Privacy Policy

1. Introduction

Memento (“we,” “our,” or “us”) operates the Memento application and website located at mementosite.me (collectively, the “Service”). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you access or use our Service. By using the Service, you consent to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide

• Account Registration: Email address and a cryptographically hashed password (Argon2id). We never store or have access to your plaintext password.
• Profile Information: Optional display name and avatar that you choose to provide.
• Support Communications: Information you provide when contacting us for support, including your email and the content of your message.

2.2 Encrypted User Content

User content — including notes, vault items, AI prompts, and attachments — is encrypted on your device using XChaCha20-Poly1305 before transmission to our servers. We store that content only as ciphertext. Some information is stored unencrypted so the Service can organize it: note titles, tags, folder names, vault item names and field labels, prompt titles and descriptions, attachment file names and sizes, saved links, and notes created by email or the browser extension. Under our zero-knowledge architecture, we do not possess the cryptographic keys necessary to decrypt your content and therefore cannot access, read, or process it.

2.3 Automatically Collected Information

• Device Information: Browser type, operating system, and device type for compatibility and debugging purposes.
• Log Data: IP address, access timestamps, and referring URLs. Log data is retained for a maximum of 90 days and is used solely for security monitoring and abuse prevention.
• Usage Analytics: Anonymized, aggregated feature usage metrics (e.g., number of notes created, sync frequency). These metrics cannot be linked to individual users or their content.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Contract Performance: Processing necessary to provide the Service you requested (Article 6(1)(b) GDPR).
• Legitimate Interests: Security monitoring, fraud prevention, and service improvement, where our interests do not override your fundamental rights (Article 6(1)(f) GDPR).
• Consent: Where you have given explicit consent for specific processing activities, such as optional marketing communications (Article 6(1)(a) GDPR).
• Legal Obligation: Where processing is required to comply with applicable law (Article 6(1)(c) GDPR).

4. How We Use Your Information

• To provide, operate, and maintain the Service
• To authenticate your identity and secure your account
• To synchronize your encrypted data across your authorized devices
• To send essential transactional communications (password resets, security alerts, account verification)
• To detect, prevent, and respond to security incidents, fraud, and abuse
• To improve the Service based on anonymized, aggregated usage patterns
• To comply with legal obligations and respond to lawful requests

5. Zero-Knowledge Encryption Architecture

Memento employs a zero-knowledge encryption model. Encryption keys are generated locally on your device and are never transmitted to or stored on our servers in unencrypted form. Notes, vault items, AI prompts, and attachments are encrypted client-side using XChaCha20-Poly1305 with unique per-item nonces before any network transmission occurs.

As a consequence of this architecture, we have no technical capability to decrypt, access, or recover your content. If you lose access to your device encryption keys and have not configured backup recovery keys, your encrypted data will be permanently inaccessible.

6. Data Sharing and Disclosure

We do not sell, rent, trade, or otherwise share your personal information with third parties for their marketing purposes. We may disclose information only in the following limited circumstances:

• Service Providers: Trusted third-party vendors who assist in operating the Service (e.g., hosting, email delivery), bound by contractual data protection obligations.
• Legal Requirements: When required by law, regulation, legal process, or enforceable governmental request.
• Safety and Rights: To protect the rights, property, or safety of Memento, our users, or the public, as required or permitted by law.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with prior notice to affected users.

Due to our zero-knowledge architecture, even in the event of a lawful data request, we can only provide encrypted ciphertext and account metadata — never the plaintext content of your notes, vault items, or other encrypted data.

7. Data Retention

• Account Data: Retained for the duration of your active account.
• Encrypted Content: Retained until you delete it or delete your account.
• Server Logs: Automatically purged after 90 days.
• Account Deletion: Upon account deletion, all associated data (account information, encrypted content, and metadata) is permanently and irreversibly removed from our servers within 30 days.
• Backup Retention: Encrypted backups in our backup system are purged within 30 days of account deletion.

8. Cookies and Tracking Technologies

We use strictly necessary cookies only. These include authentication session tokens and CSRF protection tokens required for the secure operation of the Service. We do not use advertising cookies, tracking pixels, social media widgets, or third-party analytics services that track individual users.

9. Security Measures

We implement industry-standard security measures, including:

• XChaCha20-Poly1305 client-side encryption for notes, vault items, prompts, and attachments
• Argon2id password hashing with per-user salts
• TLS 1.2+ encryption for all data in transit
• Rate limiting and brute-force protection on authentication endpoints
• Strict Content Security Policy (CSP) and security headers

While no system can guarantee absolute security, our zero-knowledge architecture ensures that even in the unlikely event of a server breach, your content remains encrypted and inaccessible without your device keys.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms.

11. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate personal data.
• Right to Erasure: Request deletion of your personal data and account.
• Right to Data Portability: Export your data in standard, machine-readable formats (JSON, Markdown).
• Right to Restrict Processing: Request limitation of processing in certain circumstances.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, please reach out to us using the contact details provided at the end of this policy. We will respond within 30 days (or sooner as required by applicable law).

12. Children's Privacy

The Service is not directed to children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information promptly.

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete it, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your California privacy rights, please reach out using the contact details at the end of this policy.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting the updated policy on our website with a revised "Last Updated" date and, where appropriate, by sending an email notification. Your continued use of the Service after such changes constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: