiting to be sent. When you make a recording that cannot be sent to our servers straight away — for example because you have no connection — it is stored on your device until it can be sent. These recordings are kept in a location that is excluded from Android's system backup and from device-to-device transfer, so they are not copied off your device by those mechanisms. They are deleted once sent, when you discard them, or when you delete your account in the app. Logging out, or a login that has expired, does not delete them: they stay on this device and are sent when you log in again. If you stay logged out on this device for 14 days, recordings still waiting are deleted the next time the app is opened, and the app tells you so when you next log in. The same applies if you delete your account from another device: recordings still waiting on this device are deleted the first time the app is opened after 14 days. If a recording is lost before it can be sent, a small record of it — when it was made, how long it was, and, where known, how large — stays on your device until you dismiss the notice, so that you can see something was lost rather than simply find it missing. The same record is sent to us when the app can reach our servers; we keep it with your account, include it in your data export, and delete it when you delete your account.

Getting your data out

Export at any time from the app. You receive a ZIP archive containing every memory, every transcript, all extracted structure, and — if you choose — your original audio. If any of your recordings were lost before they reached us, the archive also lists them, with the date of each and why it was lost; the list is there only when there is at least one. The archive is unencrypted, so store it carefully. We cannot reach a copy you have shared elsewhere.

Deleting your account

Deletion is immediate and permanent. There is no grace period and no recovery. Everything listed under "What we collect" is erased, along with your recordings.

Four things outlive it, and we would rather say so than let you find out:

• Audio cleanup can lag. Recordings are removed asynchronously. The app tells you when this is still in progress rather than claiming it has finished.
• A reminder already in flight may arrive within seconds of deletion.
• Logs and backups age out on the schedules above rather than being individually purged.
• Copies held by the services listed above are governed by their own terms. Your push registration with Google, and an installation identifier the messaging library creates, are outside our reach.

We keep one record that you deleted your account: an anonymous former-account reference, the date, and how much was removed. It contains no email, no name, and no memory content. It exists so we can prove the deletion happened.

You can also delete your account from the web, without the app: /web/en/delete-account/.

Your rights

Export your data, delete your account — both are self-service and immediate. For anything else, including questions about what we hold, contact {{PRIVACY_CONTACT}}.

Changes

Each version of this policy carries a date. We record which version you accepted at signup. Material changes are announced in the app.

2026-08-18 — first published.