The promise
What we can see.
Your iPhone records, transcribes and reads your memories on the device. Nothing you record is sent anywhere to be transcribed. This page says what changes when you turn on backup or share by link, and what we can see then.
Without backup or shared links
If you do not turn on backup or make a shared link, the app does not upload your memories. It talks to Apple for speech models and purchases, and to us if you sign in.
Recording, transcription, the words read from photos, titles and summaries happen on the device, with the phone's own models. The app runs no analytics. If you choose Apple or Google sign-in, that provider handles the sign-in.
This describes the app's own transfers, not copies you choose to share or export, or the phone's own iCloud or computer backup. Those device backups can include your memories under your Apple settings; video files are left out. A Pro backup made earlier is not removed by signing out or pausing backup.
If you turn on backup
Your private memories are encrypted on your device before backup. The key stays with you, never on our servers. We can't listen to or read them.
Each memory is sealed on your iPhone with a key of its own, and that key is sealed with your account key. The account key is made on your iPhone and kept in your Apple keychain, which carries it to your other devices through iCloud Keychain. For memory content, the server stores ciphertext with no key that can open it. If anyone made us hand over what we hold, they would get encrypted files no one can open, and the little we can see.
What we can see
We also say, plainly: we can see your email or Apple relay address and which sign-in you used, your subscription and its history with Apple, the devices you signed in from and when, how many encrypted memories and files you have, their sizes, and when they were made, changed or deleted, and the IP addresses your devices connect from. From a file's size we can guess a recording's length. We cannot see titles, words, pictures or sound.
The server uses those details to sign you in, keep Pro current and keep your devices in sync. They include sign-in identifiers, device names, which device changed a memory and which sealed files belong together. Subscription records include Apple's purchase, renewal and refund history. The files themselves are ciphertext, with no title, words, audio or picture we can read.
If you share a memory by link, we hold the encrypted copy and can see its id and owner, its size, when it was made and when it expires, whether it was taken back, and how many times it was fetched. We never see the key.
What becomes public
Only the edition you choose to publish becomes public. Anyone, including us, can view it. You can take it down, but copies others saved can't be recalled.
Publishing is a separate, deliberate act that needs your sign-in and a review by a person. A public edition never carries its private original, your other memories, the exact spot it was recorded or later edits by itself; it names an area, never a spot, and says whether where it was made is confirmed. What we can see of public stories is the edition, the public profile, the chosen place, collection membership, follows, reactions and reports, and the disclosed viewing counts; private recordings never feed public recommendations.
What we cannot do
- We cannot open your memories, listen to them or search their contents. If we were made to hand over what we hold, it would be sealed files and the account, subscription, device and file details described above. We hold no key that can open those files.
- We cannot recover a backup for you if every device is lost, iCloud Keychain is off and you kept no recovery code. Nobody can. The app offers the recovery code to everyone who turns backup on, and says this at the time.
- We do not use your content for advertising or training. We run no analytics and no trackers, and sell nothing about you.
What we never say
We never say “never leaves your phone” about backup, “we can recover your data”, or “anonymous”, and nothing here should suggest that other people will not know they are being recorded. The phone shows that it is recording; telling people is on you.
Deleting
Deleting a memory puts it in Recently Deleted for 30 days. With backup on, the change reaches other devices when they sync. After 30 days, the app erases it when it next runs; Erase Now skips that wait. Once the server receives the purge, its next cleanup removes the sealed files. Records of which files were deleted and when can remain so devices know what to remove.
A shared link stops new opens when it expires or you take it back; cleanup removes the sealed copy. Copies already opened or saved cannot be recalled. How sharing by link works.
Deleting your account removes account access, stops new opens of its shared links and starts removal of its backup, shared copies and records. Work a provider cannot finish immediately is retried. Your memories on the phone stay. The privacy policy's retention section explains the limited records that can outlast deletion.