privacy.

we keep the email address you leave, so we can write when there’s room. that’s the only thing we use it for.

we also keep a scrambled code made from your internet address. it lets the form notice a flood of sign-ups from one place in an hour. it’s only readable with a secret we keep, and we use it for nothing else.

want off the list? write to hello@memberberries.app and we’ll delete it.

your account: your email address, the name you choose, your time zone, and, if you add them, your birthday and how you’re related to the bunch. other members see your name, not your email address.

if you sign in with google or apple: they tell us your email address, an id for your account with them, and your name if they share it. apple can give us a forwarding address instead of your own. if you use apple, we also keep a token apple gives us, only so we can tell apple to end the link when you delete your account.

your password, if you set one: Supabase, which handles sign-in, keeps a scrambled copy that can’t be turned back into your password. we never see it, store it or log it. a sign-in link works without one.

what you keep: words, photos, videos, voice notes, links, tags, hearts and notes, your answers to the weekly question, who each memory is about, who it’s for, and when it happened. it’s private, but it’s still kept — that’s the point.

photos and place: photos are kept as the files they were, so any date and place your camera stored in them stays in the file, and anyone who can see the memory can download it. when you bring photos in from an iphone’s library, we also save that place on the memory. android doesn’t share it with the app, so photos picked in the android app come in without a place, in the file or on the memory. we never ask for your phone’s location and never follow where you go. the smaller copies we make for the timeline carry no place.

how you use it: which days you opened memberberries. the owners of a bunch you’re in can see how many days each member opened it that month, and how many memories each kept. nobody sees what you looked at. the phone app also remembers which months of your photos you’ve been through.

on your device: a memory you haven’t kept yet is saved on that phone or browser, so a dropped connection doesn’t lose your words. signing out clears it, and so does deleting your account there.

email: sign-in links, password resets, invitations you send, the saturday question and the weekly digest. you can turn the weekly ones off in settings.

only the people you choose for each memory. that rule lives in the database itself, so every page and every photo asks it before showing anything. a scheduled memory stays hidden from its audience until its day, unless you also shared it more widely. being in a memory never lets anyone see it.

it’s sent over an encrypted connection and stored encrypted by the companies below (if your bunch uses its own storage, that part is up to whoever runs it). it isn’t end-to-end encrypted: the people who run memberberries can reach the database to keep it working. we don’t read your record.

one exception. if someone reports a concern, the person handling it sees what was reported — the thing the reporter chose to send, and nothing else in the bunch. owners don’t see reports. if a report involves a child’s safety, we may keep that memory out of view and preserved, even from you, for as long as the law asks.

when you report a concern, we keep the reason, anything you wrote, and what you chose to send, so we can answer. after a report is closed and the 30 days to ask us again have passed, we can remove what was sent and keep a note that the report happened.

when you block someone, we keep that you did, so the block works in every bunch you share. if we close an account for breaking the house rules, we keep its email address so it can’t come back.

before you add anything, we keep a note of which version of the agreement and this page you agreed to, and when.

if you connect google photos, we ask for one permission: to see the photos you pick in google’s own picker. we can’t see the rest of your library. that access lasts about an hour and is kept, locked, in your browser, not in our database. we copy only the photos you choose to bring in. google doesn’t send where a photo was taken, so those come in with a date and no place.

MemberBerries’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Vercel hosts the website. Supabase holds the database and handles sign-in. Cloudflare stores the photos, unless your bunch chose its own storage — then whoever runs that storage can see the files and a list of which memory each belongs to, but not your words. Supabase and Resend send our email. Google and Apple confirm who you are if you sign in with them, and Google is involved if you connect google photos. each of them handles your information only to do its part of running memberberries. most of it is stored in the united states.

no analytics, no ads, no crash trackers, nothing in the app that reports to anyone else.

download everything, any time, from settings: your words in plain JSON and your photos as the files they were.

delete a memory and it disappears for everyone at once. it’s erased for good, files and all, 30 days later. the gap is there so a mistake can be undone.

to delete your account, open settings and choose “delete your account,” or start from memberberries.app/account-deletion. before anything goes, it shows what will happen in each bunch you’re in.

memories only you could see, your drafts, and memories you deleted are erased, files and all. for memories you shared, you choose: take them with you, and they’re erased too, or leave them with the bunch, signed “someone.” a name, a face or a story in one can still say who kept it. if you look after a bunch with other people in it, you choose who looks after it next; if you don’t, it goes to the grown-up who’s been there longest. if you’re the last one in a bunch, the bunch and everything in it is erased.

your sign-in, profile, settings, hearts and notes go too. if you signed in with apple, we tell apple to end the link. if we can’t, you can end it yourself in your apple id settings, under sign in with apple. it happens at once. a photo already open on someone’s screen can keep showing for up to an hour. a file that was still uploading is swept up within two days; until then we keep a bare record of the deletion, with no name or email, so we know what to sweep. a memory kept for a child-safety report stays preserved until that’s done.

we don’t keep backups of your data. once something is erased, we can’t bring it back.

accounts are for grown-ups: you need to be 18 to join. kids are in the record as people a memory is about. they don’t get a login. for each child you add, we keep their name, birthday, how you’re related, a few words about them if you write some, and a photo if you give one. the people in that bunch can see them.

we don’t knowingly collect information from a child under 13. if you think a child has an account, write to hello@memberberries.app.

only the ones that keep you signed in, and, if you connect google photos, two short-lived ones for that hour of access. no tracking, no analytics, no advertising cookies.

we’ll change the date at the top, and if it matters, we’ll email the people who use memberberries before it takes effect. you’ll see it again before you add anything new.

questions, a copy of what we hold about you, or a correction: hello@memberberries.app. a child’s safety: childsafety@memberberries.app. the agreement is at terms, and help is at support.