What we collect, and who can see it.

Trunk for the Mac is coming soon; the parts of this policy about it apply once it's available.

Washington and Nevada residents: see our Consumer Health Data Privacy Policy.

Last changed October 28, 2026. The promise page says the same thing in plain words; this is the policy.

This policy changed on October 28, 2026. The updated policy allows automated tools on our own service to help review what's submitted for publication, public profile fields and the shared material a report names, never your private library, and a person decides every permanent removal, every action against an account for breaking our rules, and every appeal. If Apple tells our iPhone app that someone under 13 signed in, we now lock the account and email its addresses; unless a person at Trunk finds by the date in that email that it belongs to an adult, we close the account and begin deleting what it holds 14 days after the lock began, or sooner if we confirm it's a child's, and a legal hold can delay that. It also now says how long we keep a report under a legal hold, a record of each notice we email to every account, a record of each request you make about your data, a record that Apple told our iPhone app someone under 13 signed in to an account and what we decided about it, and the code of a download of Trunk whose consent a parent or guardian withdrew before any account under 18 signed in with it.

This policy changed on October 19, 2026. In short, when you sign up on this site, we now ask for your year of birth to decide your age category: someone under 13, or a teen in Mississippi, Tennessee or Nebraska, can't make an account, and an account under 18 is marked as one, with the limits described under Children and teens. The site doesn't keep the year.

This policy changed on October 14, 2026, when our service was updated. In short, the service also started to:

check the country of the address you connect from, as US sanctions law requires;
count sign-in code emails and wrong codes for a day;
keep a reported link, collection or public story for a set time while the report is handled, and record each look at a reported link or collection;
find copies of reported files by their fingerprints, and keep a record of each takedown request;
suspend an account for a serious breach, pausing its links and its cloud downloads;
keep a sealed record of deletions for up to 37 days, so a restore from backup repeats them;
delete moderation records three years after an account ends.

Your memories, kept by one accountable person. Trunk records and transcribes on your iPhone or Mac. If you keep your memories in Trunk's cloud, they are encrypted on the way and where they're kept, on all your devices and safe if you lose one. Keep your own copies of what matters to you: Export is free. We never advertise with them, sell them or train AI on them, and nobody at Trunk looks at them unless you ask for help or the law compels it, and then it is recorded. What you share is different: when a shared link or a private collection is reported to us as illegal or abusive, we look at what was shared, and nothing else of your library. We record that look in Trunk’s own record, apart from the record of looks at your library that we send you.

Who we are

Trunk is run by one person, its founder Chase Kaczmarek, who answers for every use of what you keep in it. The company behind it is Chase Color, Inc. (formerly Coggy, Inc.), a Delaware corporation, which is the controller of the data described here. Post: 350 E 400 S #54472, Salt Lake City, UT 84111, United States. Email: help@trunkhere.com. The postal address is a private mailbox that is checked rarely, so email is the route that reaches us.

What this policy covers

This page covers the Trunk apps for iPhone, Apple Watch and Mac, their accounts, the cloud library, sharing by link, private collections and public stories, and trunkhere.com, including its waitlist, its contact form, its shared-memory reader and the pages where you sign in, manage your account and read your private collections. The site runs no analytics. It sets cookies only when you sign in on it: one keeps that sign-in for thirty days or until you sign out, and while you sign in with Apple or Google, a second lasts ten minutes so their answer can be matched to your request. When you sign up here, with a code or with Apple or Google, the second also holds that sign-in for at most ten minutes while you give your year of birth. When a code sign-in's address already reaches an account through Apple or Google, the second holds that sign-in for at most ten minutes while you choose whether to add the address there. No script can read either, and they are used for nothing else.

Some pages keep things in your browser only, never sent to us: what you follow or save, where you stopped in a story and when, and the quality you chose. Discover keeps the place you last chose there in your browser too, and asks our service for that place's stories, with nothing about who you are. These browser-only follows and saves do not sync with the app. Forget everything, or clearing this site’s data, removes them. The voice demo also caches its speech model in your browser; clearing this site’s data removes that copy.

What stays on your device

Recording, transcription, the words read from photos, the choice of the frames kept from a video, titles and summaries all happen on your iPhone or Mac, with the device's own models. Nothing you record is sent anywhere to be transcribed, and no video is uploaded to choose its frames; there is no cloud transcription. The iPhone app needs no account to record, transcribe, search, play or export; the Mac app needs one, with Trunk Pro, only to record. Without an account, everything stays on your device, and Export takes all of it out as files.

The iPhone and Mac apps contact our service each time they open, to learn what the service offers, and whenever you watch public stories, look up a place or get an arrival reminder, with or without an account (with reminders on, the iPhone also reads the list of public places, and a place's stories as it arrives there, in the background, without your account); once you sign in, also for the cloud library, links, collections, publishing and Pro. They contact Apple for speech-model downloads, purchases and the maps they show, and Apple or Google handles its own sign-in when you choose it. None of this sends your recordings to be transcribed. Text/PDF sharing and exporting make readable copies at the destination you choose; the cloud library and sharing by link work as described below.

On the Mac, Trunk checks the update feed at trunkhere.com when you choose Check for Updates, sending nothing but the request. It also checks at launch and once a day. It offers an update and never installs one on its own. On the Mac, Trunk notices which app is using the microphone, on the Mac alone, so it can offer to record a call; Settings turns this off.

The Apple Watch app talks only to your iPhone, never to us. A recording made on the Watch stays on it until your iPhone has saved it, and the Watch keeps the last five memories you played on it, so they play away from your iPhone. A Watch recording that can't be matched to an account stays on your iPhone, and the signed-in, unlocked account can add it from Settings, Apple Watch, "Add Watch Recordings to My Library"; one the Watch made for an account that has since been deleted is never added to any library and goes when this iPhone learns of the deletion, or at the latest at the next Erase All.

Because your memories live on your iPhone or Mac, they are included in that device’s own backups—iCloud or computer backup for the iPhone, or backups such as Time Machine for the Mac—the way any app’s data is, video files too, under your settings. If you turn on Copy Videos to iCloud Drive, the videos in that device's library, outside Recently Deleted, that Trunk hasn't already saved to a folder, and each new one, are also copied to a Trunk folder in that device's iCloud Drive. On the iPhone that's every such video on it, whichever Trunk account it was made under, signed in or not. On the Mac you sign in to turn it on, and it copies the videos made under that account, or signed out after it or before any account signed in, and skips another account's and any whose account it can't tell; signing out or changing the account stops it until that account signs in again. Copies already made stay in iCloud Drive when copying is turned off. Apple encrypts iCloud backups and iCloud Drive at rest; an iPhone backup to a computer is encrypted only when ‘Encrypt local backup’ is on. We do not receive those backups or that folder.

How recording works

Trunk records and transcribes on your device. Recording starts only when you start it, including through a Shortcuts automation you set up. Nothing of a recording is sent to us while you record. If you use the cloud library, the finished recording and its words are uploaded after you stop, so you can reach them on your other devices; our service searches your words only when you ask it to. "Me" is your microphone and "Them" is the other sound. Trunk never analyzes anyone's voice to tell people apart.

What you keep in the cloud library

If you sign in and keep your memories in the cloud (Settings, Cloud Library), Trunk stores them so they are on all your devices and safe if you lose one: titles, words, transcripts, summaries, folders, audio, photos and the frames taken from video. It does not keep video files: they stay on the device that made them, and Export includes them. Keep your own copies of what matters to you: Export is free. The cloud library comes free with your account, with fair use of about 100 GB. Apart from files, what your account keeps in our database, including the words, titles and other details of your cloud library and of the copies kept for your links and collections, has a separate limit of 128 MiB, about 134 MB. Signing in alone does not turn it on: your library stays on your devices until you choose Keep in the Cloud. The first time, the app says what will go up, why, who stores it and how to stop, and asks before anything goes.

The device keeps a record of which account was signed in when each memory was made. On the Mac, a recording that ends after the account it began under has signed out or changed waits on that Mac, out of the library and never sent to us, until that account signs in there again; it goes if that account is deleted or you choose Erase All Memories on that Mac. One Trunk can't tell is any account's stays there the same way until Erase All Memories removes it.

What you keep there is encrypted in transit and at rest; our providers hold the keys for storage, and our service can read it, to run Trunk: to sync it, search it for you, make the links and collections you ask for, and keep it safe. There are no keys, recovery codes or device approvals for you to keep.

What you keep can include sensitive things: your health, your beliefs, your relationships, where you were. We treat all of it the same way: we keep it for you and use it for nothing else. Our Consumer Health Data Privacy Policy says more about health information.

We hold your sign-in (your email or Apple relay address, and which sign-in you used), your subscription, your devices and when they connected, and a keyed hash of the address they connect from, kept only to limit abuse: gone within the hour, except a day's count of the sign-in code emails asked for from that address, kept about 25 hours. We also hold your username and the ones you had before, your devices' names (a Mac's is the name you gave the computer), the people you've blocked, the stories you've hidden, your private collections with their copies, members and invitations, the reports you send us (for a takedown request, the name, contact details and signature you give), our records of moderation decisions and legal holds, and, for an account under 18, the under-18 mark. If you keep memories in the cloud, we hold everything you keep there: titles, words, transcripts, summaries, folders, audio, photos and the frames taken from video (video files stay on your devices), and the service can read them to run Trunk.

If you kept the earlier encrypted backup, it moves into the cloud library once, from a device that still holds its key: on that device, choose Move My Backup in Settings, Cloud Library. Everything in it comes to that device first, goes up and is checked; then the old backup is removed. From then on it is kept like the rest of the cloud library. If your account keeps nothing in the cloud library, the earlier backup is deleted 90 days after its Pro subscription ends.

Who looks at it

The people who run Trunk never look at a private library except when its owner asks for help or the law compels it. Every such look is recorded with its reason and reference, and the record is sent to the owner on request (help@trunkhere.com), unless the law forbids telling them, and then as soon as it allows.

What you share is different. When a shared link or a private collection is reported to us as illegal or abusive, we look at what was shared, and nothing else of your library. We record that look in Trunk’s own record, apart from the record of looks at your library that we send you.

If we switch the link or collection off, it is kept out of everyone's reach for 30 days, so a report the law requires can be made or a mistake put right; then the link's copy, or the copies in the collection, are deleted, unless the law requires us to keep them longer. The collection's name, description, members, invitations and history go with them. If you delete your account during those 30 days, its deletion finishes when they end.

The memories in your library stay.

We may use automated tools, running on Trunk's own service, to check what's submitted for publication, public profile fields, and the particular shared material a report names. Each check sees one item, with how many the same account submitted that day and whether it repeats one we rejected, and, where needed, the report's words, without account numbers, email or IP addresses, or ages. The tools never scan your private library, an unreported private collection or a draft you haven't submitted, and we don't train models on memories or reports. These tools never act on an account: a person decides every permanent removal, every action against an account for breaking our rules, and every appeal.

Trunk never uses private memories for advertising, never sells or rents them, and never trains models on them.

Child safety and the law

US law requires us to report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), and we do. If someone reports a shared link, a private collection or a public story to us as illegal or abusive, we look at what was shared, and nothing else of the library. When we make a report to NCMEC, we keep what we reported for one year from the report, as the law requires, and keep the account it came from, with everything it holds, from being deleted for that year; no one opens what is kept unless the law requires it, and it is used for nothing else. When we act on a report or a removal request, a machine can compare the fingerprints recorded for its files with those of the files in other public stories, shared links and collections, without anyone looking at anything else, and each link or collection found with a matching fingerprint is noted in Trunk's own record; a matching fingerprint alone doesn't prove the files are the same. When we remove an intimate image shared without consent, we also remove the identical copies of it we know of. We answer valid legal process, such as a court order. The look is recorded, and the record is sent to you on request (help@trunkhere.com), unless the law forbids telling you, and then as soon as it allows, as described under Who looks at it.

When you choose Share by Link, the app makes a copy of the memory on your device: its title, date, summary, transcript, audio, photos and stills and the words read from them, with photos re-encoded without location or camera details and the recording made playable. Video is not included. Trunk keeps that copy for the link until the link expires or you take it back; a link lasts 7, 30 or 90 days, 30 by default. There is no key in the link. The copy is encrypted in transit and at rest, and our service reads it to serve it. We hold the copy and its id, owner, size, creation and expiry times, whether it was taken back, and how many times it was opened. Network information such as IP addresses is visible to our infrastructure.

Anyone with the link can open it in a browser, without an account or the app, and save or pass it on; the service you use to send the link can receive it too. Taking back or expiring a link stops new opens, not copies already made. Free accounts may have five live links, within 2 GB of copies. The reader uses no accounts, comments, analytics or third-party resources.

A private collection is read by its owner and the people they invite by username; our service reads it to serve it, and Trunk’s people may look at a reported collection as described under Who looks at it. Trunk keeps each collection's title and description, who may read it, its invitations and who joined or left and when, and a copy of each memory added to it, made from the owner's cloud library, with photos re-encoded without location or camera details. Removing someone stops their access at once, but cannot recall copies they already saved.

Public stories, if you publish or watch them

Publishing is a separate, deliberate act that needs your sign-in and a review. Only the edition you choose to publish becomes public. Anyone, including us, can view it. You can take it down, but copies others saved can't be recalled. A public edition never carries its private original, your other memories, the exact spot it was recorded or later edits by itself; it names an area, never a spot, shows when it was recorded, to the minute, and says whether where it was made is confirmed.

A public story is its key frames and audio, its photos, or its text. The frames move gently and change in time with the recording, more like a moving album than a video. No video is published or hosted.

Of public stories we can see the edition itself, the public profile, the chosen place, collection membership, follows, appreciation, hides, blocks and reports, and the operational records needed to serve them. Before you publish, you confirm that you are 18 or older and have the rights and consent your stories need; we keep that confirmation, the version of our rules you agreed to, and when. For a story placed while you were there, we also keep when and how closely your phone confirmed you were in the area, never the spot itself. The people who review stories see these; automated tools see only whether the edition says its place is confirmed. A block also reaches our review as a report, and the person blocked is never told. Watching needs no account, no app and no location.

If you recommend a story to our curators or suggest a correction to a place, we keep it with your account, your words and whether you said you were sure. The curators see your public name if you have one, and your standing from recommendations they took up. If they pick a story you recommended, your public name can show beside it.

Discover shows the places with public stories on a map, the stories near a place you choose, newest first, and Spotlight: stories, collections and creators our curators choose by hand, in their order, the same for everyone apart from any you can't open, with who picked each, when and why. There is no feed, no ranking, no algorithmic picks, no personalization and no language model. When you're signed in, the apps' requests for stories, a place's stories included, carry your sign-in; their requests for places and the map never do. We keep nothing about what you watch, skip or save. Requests for authors carry your sign-in too, so the service can answer them. The apps send no viewing signals, and we keep no viewing history or preference profile; what the service held of them before is being removed. Your follows, hides, blocks, reports and appreciation stay.

When you ask for places near you, the app sends a rounded area, never your exact spot, and we keep nothing of it.

On the iPhone, Your Progress keeps up to 500 of the public places it found you in, on the phone only and out of its backups, until you choose Reset Places Visited or Erase All Memories.

When an arrival reminder goes off, the phone reads that place's stories without your account, so we never learn which account arrived where or when.

Your account

Any signed-in adult can make a public profile: your username and the display name and biography you give it, with no photo. Each time you save it, it's reviewed, and it's public only once approved.

An account is made the first time you sign in, in the app or on this site, for the cloud library, Pro, Share by Link, private collections or publishing. It holds your sign-in addresses and methods, the provider's identifier, your username if you choose one and the usernames you had before, device names (a Mac's is the name you gave the computer) and identifiers, sign-in times, and your subscription records and their history with Apple. Apart from the account, the service keeps a keyed hash of the address your devices connect from, kept only to limit abuse: gone within the hour, except a day's count of the sign-in code emails asked for from that address, kept about 25 hours. There are no passwords, keys, recovery codes or device approvals (the earlier encrypted backup's key aside, until you move it): email sign-in uses a six-digit code that works for ten minutes.

After ten wrong codes for one email address in a day, that address's codes are nine digits long until the day ends (UTC). To know when, the service counts the wrong codes for each email address that day, filed under a keyed hash rather than the address itself, and deletes the count when the day is over. To limit unwanted code emails, it also counts the code emails sent to each email address that day, filed the same way, and deletes that count when the day is over too.

Apple and Google sign-in give us a stable identifier and an address; when you delete the account, we ask Apple to end that sign-in.

If Apple or Google gives an address that already belongs to an account, we say so rather than make a second account, and hold that sign-in for ten minutes while you sign in to the existing account or choose a new one. Before you delete the account, add or remove a way to sign in, or change your username, we ask you to sign in again if your last sign-in on that device was more than ten minutes ago.

We email the addresses on your account when someone signs in after the sign-in that made it (except the address that just received that sign-in's code), when a way to sign in is added or removed, when your username changes, and when the account is set to be deleted, kept or deleted, so you would know if it was not you. We don't email an Apple relay address that Apple tells us you've turned off. In Settings, Account, or on this site's Account page, you can manage your sign-in methods, see your devices, sign out here or everywhere, and delete the account.

Deleting the app doesn't sign you out of this iPhone: its keychain keeps your sign-in, whether you keep your memories in the cloud library, and this month's transcription count, so Trunk installed again comes back signed in and, with the cloud library on, brings your memories back down. Sign out first if you want it to forget your sign-in. On the Mac, deleting the app leaves your memories and your sign-in on that Mac, in its Application Support folder and its keychain, so Trunk installed again finds them; sign out and choose Erase All Memories first if you want that Mac to forget them.

Payments

Pro is sold through the App Store as an auto-renewing subscription. Apple runs the purchase, renewal and cancellation under Subscriptions in your Apple Account settings, and card numbers go to Apple and never to us. Apple sends signed subscription records, including transaction identifiers, purchases, renewals, expiry and refund events, so Pro can be turned on and off. These records carry no card details. A purchase made while you're signed in carries your account's number, so Apple's records of it name that account. If you delete the account a subscription belongs to, the subscription goes to the next account you sign in to on that iPhone within 400 days; to stop paying, cancel it with Apple.

The waitlist

When you join the waitlist on this site we collect your email address, which part of the page you signed up from, and the campaign labels carried by the link you arrived on, if any.

We use them to ask you to confirm the address, and then to email you when Trunk is on the App Store, and for nothing else. Until you confirm, you aren't on the list and we keep nothing of your address: the link carries it, and stops working after 7 days. If you joined before October 12, 2026, when we began asking you to confirm, you're on the list without confirming. Resend, which sends that email, keeps its record of each send for 30 days. If an email to an address can't be delivered at all, or is marked as spam, Resend puts that address on a list of addresses not to email, and nothing more is sent to it while it stays there. We keep when you confirmed.

We send that email once, keep the list for 30 days after it so its unsubscribe link keeps working, and then delete the whole list. If you reply to that email asking for updates, we keep your address on a separate updates list and email you about what's new in Trunk, at most once a month, until you unsubscribe, reply "stop" or ask us to delete it.

Resend, our email provider, stores the list and sends the mail on our behalf. The launch email and any updates email carry an unsubscribe link, and unsubscribing stops the mail. The email asking you to confirm has none: it only asks. Until you confirm, entering the address on the form again can send another request, and nothing else is sent. We send at most one confirmation email a day to an address. Once an address has unsubscribed, submitting the form again changes nothing: nobody can put you back on the list against your wishes. To re-join, email help@trunkhere.com. Unsubscribing keeps your address on the list marked as unsubscribed, which is what makes it stay unsubscribed. Ask us to delete it and we delete it. After that, entering the address on the form can send a request to confirm again, and a link from an earlier request can add it back until that link expires.

The contact form

A note sent from the support page goes by email, through Resend, to help@trunkhere.com, with your address as the reply address. It is kept as ordinary mail for as long as the conversation needs, and deleted on request.

Who processes what

Apple: speech-model downloads; the App Store and your subscription; Sign in with Apple, in the app or on this site, if you use it; the maps the apps show (Apple Maps); the age range it shares with the iPhone app, and its notice if a parent withdraws consent. Links to the App Store from the pages of this site that work like the app, such as stories, places and Discover, name the kind of page they’re on as an App Store campaign, so Apple can tell us in totals how many downloads came from each; nothing about you is in the link.
Google: Sign in with Google, in the app or on this site, if you use it.
Resend sends the sign-in codes and the emails about your account, and sees the address and what each says. It also holds the waitlist and relays notes from the contact form. It also carries removal requests made with Report to takedown@trunkhere.com. Resend checks a small sample of the email it sends with automated tools it runs itself, including language models, to stop abuse; it doesn't train models on it.
Google Workspace hosts our email, including help@trunkhere.com: what you write to us and our replies are kept there.
Fly.io runs our server and its database, in the United States. Its network receives each connection at the point nearest you, which can be in another country, and passes it to our server.
Tigris stores the files of your cloud library, shared links, private collections and public stories. It is a global storage network: each file is kept in the data center nearest to where it was uploaded, and copies are made near wherever it is opened, so a file can be stored in any of Tigris's locations, in the United States, Europe, the United Kingdom, Brazil, South Africa, Japan, Singapore and Australia. They are encrypted at rest, and our service can read them.

The phone's own iCloud or computer backup, and the iCloud Drive copy of your videos if you turn it on, are separate, as described above. We do not sell your data or share it for advertising. If the law compels us to disclose what our service holds, that can include what you keep in the cloud library, as well as the account, subscription and device details described here; such a look at a library is recorded like any other. In an emergency, when someone is in danger of death or serious injury, we may give the police an account's records (who it is, its sign-ins and devices) without a court order, never what is kept in its library.

Logs

Our server's request logs record only which kind of request was made, whether it worked and how long it took, and its operational logs hold totals, measurements and fixed warnings: neither holds an internet address, an account or content. Our host sees the internet address of each connection, as any host does, and keeps its own logs under its terms. The site keeps whatever request logs its host keeps. The site's gateway also counts waitlist and contact-form requests, only to limit how often the forms can be sent: in its memory, never in a log, and each filed under a keyed hash of the request's internet address (for an IPv6 address, its first half) rather than the address itself. The key is replaced every 20 minutes, and the old one isn't kept.

To limit abuse, the service counts requests for up to an hour, by internet address (for an IPv6 address, its first half, which names its network) and, for some requests, by account or email address, each filed under a keyed hash rather than the address or account itself; nothing records what you watched. Of these, a day's count of the sign-in code emails asked for from each internet address, or sent to each email address, is kept longer, deleted once that day (UTC) is over, within about 25 hours. So is a day's count of wrong codes for each email address.

We check the country and region of the address you connect from when you visit the Mac page or download the Mac app, when it checks the update feed, and on every other request you make to our service, such as reading public stories or a shared link, signing in or using your account. US sanctions law requires it. We also send no sign-in code to an email address under Cuba's, Iran's or North Korea's country domain. The country and region come from DB-IP's IP to City Lite database, refreshed monthly. Nothing of a lookup is kept. If the database places you wrongly and you're blocked, write to help@trunkhere.com. IP Geolocation by DB-IP

What we do not do

We run no analytics tools and no advertising trackers in the app or on the site. We use no third-party analytics SDKs and no cross-site fingerprinting, load no third-party scripts, and set no cookies on the site but the two for signing in, described above. Signing in with Apple or Google on the site takes you to their own page and back. We never use private memories for advertising, never sell or rent them, and never train or tune models on them. Nobody here looks at your library except as described under who looks at it.

We don't sell personal information, and we don't share it for advertising. If you live in Nevada, you can still send a request not to sell to help@trunkhere.com, and we'll confirm it. We don't collect, use or sell anyone's personal information to train large language models or any other AI model.

Do Not Track

Trunk does not track you across other companies' sites or apps, and no other company can collect information through our site or apps about what you do over time or on other sites. (If you choose to sign in with Apple or Google, they know you signed in.) So we treat every visit the same, whether or not your browser sends a Do Not Track or Global Privacy Control signal.

How long we keep things

Your account details, sign-in methods, device records and subscription state, while you have an account. Account deletion removes them, subject to the cleanup and retry steps below.
A record of each notice we email to every account, such as a change to these terms: when it went to your account and whether the mail service took it, while you have an account. Account deletion removes it.
A record of each request you make about your data, such as for a copy or a deletion: when it came, what you asked, the address it came from and how we answered, for about 24 months after we answer it, even after the account is deleted, to show how we handled it. It never holds the data itself.
Your username and the usernames you had before, while you have the account, so your old profile links keep working and nobody else can take those names. A new name you leave by switching back within 14 days is freed at once, and its links stop working. After the account is deleted, the remaining names alone are held for at least 35 days before anyone else can choose them.
After an account is deleted, one-way hashes of its deletion receipts, of its devices' sign-in tokens and of the account's own number are kept for 400 days. Nothing about you can be read back from them. They let a device you used learn the account is gone and remove what it kept, and let a Pro purchase made with the account go to the next account you sign in to on that iPhone within those 400 days. A one-way hash of the account's number, made with a key only the service holds, stays on the record of each link the account made, so our moderators' notes about a link still find it, and it goes when the 400 days end.
What you keep in the cloud library, until you delete it. The cloud library comes free with your account and stays while you keep the account; Pro ending takes nothing from it.
A shared link stops new opens when it expires or you take it back. Expiry is 30 days by default, with 7, 30 or 90 days to choose from. Server cleanup then removes its copy, retrying if storage is unavailable. Its operational record can remain to show its expiry or taken-back status. Deleting your account also stops its shared links and removes their copies and records through the account cleanup. Copies someone already opened or saved cannot be recalled.
A shared link or private collection we switch off after a report, or when its owner asks us to: out of everyone's reach for 30 days, then the link's copy or the collection's copies are deleted, unless a report on it is still open or the law requires us to keep them longer; the closed collection's name, description, members, invitations and history go with them.
A private collection, until you delete it or your account. Its members lose it at once.
A public collection you or a moderator remove stays, out of view, until the account is deleted.
A deleted memory stays in Recently Deleted for 30 days, then goes from your devices and the cloud library. The app erases it when it next runs after that, or when you choose Erase Now. The change reaches the cloud library and your other devices when they sync, and the cloud library removes its files at its next cleanup; offline or paused syncing delays that; a deletion made while signed out reaches the cloud library only when you next sign in; and while Pause Syncing is on, an iPhone also waits to erase the memory itself until syncing resumes or you choose Erase Now. Once the deletion has reached the cloud library, the service also deletes it there 30 days after the deletion reached it without waiting for a device to send the rest; a legal hold or an unfinished cleanup can delay the end. Any copy of its video in iCloud Drive › Trunk stays there until you delete it.
A link you shared from a memory keeps opening until it expires or you take it back. While you're signed in to the account that made the link, deleting a memory this iPhone made a link from also offers "Delete and Take Back Link", and Erase Now takes back the links this iPhone made from it and says so. Signed out, deleting or erasing the memory leaves its link open until it expires, or until you sign in and take it back. On the Mac, deleting or erasing a memory leaves its links open until they expire or you take them back in Account, Shared Links. Copies added to private collections stay until removed.
Memory and file identifiers, sizes and deletion dates can remain after an individual memory is erased, to keep devices in sync and track file cleanup. Deleting the account removes those records once its file cleanup finishes.
No viewing history or preference profile: requests can carry your sign-in as described above, but we do not keep a history of what you watch, skip or save; what the service held of them before is being removed.
A public story you withdraw or delete: its files and words go from our service within a day, unless a report on it is still open, for 30 days after we act on a report on it about a child's safety or an intimate image, for 30 days after we take it down, or while the law requires us to keep them. One we take down is kept, out of view, for 30 days after the removal (an appeal can be made in the first 14, and that time keeps running if appeals are paused in an emergency; a takedown made during a pause can't be appealed), longer while an appeal or report is open. Its edition, its review and any appeal stay 35 days, then go, unless we must keep them longer: while a report on it is open, for 30 days after we act on a report about a child's safety or an intimate image, for 30 days after we take it down, or while the law requires it. Turning off your public profile, or our staff marking your account under 18, withdraws your stories the same way, but their records stay until the account is deleted, then 35 days. Either way, a bare record that a story existed (its number and when it was published and withdrawn, with a one-way fingerprint of the upload that can't be read back, but nothing it said or showed) stays without a set end, so its number is never used again; once your account is deleted, it no longer names you. A story hidden because your iPhone said you’re under 18 stays whole, out of view, until that clears, our staff confirm the mark, or the account is deleted.
A report you send, or the one a block files for you: what was reported, the reason, your words and, if you were signed in, your account, until it's resolved, and then 90 days, or longer while a legal hold keeps what it reports. Moderators never see who you are (unless you name yourself in your report's words or a removal request), only whether you were signed in and whether your account is new; the service keeps your account with the report so one person cannot report the same thing over and over, and so reports from signed-in accounts, most of all those whose recommendations our curators accepted, weigh more in the queue.
For an intimate-image removal request, sent to takedown@trunkhere.com or made with Report: we keep the email, with your name, contact details, good-faith statement and signature, and any authority to act for someone else, until we finish handling and answering it, then for 90 days, and then delete it, unless a child-safety preservation duty or another legal hold requires us to keep it longer. Our service keeps the report and its number, never the request's words. Our service also keeps the request's record (its number, when it came, what was removed or why not, never its words or who sent it) for as long as Trunk runs (a restore from backup loses the records of requests opened since that backup), so a request can be answered for. For an account we delete as a child's, including at an under-13 lock's deadline, the record's link to that account goes three years after the deletion.
The record of each moderation decision and its reasons, for as long as the account it concerns exists and three years after, so an appeal or a legal claim can be answered. The record of a decision that concerns no single account, such as one covering several accounts or none, is kept for as long as Trunk runs. For our staff's acts on an account's age or a parent's lock, the act, its time and who did it stay for that time, but their written reasons go when the account's deletion finishes; a hold or an unfinished cleanup delays that. For an account we delete as a child's, including at an under-13 lock's deadline, every written reason and note about it goes when its deletion finishes, unless a legal hold keeps it.
Trunk’s own record of each look at a library or a reported shared link or private collection, and of each link or collection found with a matching recorded fingerprint, for as long as Trunk runs, so a look can be answered for. For an account we delete as a child's, including at an under-13 lock's deadline, these records go three years after the deletion.
A recommendation or place correction you send our curators: until a curator decides it, then 90 days.
The record of a legal hold—the account, why, the report’s or order’s reference, and what was reported—for three years after the hold ends.
What we report to NCMEC, one year from the report, with the account it came from kept from deletion for that year.
An account the police ask us to preserve while they seek a court order: kept from deletion for up to a year.
The mark that an account belongs to someone under 18, and the keyed code for its App Store download that goes with it, until we learn the person is 18 or older, or the account's deletion finishes (a legal hold or an unfinished cleanup delays that).
After the first under-18 account to sign in with a download of Trunk is deleted, or its under-18 mark is removed, a one-way mark of that download stays, with no account and no date, used only so that another account can't take its place and lift a parent's lock on that download without our staff. It's kept while another under-18 account that signed in with that download remains, and is deleted at the next cleanup after none does.
A parent's or guardian's withdrawal of consent for a download of Trunk that reaches us before any account under 18 has signed in with it: only that download's code and the time of the withdrawal, with no account. It's deleted when an account under 18 signs in with that download (that account is then locked, unless Apple has confirmed consent again since the withdrawal), or by the first successful cleanup 12 months after the withdrawal.
That Apple told our iPhone app someone under 13 signed in to an account: until the account is deleted, or we find it isn't a child's. The under-13 lock ends then. We keep only account, actor, request and lock identifiers, the action and outcome, and the lock, action, deadline and settlement times, solely to handle retries and prevent restored backups from undoing that decision. When we find the account isn't a child's, the lock, its deadline and its report go at once, but the time the lock was cleared stays with the account until its deletion finishes, so that a restore can't bring the lock back. The sign-ins the lock ended keep the time they ended until we delete them, normally 30 days later, and the record a restore runs again keeps the lock and its end normally for up to 37 days after it's written, each at the next cleanup that succeeds; the rest of these records go normally within 37 days of the deletion or the adult finding. A person's decision about the lock is also a moderation decision, kept as those are: the act, its time and who made it while the account exists and three years after, and its written reason until the account's deletion finishes.
App Store notification receipts, which describe subscription events, are removed by the first successful cleanup after 90 days from receipt. They can outlast account deletion. A failed request to end Apple sign-in is retried; its pending record is removed on success or by the first successful cleanup after 90 days. Expiry does not mean Apple completed the request.
Email sign-in codes work for ten minutes, and a sign-in held while you choose between an existing account and a new one lasts ten minutes; expired verification records are cleared by server cleanup. A sign-in held while you give your year of birth lasts ten minutes too. A day's count of wrong codes for an email address is deleted once that day (UTC) is over, within about 25 hours. A day's count of the sign-in code emails asked for from an internet address, or sent to an email address, is deleted once that day (UTC) is over, within about 25 hours. Request logs are kept briefly. Abuse-prevention and replay-prevention records expire through their own cleanup rather than account deletion.
A security email we owe you, such as the one saying your account was deleted, keeps its address and words sealed until it's sent, normally for at most 72 hours, even after the account is deleted. If it can't be sent, only a count of that stays, with no address or words, for 30 days.
Backups of the service: our host's daily snapshots, kept five days, and at most one other copy, never older than 35 days. What you delete can remain in a backup until it ages out. If a backup is ever restored, the deletions, legal holds and removals made since it was taken are run again, holds first. Rarely, one still being saved when the backup was taken, more than 15 minutes after it began, isn't run again, so a deletion like that can come back. For now, a restore forgets the reports, suspensions and restorations made since that backup. A restore from backup also forgets blocks made since that backup, and the records of moderators' looks made since then. A change made in the last seconds before the database was lost may not be run again, so a deleted memory or account can come back, and a link taken back or switched off then can open again. The service keeps a sealed record of each change it would run again: the kind of change and a fixed reason code (or, for a purchase, a one-way code), the numbers of the account, the items and the device it concerns, and when, never names, private words or files. For an under-18 account, the record also carries the code for each download of Trunk the account signs in with, and the one-way mark of its download when the account is deleted or its under-18 mark is removed, so that a restore loses neither. It also carries the code and time of each withdrawal kept before any account under 18 signed in with its download, and the end of one when Apple has confirmed consent again, so that a restore neither loses such a withdrawal nor brings back one that ended that way. It keeps each record normally for up to 37 days after it's written, deleting it at the next cleanup that succeeds; one not yet written waits until it is.
The waitlist keeps your address until you ask for it to be deleted, or until we delete the whole list about 30 days after the launch email; until then an unsubscribed address stays marked as unsubscribed so that it stays that way. The updates list keeps your address until you unsubscribe, reply "stop" or ask us to delete it.

Ending your account, and deletion

You can delete your account in the app under Settings, Account, or on this site's Account page, in 30 days or now. In 30 days: you are signed out everywhere at once, and your public profile and stories, shared links and private collections stop being available to anyone else. Signing in before the date keeps the account and cancels the deletion; on the date, deletion goes ahead as below.

When deletion goes ahead, or at once if you choose now, account access and new opens of its shared links stop, and removal of its cloud library, shared copies, private collections, public stories and records begins. If file removal or ending Apple sign-in cannot finish because a service is unreachable, the server retries until it does, and Delete Now tells you so. The limited records and deadlines above still apply. Your memories on your devices stay. Cancel an Apple subscription separately in your Apple Account settings. While a report about one of its shared links or private collections is open, the account closes as usual, but its final deletion waits until the report is resolved. (A reported public story is kept on its own, as How long we keep things says.)

If the law requires us to keep an account, as after a report to NCMEC or a request from the police to preserve it, the account closes to its owner as usual, and its deletion finishes when that requirement ends. While a hold keeps an account, what is deleted from it is kept, but an edit can still replace a memory's earlier words: we don't yet keep every earlier version.

If we suspend your account for a serious breach of our rules, we email its addresses to say so. While it is suspended, the cloud library and collections are closed to it. You can still sign out or delete the account. Your links stop opening and your private collections close to their members until the suspension lifts, when they open again unchanged; you can still take back a link you shared. The memories on your devices stay. Ask us for a copy of your memories at help@trunkhere.com and we’ll send it, unless the law forbids it.

We will not claim more than that. Copies that are out of our reach stay where they are: files you exported or shared, and records a provider or the law requires us to keep.

Your choices and your rights

You can export everything on your devices at any time, free. A suspended account can't download its cloud library, though its owner can ask us for a copy, and neither can an account we hold after a report about a child's safety. You can delete a memory, a link, a collection or your account in the app, and your account on this site too. Ask about a look at your library at help@trunkhere.com.

When you choose Sign Out, the app can offer to remove that account's memories from the device, if its cloud library is on and running and may already hold some of them. If you choose Remove, the app first checks which memories your cloud library holds, then tries to remove those once you're signed out; the others stay. Its messages describe the removal in general terms, without listing every memory left on the device.

You can ask us to confirm what we hold about you, to see it, to correct it, to get a copy you can take elsewhere, or to delete it, and you can withdraw consent at any time. Email help@trunkhere.com from an address on your account; we may ask you to sign in to confirm it's you. We answer within 45 days, or tell you within that time why we need up to 45 more. There is no charge and no form. If we turn a request down, reply to appeal: we'll look again and answer in writing within 45 days, with our reasons, and tell you how to complain to your state's attorney general if we still say no. In the UK and EU you also have the rights to restriction, portability and objection under the GDPR, and you can complain to your supervisory authority. Where the GDPR applies, our legal basis for account data and for the cloud library you turn on is performing our contract with you, and for the waitlist it is your consent.

Children and teens

Children. Trunk is not for anyone under 13, or under the higher minimum age your country sets. On the iPhone, someone under 13 can use the app on their device only, and can’t make an account or sign in. Nothing they record is sent to us. On this site, someone whose year of birth puts them under 13 can't make an account. To tell us an account belongs to someone under 13, write to help@trunkhere.com; a person at Trunk decides. If we find that it does, we close it and begin deleting what it holds at once, without the usual 30 days, subject to the requirements under Ending your account, and deletion.

If Apple tells our iPhone app that someone under 13 signed in, we lock the account and email its addresses. Nothing is added to it while it's locked. If it belongs to an adult, reply to that email or write to help@trunkhere.com as soon as you can. Unless a person at Trunk finds by the date in that email that it belongs to an adult, we close it and begin deleting what it holds then, 14 days after the lock began; a reply alone doesn't stop that date. If we confirm sooner that it belongs to a child, deletion begins at once. The requirements under Ending your account, and deletion still apply.

What we keep after we learn an account is a child's. Our service keeps a child's information only as long as it's needed to finish deleting the account, to stop its receipts, sign-ins and links from working again, and to answer for what we did. How long we keep things gives each record and its limit. The records of our decisions about the account and of any look at its library stay three years after the deletion; from the time its deletion finishes, they carry a one-way code in place of its account number and none of our moderators' written words. After that, none of them is linked to the account. If we've made a copy of the account's summary and cloud library, our record of a look at that copy is the exception: it keeps the account number until we delete it, normally 36 days after the copy is deleted, at the next cleanup that succeeds. Mail from or about the account stays in our mailbox as ordinary mail until we delete it, and we delete it if you ask. A legal hold can keep something longer, and the hold's own record stays three years after it ends.

Teens. Publishing and the social features are for adults. If you tell us you're under 18 when you sign up on this site, or on the iPhone, or where Apple tells the app that you're under 18, publishing, a public profile and username, following, Appreciate, collections, and recommending stories or suggesting place corrections to our curators are off for you, and our service refuses them. Teens can still record, keep their library in our cloud, export it, share a memory by link, watch and save public stories, get arrival reminders, and hide, block and report. A link made while an account is marked under 18 lasts at most 30 days. If you're under 18 and live in Mississippi, Tennessee or Nebraska, you can use Trunk on your device, but you can't make an account yet. This site asks a teen who signs up here whether they live in those states, and a Yes refuses the account; the site doesn't remember the answer. The iPhone asks the same, and a Yes prevents teen sign-up and sign-in there until Apple shares a range that says you're 18 or older or, when your teen category rests on the year of birth you gave, until the year rule under How we use age allows the question again. When it rests on Apple's range, using the app under another Apple Account that Apple doesn't say is a teen's also ends it. Which state you live in isn't sent to us.

If we learn that someone who has already published is under 18, their public stories, profile and collections are taken out of view, without telling anyone else why; the private collections they made close, and they leave those they joined; if the mark came from the app or this site rather than our staff, those collections are paused instead and come back when the mark is removed. Their library keeps everything.

How we use age. When you sign up on this site, we ask for your year of birth and use it to decide your age category. If the year could put you on either side of an age limit, we use the younger age. We don't ask it when you sign in to an account you already have, and this site doesn't remember your answer. The Mac app asks no one's age.

On the iPhone, when the app asks, Apple shares an age range, not a birth date. The app uses it only to decide which features are on and to follow the law, and keeps only that decision, when it was made, which account and sign-in it was for and whether it told our service, and, on the device, a one-way mark of the Apple Account it asked under. When you sign up on the iPhone and Apple gives no age range, the app asks for your year of birth, as this site does. On the iPhone, an under-13 or teen category stays on that device until the year it must change, through Erase All Memories and reinstalling the app too; an adult answer isn't reused for a later sign-up, and when Apple gives an age range, Apple's range decides. On the iPhone we keep the category and the year it can be asked again, which can show your year of birth; that year is never sent to us.

Our service keeps one mark on an account: that it belongs to someone under 18, and whether it was set by our staff or by the app or this site. The Mac app and this site follow that mark. We use it only to keep those features off; we never show it to anyone or share it. It is removed when we learn the person is 18 or older, or when the account's deletion finishes. A record that our staff set or cleared the mark, lifted a parent's lock, or deleted an account found to be a child's, stays with our moderation records, as How long we keep things says.

When Apple tells the app that you’re under 18, the app tells our service that and sends Apple’s signed record of your download of Trunk, including its identifier, purchase date, app version and a device-verification value. From that record our service keeps only a code it can match against, so that if a parent or guardian withdraws consent through Apple we can lock, everywhere, each under-18 account that signed in with that download. We keep it linked to your account only while it’s marked under 18 (our sealed record of changes keeps it up to 37 days more); after that, only a one-way mark of the download may stay, with no account, so that it can't be used to skip a parent's lock. The sealed record of changes described under How long we keep things also holds that code for up to 37 days, so a restore from backup can't lose it. After the account is deleted, or its under-18 mark is removed, only a one-way mark of the download stays, with no account, as How long we keep things says, so that it can't be used to skip a parent's lock. If Apple tells us that a parent or guardian withdrew consent for a download of Trunk before any account under 18 signed in with it, we keep only that download's code and the time of the withdrawal, with no account, as How long we keep things says, so that an account under 18 that later signs in with that download is locked unless Apple has confirmed consent again since. While an account is locked, nothing new can be recorded or added to its library and its links stop opening; you can still play your memories, export them, sign out or delete the account. A recording made on the Apple Watch after the lock began, before the Watch learned of it, or from the iPhone's Lock Screen before Trunk on the iPhone learned of it, waits on the iPhone, out of the library and never sent to us, until that account is back with consent, or is deleted with the account or by Erase All Memories on that iPhone. A recording on the Mac that the lock stopped, including what See took during it, waits on that Mac the same way, out of the library until consent is given again, or is deleted with the account or by Erase All Memories on that Mac. A photo begun on the Mac while an account was signed in can also wait outside the library, if that account or its consent changes before it's saved; it's added only when the same account is signed in with consent, and removed if that account is deleted or you choose Erase All Memories on that Mac.

So that erasing can't undo a withdrawn consent, the iPhone keeps each account's latest consent answer, under the account's number, in this iPhone's keychain, never synced, and never restored to another device. It stays through signing out and Erase All Memories, and may stay after the app is deleted, until the iPhone learns the account was deleted; then it goes.

What we never do with a teen's data: advertise, sell or share it, build profiles from it, or use designs meant to keep them on Trunk longer.

Removing what you shared. If you're under 18, you can remove anything you've shared or published: take back a link, withdraw a public story, or delete your account. On the iPhone, take a link back in Settings, Sharing, Shared Links and withdraw a public story in Profile, Stories, Your Stories on the iPhone you published it from; on the Mac, take a link back in Account, Shared Links. For anything else, or if you can't reach those controls, write to help@trunkhere.com and we’ll remove it for you. Removing it from Trunk can't undo copies other people already saved.

Parents. A parent or guardian can write to help@trunkhere.com to ask whether their child under 13 has an account and have it deleted, or for help with a teen's account. We'll ask for enough to confirm who you are.

Where your data is processed

We are a United States company, and our server and its database are in the United States. The files you keep or share are stored by Tigris in the places named above, near where they are uploaded and opened. Apple, Google, Resend and Google Workspace handle what they do for us in the United States and other countries where they operate. So if you live outside the United States, your information is processed in the United States and can be stored in those other countries, whose laws may differ from yours; wherever it is, this policy applies to it.

If Trunk changes hands

If Chase Color, Inc. or Trunk is ever sold, merged or handed to someone else, what you keep goes with it only under these promises. We would tell you first, by email if you have an account and on this page, with time to export and delete everything before anything changes.

Changes to this policy

The date at the top is the date of the last change. Before a change that matters takes effect, we say so here and email you if you have an account. If a change would let us use what you already keep in a new way, we ask you first.