1. Introduction

At MemoryLane, we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you use our app and services.

2. What Data We Collect

We collect, but are not limited to, the following types of personal data:

• Account details (name, email address, profile picture)
• Waitlist data (email address, if you join our launch waitlist on our website)
• Contact form data (name, email address, message content, and hCaptcha verification data)
• Memory content (text, images, audio and videos you upload only for the duration of transfer)
• Technical data (device type, IP address)

3. Children's Privacy

MemoryLane is not intended for users under the age of 13. We do not knowingly collect personal data from children under this age. If you believe a child has provided us with personal data, please contact us at [email protected], and we will take appropriate action.

4. How We Use Your Data

We use your information to:

• Provide and personalize MemoryLane's experience
• Enhance app features and security
• Communicate updates and support
• Analyze trends and improve user experience
• Ensure the security and integrity of our platform

5. Data Retention & Deletion

We retain your data for as long as your account is active or as needed to provide services. If you delete your account, your personal profile and account information will be permanently removed from our servers.

Important note about shared memories: When you share memories (photos, videos, messages) with other users, those recipients retain access to the content you shared with them, even if you later delete your account. Shared content will be disassociated from your personal profile but will remain visible to the recipients.

Retention periods: Account data is retained for as long as your account is active. After account deletion, your personal profile and account information are removed from our servers within 30 days. Waitlist emails are kept until the waitlist closes or you withdraw your consent and request deletion. Contact form messages are retained only as long as necessary to respond to and resolve your inquiry. Technical data (such as IP addresses and device type) is deleted or anonymized after 14 days, unless a longer retention period is required by law or necessary to investigate security incidents.

To request complete data deletion or export your data, contact us at [email protected].

6. Data Sharing & Third Parties

We do not sell your data. We only share it with:

• Service providers: Google LLC (Firebase: authentication, cloud storage and real-time database, used to operate the app and facilitate the transfer of memories), our web hosting provider, and our email delivery service (Mailgun), which routes messages you send to us
• Security providers: hCaptcha (Intuition Machines, Inc.), which verifies that website visitors are human
• Infrastructure: Cloudflare, Inc., which provides content delivery, DNS and DDoS protection for our website
• Analytics: Plausible Analytics, used to measure website usage in a privacy-friendly, cookieless way
• Legal authorities (if required by law)
• Other users (only when you explicitly share memories)

These providers act as data processors on our behalf. Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards (such as Standard Contractual Clauses) to protect your data.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized or unlawful processing, accidental loss, destruction, or damage.

8. Device Permissions

To provide our services, MemoryLane may request access to the following device features:

• Camera: To capture photos and videos for your memories
• Photo Library: To save memories to your Library
• Microphone: To record audio for video content
• Notifications: To alert you about new memories and app updates
• Storage: To save and cache your memories locally

You can manage these permissions in your device settings at any time.

9. Your Rights (GDPR)

Under GDPR and other privacy laws, you have the right to:

• Access, edit, or delete your data
• Withdraw consent at any time
• Request data portability (receive your data in a structured format)
• Object to data processing
• File a complaint with a data protection supervisory authority. For users in Germany, the competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)

10. Legal Basis & Data Controller

Data Controller: MemoryLane is operated by Gustav Schöndube, Neuer Weg 3, 15306 Vierlinden, Germany, who is the data controller responsible for your personal information. For privacy inquiries, contact us at [email protected].

Legal Basis for Processing: We process your data based on:

• Contractual Necessity: To provide the services you requested
• Legitimate Interest: To improve our app and ensure security
• Consent: For optional features (you can withdraw at any time)
• Legal Obligation: When required by law

11. Cookies & Tracking

Our website only uses necessary cookies. We do not use advertising or tracking cookies, and we do not require consent for any third-party tracking.

hCaptcha: We use the hCaptcha security service (provided by Intuition Machines, Inc.) on our website to check whether user actions (such as submitting a contact form) meet our security requirements. To do this, hCaptcha analyzes the behavior of the visitor based on various characteristics, such as IP address, time spent on the page, and mouse movements. To keep your browsing cookie-free, the hCaptcha service is only loaded when you submit our contact form. The data collected during the analysis is forwarded to hCaptcha, which acts as a data processor on our behalf. This processing is based on Art. 6(1)(b) and Art. 6(1)(f) GDPR — our legitimate interest in protecting our service from abusive automated crawling, spam, and other forms of abuse. For more information, see hCaptcha's Privacy Policy and Terms of Service.

Analytics: We use Plausible Analytics on our website. Plausible is a privacy-friendly, cookieless analytics tool that does not collect personal data and does not require consent under the GDPR.

12. Updates to This Policy

We may update this Privacy Policy from time to time. You will be notified of any significant changes via email or in-app notification at least 30 days before the changes take effect. If a change requires your consent under applicable law, we will obtain it separately. If you do not agree with the updated policy, you may delete your account and stop using the service before the changes take effect.

13. Contact Us

For questions or to exercise your privacy rights, contact us at [email protected].