The promise

What we can see.

Your iPhone records, transcribes and reads your memories on the device. Nothing you record is sent anywhere to be transcribed. This page says what changes when you keep your memories in Trunk's cloud or share them, and what we can see then.

If you keep everything on your device

If you do not keep memories in the cloud, share a link or publish a story, the app does not upload your memories. It talks to Apple for speech models, purchases and maps, and to us each time it opens and whenever you watch public stories, look up a place or get an arrival reminder, with or without an account; once you sign in, also for what you keep in the cloud or share. None of this sends your recordings to be transcribed. No account is needed to record, transcribe, search, play or export.

Recording, transcription, the words read from photos, the choice of the frames kept from a video, titles and summaries happen on the device, with its own models; no video is uploaded to choose its frames. The app runs no analytics. If you choose Apple or Google sign-in, that provider handles the sign-in.

This describes the app's own transfers to us, not copies you choose to share or export, the phone's own iCloud or computer backup, or the iCloud Drive copy of your videos. Those device backups can include your memories, video files too, under your Apple settings, and with Copy Videos to iCloud Drive on, the videos in your library that Trunk hasn't already saved to a folder, and each new one, are also copied to a Trunk folder in your own iCloud Drive. Memories already in the cloud library stay there when you sign out or pause syncing.

If you keep your memories in the cloud

The cloud library holds what you keep in it: titles, words, transcripts, summaries, folders, audio, photos and the frames taken from video. Video files stay on the device that made them, and Export includes them. The cloud library comes free with your account, with fair use of about 100 GB, and you turn it on in Settings, Cloud Library. It is encrypted on the way and where it is kept; our providers hold the keys for storage, not you, so our service can read it, and does, to run Trunk: to sync it, search it for you, make the links and collections you ask for, and keep it safe.

There are no keys, recovery codes or device approvals for you to keep or lose. On a new iPhone, sign in and turn on the cloud library, and your memories come to it. If you kept the earlier encrypted backup, it moves into the cloud library once, from a device that still holds its key.

Who looks

The people who run Trunk never look at your library unless you ask for help or the law compels it. Every such look is recorded with its reason and reference, and the record is sent to you on request (help@trunkhere.com), unless the law forbids telling you, and then as soon as it allows.

What you share is different: when a shared link or a private collection is reported to us as illegal or abusive, we look at what was shared, and nothing else of your library.

What we can see

The server uses your sign-in and device details to sign you in, keep Pro current and keep your devices in sync. They include sign-in identifiers, device names and which device changed a memory. Subscription records include Apple's purchase, renewal and refund history.

If you share a memory by link, we keep a copy of it as it was, which anyone with the link can open until it expires or you take it back, and we count how many times it is opened. The copy is made on your phone: photos without location or camera details, the recording made playable, and no video. There is no key in the link.

A private collection is shared only with you and the people you invite by username, except when it is reported to us as illegal or abusive: then we look at what was shared, and nothing else of your library. We keep who may read it. If you create a public profile, we can read the name, username and biography you submit for it. Your private memories stay separate.

What becomes public

Publishing is a separate, deliberate act that needs your sign-in and a review: automated tools may approve clear cases, and uncertain ones go to a person. A public edition never carries its private original, your other memories, the exact spot it was recorded or later edits by itself; it names an area, never a spot, and says whether where it was made is confirmed. What we can see of public stories is the edition, the public profile, the chosen place, collection membership, follows, appreciation, recommendations and place corrections you send, appeals, hides, blocks and reports.

A public story is its key frames and audio, its photos, or its text. The frames move gently and change in time with the recording, more like a moving album than a video. No video is published or hosted.

Discover shows the places with public stories on a map, the stories near a place you choose, newest first, and Spotlight: stories, collections and creators our curators choose by hand, in their order, the same for everyone apart from any you can't open, with who picked each, when and why. There is no feed, no ranking, no algorithmic picks, no personalization and no language model. When you're signed in, the apps' requests for stories, a place's stories included, carry your sign-in; their requests for places and the map never do. We keep nothing about what you watch, skip or save. Requests for authors carry your sign-in too, so the service can answer them. The apps send no viewing signals, and we keep no viewing history or preference profile; what the service held of them before is being removed. Your follows, hides, blocks, reports and appreciation stay.

What we do not do

• We never advertise with your memories, sell them or train AI on them. We run no analytics and no trackers, and sell nothing about you.
• We never look at your library unless you ask for help or the law compels it, and every such look is recorded.
• We rank nothing and keep no profile of what you like. Discover shows the newest stories near the place you choose.
• We never put privacy behind Pro. Export and the app lock are free, and you can always leave with everything as files, without an account.

What we never say

We never say “never leaves your phone” of what you keep in the cloud, “end-to-end encrypted” or “we can't read it” of the cloud library, or “anonymous”, and nothing here should suggest that other people will not know they are being recorded. The phone shows that it is recording; telling people is on you.

Deleting

Deleting a memory puts it in Recently Deleted for 30 days. With the cloud library on, the change reaches other devices when they sync. After 30 days, the app erases it when it next runs; Erase Now skips that wait; while Pause Syncing is on, an iPhone also waits to erase the memory itself until syncing resumes or you choose Erase Now. Once the cloud library receives the purge, its next cleanup removes the files kept there. Records of which files were deleted and when can remain so devices know what to remove.

A shared link stops new opens when it expires or you take it back; cleanup removes the copy. Copies already opened or saved cannot be recalled. How sharing by link works.

You can delete your account in the app under Settings, Account, or on this site's Account page, in 30 days or now. In 30 days: you are signed out everywhere at once, and your public profile and stories, shared links and private collections stop being available to anyone else. Signing in before the date keeps the account and cancels the deletion; on the date, deletion goes ahead as below. When deletion goes ahead, or at once if you choose now, account access and new opens of its shared links stop, and removal of its cloud library, shared copies, private collections, public stories and records begins. If file removal or ending Apple sign-in cannot finish because a service is unreachable, the app says so and the server retries. Your memories on your devices stay. The privacy policy's retention section explains the limited records that can outlast deletion.

See also the privacy policy, which is the legal document, and the terms.