Privacy Policy
This Privacy Policy explains how Olexandr Khodarev, doing business as MyMemora (“MyMemora”, “we”, “us”, “our”) collects, uses, stores and shares personal data when you use the MyMemora website at https://mymemora.net, the MyMemora mobile and desktop apps and any related services that link to this Privacy Policy (together, the “Services”).
MyMemora is a private photo and video storage service for individuals and families. You can upload, organise and view your photos and videos, create personal and shared family albums, relive moments with automatically generated “Memories”, and share selected albums, files or memories via private links. Optional smart features include search by content, grouping photos by people, finding duplicates and cleaning up unsuccessful shots.
We are the controller of your personal data. If you have any questions, contact us at privacy@mymemora.net.
SUMMARY OF KEY POINTS
- Your photos and videos are yours. We process them only to provide the Services to you and to the people you choose to share them with.
- No advertising, no tracking, no selling of data. We do not use analytics or advertising cookies, we do not buy data from data brokers and we never sell or rent your personal data.
- AI runs on our own servers. All smart features run on servers we operate in the European Union. Your photos, videos and face data are never sent to third-party AI providers and are never used to train AI models.
- You are in control. You can turn off all AI processing at any time. Grouping photos by people (face recognition) is used only with your explicit consent.
- Stored in the EU and encrypted. Your files are stored in data centres in the European Union and are encrypted at rest.
- Take it with you or delete it. You can download your whole archive and delete your account at any time.
TABLE OF CONTENTS
- WHO WE ARE
- WHAT PERSONAL DATA DO WE COLLECT?
- HOW DO WE USE YOUR DATA AND ON WHAT LEGAL BASIS?
- SMART FEATURES AND ARTIFICIAL INTELLIGENCE
- FACE GROUPING AND BIOMETRIC DATA
- FAMILY ARCHIVES, PARTNER ACCESS AND SHARED LINKS
- WHO DO WE SHARE YOUR DATA WITH?
- INTERNATIONAL DATA TRANSFERS
- COOKIES AND SIMILAR TECHNOLOGIES
- MOBILE AND DESKTOP APPS
- HOW LONG DO WE KEEP YOUR DATA?
- HOW DO WE KEEP YOUR DATA SAFE?
- WHAT ARE YOUR PRIVACY RIGHTS?
- CHILDREN
- AUTOMATED DECISIONS AND DO-NOT-TRACK
- CHANGES TO THIS PRIVACY POLICY
- HOW CAN YOU CONTACT US?
1. WHO WE ARE
The Services are operated by Olexandr Khodarev, doing business as MyMemora, Odesa 65000, Ukraine. We are responsible for deciding how and why your personal data is processed (the “controller”).
Because we offer the Services to people in the European Economic Area (EEA), the United Kingdom and Switzerland, we process personal data in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection and the Law of Ukraine “On Personal Data Protection”, as applicable.
2. WHAT PERSONAL DATA DO WE COLLECT?
Data you provide to us
- Account data: email address, username or display name, password (stored only as a secure hash), interface language and your settings (for example, whether AI features are enabled).
- Sign in with Apple or Google: if you choose to register or sign in this way, we receive a unique account identifier from the provider, your email address (with Apple this may be a private relay address) and, if you allow it, your name. We never receive your Apple or Google password, contacts or friends lists.
- Your content: photos, videos and audio tracks you upload (for example, music for Memories), albums, titles, descriptions, favourites, edits and other information you add.
- Family and sharing data: families you create or join, invitations, roles and permissions, partner access you grant, and shared links you create (including their settings such as expiry date, password protection and download permission).
- Communications: messages you send to our support, privacy or abuse addresses, including your email address and any attachments.
- Subscription data (when paid plans are offered): your plan, subscription status, country and transaction identifiers. Payments are processed by Apple, Google or our payment provider; we never receive your full card details.
Data derived from your content
To provide the Services, our servers automatically create the following from the files you upload:
- File metadata: information embedded in your files, such as the date and time of capture, camera or device model, orientation, file name, size and, if present, GPS location. Location is used to show your photos on a map and to find place names; place names are looked up on our own servers.
- Previews and copies: thumbnails, previews in several sizes and video versions optimised for streaming.
- Technical fingerprints: file checksums and perceptual image hashes used to avoid storing the same file twice and to find duplicates.
- AI results (unless you turn AI off): numerical descriptions of image content (“embeddings”) used for search, tags and categories, quality scores used to suggest unsuccessful shots, and automatically generated Memories. See section 4.
- Face data (only with your explicit consent): see section 5.
Data collected automatically
- Security and usage data: IP address, date and time of sign-ins and other security-relevant events (for example, account deletion), and failed sign-in attempts.
- Technical data: browser or app type and version, operating system, and server logs containing the requested address, time, response status and user agent.
- Device data (apps): a push notification token and the platform of your device, so that we can send you notifications.
- Search queries: text you type into search, which we process on our own servers to find matching photos (including automatic translation of the query).
Data about other people
Your photos and videos may show other people, including family members and children. You upload such content for your own personal or family purposes and you are responsible for having the right to do so (see our Terms of Service). People who open a shared link are not required to have an account; we process their IP address only to deliver the content and protect the link from abuse.
What we do not collect
We do not collect data about you from data brokers, marketing partners or social networks, we do not build advertising profiles and we do not track you across other websites or apps.
3. HOW DO WE USE YOUR DATA AND ON WHAT LEGAL BASIS?
We process personal data only where we have a legal basis under the GDPR:
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and managing your account, signing you in | Account data, sign-in provider data, security data | Performance of a contract (Art. 6(1)(b) GDPR) |
| Storing, organising, displaying, syncing and streaming your content, creating previews and video versions | Your content, file metadata | Performance of a contract |
| Family archives, partner access and shared links | Your content, account and family data | Performance of a contract |
| Smart features: search by content, tags and categories, map, Memories, duplicate detection, cleanup suggestions, translation | Your content, file metadata, AI results, search queries | Performance of a contract (features you can switch off at any time) |
| Grouping photos by people (face recognition) | Face data | Your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR) |
| Push notifications (for example, a Memory video is ready or you were invited to a family) | Push token, account data | Performance of a contract; you can disable notifications in your device settings |
| Service messages, such as security notices and changes to our Terms or this Privacy Policy | Email address, push token | Performance of a contract; legal obligation (Art. 6(1)(c) GDPR) |
| Keeping the Services secure, preventing fraud, spam and abuse, limiting excessive requests | Security data, technical data | Legitimate interests in protecting our users and the Services (Art. 6(1)(f) GDPR) |
| Handling reports of illegal content and enforcing our Terms of Service | Reported content, account data, communications | Legal obligation; legitimate interests |
| Answering your requests and providing support | Communications, account data | Performance of a contract; legitimate interests |
| Recording which versions of our Terms of Service and Privacy Policy you accepted | Account data, date, IP address | Legal obligation; legitimate interests in proving consent |
| Managing subscriptions and keeping accounting records (when paid plans are offered) | Subscription data | Performance of a contract; legal obligation |
| Complying with the law, responding to lawful requests from authorities, establishing or defending legal claims | Data relevant to the specific case | Legal obligation; legitimate interests |
We do not use your personal data for advertising or marketing profiling. Where we rely on legitimate interests, you have the right to object (see section 13). Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal.
4. SMART FEATURES AND ARTIFICIAL INTELLIGENCE
MyMemora uses machine learning to help you organise your library:
- Search by content: find photos by describing what is in them;
- Tags, categories and mood: automatic labels chosen from a fixed list;
- Duplicates and cleanup: finding identical or very similar photos and suggesting blurry, dark or accidental shots, which you can review before anything is moved to the trash;
- Memories: automatically generated collections and videos;
- Translation: translating the interface and your search queries;
- Grouping by people: only with your explicit consent (see section 5).
How it works. All AI processing runs exclusively on servers we operate in the European Union, using models hosted by us. Your photos, videos, search queries and face data are never sent to third-party AI providers and are never used to train or improve AI models.
Accuracy. Automatic tags, groupings and suggestions may be incomplete or wrong. They are only used to organise your library and never lead to decisions about you.
How to turn it off. You can turn off all AI processing for your personal archive at any time in Settings → Use AI on the website or in the app. When AI is off, we stop analysing your content with AI and stop showing AI results for your archive. Family archives have a separate setting, managed by family members with the corresponding permission.
5. FACE GROUPING AND BIOMETRIC DATA
If you enable grouping photos by people, our servers detect faces in your photos and create numerical face templates that allow similar faces to be grouped together into “People”, which you can then name. Face templates are biometric data, a special category of personal data under the GDPR.
- Consent. We process face data only with your explicit consent, which you give by enabling this feature. For a family archive, the feature is enabled by a family member with the corresponding permission, who confirms that the family has agreed to it.
- Limited purpose. Face data is used only to group photos within your own library or within the family archive where the photos are stored. It is never compared with other users’ libraries, never used to identify anyone outside the Services and never shared with third parties.
- People in your photos. Photos may show people who do not use MyMemora. Please only enable face grouping for content where you have the right to do so, and respect the wishes of the people shown.
- Withdrawing consent. You can turn the feature off at any time. We then stop processing face data and delete the face templates and groupings from our active systems within 30 days.
6. FAMILY ARCHIVES, PARTNER ACCESS AND SHARED LINKS
Family archives
When you create or join a family, the content in the family archive is visible to its members according to the roles and permissions set in that family. Family members with the corresponding permissions can view, download, edit, share or delete family content, manage members and change family settings, including AI settings. Content added to a family archive uses the family’s storage.
Content you add to a family archive remains part of that archive if you leave the family or delete your account. If you want content you added to be removed, delete it before leaving (where your permissions allow) or ask a family administrator. Content in your personal archive is not affected by family settings.
Partner access
You can give another MyMemora user read-only access to your personal library. You can revoke this access at any time.
Shared links
You can create links to selected albums, files or memories. Anyone who has the link can view the shared content, and download it if you allow downloads, until you revoke the link or it expires. You can protect a link with a password and an expiry date. People who receive a link may save or forward the content. Original files may contain metadata such as the date and location of capture, so please think before sharing.
7. WHO DO WE SHARE YOUR DATA WITH?
We do not sell, rent or trade your personal data. We share it only in the following cases.
Service providers
We use a small number of providers who process data on our behalf, under contracts that require them to protect it and use it only as we instruct:
| Provider | Service | Data | Location |
|---|---|---|---|
| Hetzner Online GmbH (Germany) | Servers and object storage that host the Services | All data stored in the Services (files are encrypted at rest) | European Union (Germany, Finland) |
| Cloudflare, Inc. (USA) | Domain name services and delivery of emails sent to @mymemora.net addresses | Emails you send us, technical connection data | Global network, including the USA |
| Google (Google Ireland Ltd / Google LLC) | Email mailbox for support correspondence; Firebase Cloud Messaging for push notifications | Emails you send us; push token and notification content | EU and USA |
| Apple (Apple Distribution International Ltd / Apple Inc.) | Apple Push Notification service for notifications on Apple devices | Push token and notification content | EU and USA |
We keep notification content short and avoid including your photos or other sensitive details in it.
Sign-in and payment providers
If you sign in with Apple or Google, or buy a subscription through the App Store, Google Play or our payment provider, that company processes your data as an independent controller under its own privacy policy. We receive only the information described in section 2.
Content loaded from third parties on our website
To display parts of our website, your browser connects directly to the following third-party services, which receive your IP address and technical browser data when you open the relevant pages: Google Fonts (fonts), the jsDelivr and unpkg content delivery networks (scripts and icons) and OpenStreetMap tile servers (map images on the map page). These providers do not receive your photos or account data.
Other users and people you share with
Content and information you share through family archives, partner access or shared links are visible to the people you share them with, as described in section 6.
Authorities and legal requirements
We may disclose personal data if required by applicable law, a court order or a valid request from a competent authority, or where necessary to protect the rights, property or safety of our users, the public or us. We review each request, disclose only what is legally required and, where the law allows, inform the affected user. Where required by law, we report child sexual abuse material to the competent authorities.
Business transfers
If the Services are sold, merged or transferred, personal data may be transferred to the new operator, who will be bound by this Privacy Policy or will inform you of any changes in advance.
8. INTERNATIONAL DATA TRANSFERS
Your files and account data are stored on servers in the European Union. The Services are administered from Ukraine. Some of the service providers listed in section 7 may process limited data outside the EEA, for example in the USA. In those cases we rely on an adequacy decision of the European Commission (such as the EU–U.S. Data Privacy Framework, where the provider is certified) or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can request more information about these safeguards by contacting us.
9. COOKIES AND SIMILAR TECHNOLOGIES
Our website uses only strictly necessary cookies that are required for the Services to work. We do not use analytics, advertising or social media tracking cookies, so we do not ask for cookie consent.
| Cookie | Purpose | Duration |
|---|---|---|
| advanced-frontend | Keeps you signed in during your visit (session) | Until you close the browser or sign out |
| _identity-frontend | Keeps you signed in if you choose to be remembered | Until you sign out or it expires |
| _csrf-frontend | Protects forms against cross-site request forgery | Session |
| hg_lang | Remembers the language you chose before signing in | Until you change it or clear cookies |
The apps store a sign-in token and your preferences on your device for the same purposes. You can delete cookies in your browser settings, but you will then need to sign in again.
10. MOBILE AND DESKTOP APPS
- Photo library access. The mobile app asks for access to your photos and videos so that you can upload them and, if you turn it on, back them up automatically. Only the files you choose, or the files covered by the backup settings you enable, are uploaded.
- Notifications. The app asks for permission to send notifications. You can turn notifications off at any time in your device settings.
- Downloads. When you download files or archives, they are saved on your device and are then under your control.
11. HOW LONG DO WE KEEP YOUR DATA?
We keep personal data only as long as necessary for the purposes described in this Privacy Policy:
| Data | Retention period |
|---|---|
| Account data and settings | While your account exists |
| Content in your personal archive, its previews, metadata and AI results | Until you delete it or delete your account |
| Files you delete | Kept in the trash for 30 days so you can restore them, then permanently deleted; you can empty the trash earlier |
| Content in a family archive | While the family archive exists, until deleted by an authorised family member |
| Face templates and groupings | Until you turn face grouping off or delete the related content; then deleted within 30 days |
| Shared links | Until you revoke them, they expire or the shared content is deleted |
| Archive exports (ZIP files you request) | 7 days after they are ready |
| Security logs (sign-in IP addresses and events) | Up to 12 months |
| Server logs | Up to 30 days |
| Support, privacy and abuse correspondence | Up to 2 years after the matter is closed |
| Records of accepted Terms of Service and Privacy Policy versions | For as long as needed to prove acceptance; after account deletion kept only in a form that no longer contains your IP address |
| Subscription and accounting records (when paid plans are offered) | As long as required by tax and accounting laws |
| Encrypted backups | Up to 14 days, after which they are automatically overwritten |
Account deletion. You can delete your account at any time in the website or app settings. When you do, we permanently delete your personal archive, including all photos and videos, together with its previews, metadata and AI results. Content you added to family archives remains available to those families (see section 6). Limited account data may remain in encrypted backups for up to 14 days; backups are used only for disaster recovery and are never used to restore deleted accounts.
We may keep specific data for longer where we are legally required to do so or where it is necessary to establish, exercise or defend legal claims, for example when content has been reported to us as illegal.
12. HOW DO WE KEEP YOUR DATA SAFE?
We use appropriate technical and organisational measures to protect your personal data, including:
- encrypted connections (HTTPS/TLS) between your device and our servers;
- encryption of stored files at rest;
- passwords stored only as secure hashes;
- strict access controls that check permissions for every file, family archive and shared link;
- protection against brute-force attacks and excessive requests;
- regular updates and restricted administrative access to our servers.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, you, in accordance with applicable law. We recommend keeping your own copies of photos and videos that are important to you.
13. WHAT ARE YOUR PRIVACY RIGHTS?
Subject to applicable law, you have the right to:
- access your personal data and receive a copy of it;
- rectify inaccurate or incomplete data;
- erase your data (“right to be forgotten”);
- restrict the processing of your data;
- object to processing based on our legitimate interests;
- data portability: receive your content in a structured, commonly used format;
- withdraw consent at any time, for example by turning off face grouping or AI features;
- lodge a complaint with a data protection supervisory authority.
How to exercise your rights. Many rights can be exercised directly in the Services: change your account details in your profile, turn AI features off in Settings, download your whole archive as ZIP files with Export archive, and delete your account in Settings. For anything else, email privacy@mymemora.net. We may ask you to confirm your identity. We respond within one month; this period may be extended by two further months for complex requests, in which case we will tell you why. Exercising your rights is free of charge.
Supervisory authorities. If you are in the EEA, you can complain to the data protection authority of your country of residence, work or of the place of an alleged infringement. In the United Kingdom, you can contact the Information Commissioner’s Office (ico.org.uk). In Switzerland, you can contact the Federal Data Protection and Information Commissioner (FDPIC). In Ukraine, you can contact the Ukrainian Parliament Commissioner for Human Rights. We would appreciate the chance to address your concerns first, so please contact us before filing a complaint.
14. CHILDREN
The Services are intended for people aged 18 or older, and we do not knowingly allow children to create accounts. If we learn that an account belongs to a child, we will delete it. If you believe a child has created an account, please contact us at privacy@mymemora.net.
Parents and guardians may store photos and videos of their children in their personal or family archives. They are responsible for this content and for decisions about sharing it and about enabling face grouping for it.
15. AUTOMATED DECISIONS AND DO-NOT-TRACK
We do not make decisions that produce legal effects concerning you or similarly significantly affect you based solely on automated processing. Our AI features only help organise your library.
We do not track you across third-party websites and do not use tracking technologies, so “Do Not Track” browser signals do not change how we process your data.
16. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time. Each version has a version number and an effective date shown at the top of this page, and previous versions remain available on this website.
If we make material changes, for example new purposes of processing, new categories of data or new recipients, we will inform you in advance through the website and the apps and, where appropriate, by push notification or email, at least 30 days before the changes take effect. If a change requires your consent, we will ask for it and will not apply the change to you without it.
17. HOW CAN YOU CONTACT US?
If you have questions about this Privacy Policy or how we process your personal data, contact us:
- Privacy requests: privacy@mymemora.net
- General support: support@mymemora.net
- Reports of illegal content or abuse: abuse@mymemora.net
- Post: Olexandr Khodarev (MyMemora), Odesa 65000, Ukraine
Our Terms of Service describe the rules for using the Services.