mymemoLegal
Privacy policy
mymemo holds personal notes, photos, recordings and places. This page sets out exactly what is collected, who it reaches, and what you can require of us.
1. Who is responsible
The controller of your personal data is mymemo ("we", "us").
For anything in this policy, including any request under section 7, write to support@mymemo.cloud.
2. What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| E-mail address, password (stored hashed), and — if you use Google sign-in — the identifier and e-mail address Google returns | To create and secure your account, and to send you service e-mail such as address verification and password resets | Performance of the contract, Art. 6(1)(b) GDPR |
| Your content: entries, notes, tasks, reminders, categories, subtags and saved locations | This is the service — storing what you record and showing it back to you across your devices | Performance of the contract, Art. 6(1)(b) GDPR |
| Photos, videos and files you attach | To store them against your entries | Performance of the contract, Art. 6(1)(b) GDPR |
| Voice recordings and the transcripts made from them | To turn what you say into an entry. Recording starts only from an action of yours in the app: using the record control. It never starts without microphone permission | Your consent, given through the microphone permission, Art. 6(1)(a) GDPR |
| Precise location | When you ask for it — "use my current location" in the place picker, and to attach a place to an entry. For voice capture it is also used to suggest the place you mean, unless you switch off "Use my location for voice" in the app's voice settings (on by default; see section 3). Locations you save on entries and saved places are part of your content | Your consent, given through the location permission, Art. 6(1)(a) GDPR |
| Device notification token and the language of your device | To deliver reminders you set | Performance of the contract, Art. 6(1)(b) GDPR |
| Your time zone (for example Europe/Warsaw), taken from your device or set in the web app's settings | To reset your credit allowances at your local midnight | Performance of the contract, Art. 6(1)(b) GDPR |
| Technical and usage records: sign-in attempts, error diagnostics, credit consumption, subscription and billing events, and the record of purchases | To keep the service running, to investigate faults, and to prevent abuse of the account and of paid capacity | Our legitimate interests in a secure, working service, Art. 6(1)(f) GDPR |
We do not use your content for advertising, we do not sell it, and we do not use it to train artificial-intelligence models.
Data export gives you your content (entries, notes, tasks, reminders, categories, subtags, saved locations and your attachments). It does not include account records such as sign-in history or billing events.
On your device
The app keeps a local copy of your content on your device so it works offline, including recordings and transcripts waiting to be processed. On Android, mymemo opts out of Google's device backup; your operating system's own backup features may still include app data, which we do not control. Deleting your account clears the local copy on your devices the next time they connect.
3. Automated processing
When you record a voice note, the audio is transcribed and the text is analysed to propose a structure for the entry — whether it looks like a note, a task or a cost, and which category, date, amount or place it mentions. This is a suggestion shown to you for confirmation. It produces no legal or similarly significant effect, and nothing is decided about you without your involvement.
What the analysis step receives, with the setting "Use my location for voice" (voice settings in the app; on by default):
- On: the prompt sent to Azure OpenAI includes the address your device position resolves to, up to about 10 nearby places, and up to 10 places you recently used on entries.
- Off: none of that is sent, the app does not read your position and does not ask for location permission while you capture, and our server removes any location context.
This setting does not cover everything. In both modes the analysis and the speech-to-text step also receive the names of your categories, subtags and saved places, and category aliases, which are often people's names, so they can recognise what you mention.
4. Who processes your data on our behalf
We do not sell or rent your data. It is handled by the following providers, acting on our instructions:
| Provider | What it handles | Where |
|---|---|---|
| Microsoft Azure | Application hosting, database, and file storage — your account, entries and attachments. Also telemetry (Application Insights), backups and logs, see section 6 | Database: Sweden Central (Sweden). Hosting and files: West Europe (Netherlands) |
| Azure OpenAI Service (Microsoft) | Speech-to-text and the analysis described in section 3: the audio, the transcript, and the context described in section 3 (category, subtag and place names, aliases, location if enabled) | Account in Sweden Central (Sweden). Most processing stays in the EU data zone; speech-to-text for standard voice transcription uses a global deployment, so the audio may be processed outside the EU |
| Azure Communication Services (Microsoft) | Sending service e-mail to your address: your address and the message. Delivery logs are kept in our own log workspace | European Union |
| OpenFreeMap | Vector map tiles for the in-app map. Receives the map coordinates being displayed and your device's IP address | Not publicly disclosed by the provider |
| CARTO | Raster map tiles used as a fallback when the vector map cannot be loaded. Receives the map coordinates being displayed and your device's IP address | Not publicly disclosed by the provider |
| Photon, operated by Komoot GmbH | Place search and address lookup. Receives what you type into the place search together with the centre and zoom of the area shown on the map (or the pin you chose). A place picker you have just opened may be centred on your device position, so the first search can reflect it. With no map on screen no position is sent. If "Use my location for voice" is on, voice capture also sends coordinates for address and nearby-place lookups. Also receives your IP address | Germany |
| Google (Firebase Cloud Messaging) | Delivering reminder notifications to Android devices. A reminder notification carries the task's title (shortened to about 40 characters), the task's day and time, your device token and opaque identifiers. Task notes are never sent. Other notifications, such as storage notices, use generic text | European Union and United States |
| Apple (Apple Push Notification service) | Same as above, for iOS devices; used only when notifications to iOS devices are enabled | United States and worldwide |
| Have I Been Pwned | Checking a new password against known breaches. Receives only the first five characters of a one-way hash of the password, never the password or your e-mail address, plus our server's IP address | Not publicly disclosed by the provider |
| Google (Sign-In) | Only if you choose to sign in with Google | European Union and United States |
5. Transfers outside the European Economic Area
Your account, content and attachments are stored inside the EEA. Notification delivery (Google, Apple), Google sign-in and, for standard voice transcription, Azure OpenAI's global processing may involve transfers outside the EEA, including to the United States; those are covered by the European Commission's standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.
6. How long we keep it
We keep your account and content for as long as your account exists — until you delete it. You can delete individual entries, attachments and recordings yourself at any time, and you can delete the whole account in the app or on the web: see deleting your account. Deletion starts a 7-day window in which you can cancel; when it ends the account is removed automatically, usually within 15 minutes. If you ask us by e-mail instead, we action it the same way.
After the account is removed, copies can remain for a limited time in backups: database point-in-time backups are kept for 7 days, and deleted files stay recoverable for 30 days (storage soft-delete). They are then discarded.
Other periods:
| Data | Kept |
|---|---|
| Application telemetry (requests, logs, diagnostics) | 30 days |
| Error reports (exception records) | 30 days. Error messages written to the ordinary logs follow the 30 days above |
| E-mail delivery logs (Azure Communication Services) | 30 days |
| Platform audit logs (file-deletion records, database sign-in audit) | 30 days |
| Credit and usage history | 400 days. Purchase entries are kept while your account exists |
| Subscription and billing event history | While your account exists; erased with it |
| Purchase records, anonymised (no link to you) | Kept after the account is erased, for accounting |
| File-processing records (upload events, thumbnail failures) | 90 days |
| Revoked or expired access tokens and device pairing codes | 30 days after they are revoked or expire |
| Disabled notification tokens | The token itself is dropped at once; the record is deleted after 30 days |
| Background-job records | 7 days when successful, 30 days when failed |
| Voice samples (recording, transcript and analysis result), kept for operator accounts only | Up to 30 days; removed at once when the account is deleted. Any location context in them follows the "Use my location for voice" setting |
| Data export files | Deleted after 48 hours |
7. Your rights
Under the GDPR you may:
- ask what we hold about you, and get a copy;
- have inaccurate data corrected;
- have your data erased;
- have our processing restricted while a dispute is resolved;
- receive your data in a portable format;
- object to processing we carry out on the basis of legitimate interests;
- withdraw consent — for the microphone or for location — at any time, in your device settings. Withdrawing it does not affect what was done beforehand.
To exercise any of these, write to support@mymemo.cloud.
You also have the right to complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa.
8. Security
Data is encrypted in transit between the app and our service, and is encrypted at rest by our hosting provider. Passwords are stored only as hashes and cannot be read back by us. Access to production systems is limited to those who need it.
No service can promise perfect security. If a breach affects your data and poses a high risk to you, we will tell you.
9. Children
mymemo is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has given us their data, write to us and we will remove it.
10. Changes
If this policy changes in a way that matters, we will update the date below and, where the change is significant, tell you in the app or by e-mail.
Last updated: 2 November 2026