Privacy Policy

This is the whole list, taken from what the application actually saves:

• Account — your email address, a bcrypt hash of your password (never the password), your first and last name if you gave them, and your sign-up date.
• Profile — display name, phone number and avatar, if you fill them in.
• Your work — designs and emails, their names, and whether each is shared. Small documents live in our database; larger ones are written to private object storage that is not readable from the web.
• Uploads — images you upload, with their filename, type and size. These are stored in object storage behind a public but unguessable URL.
• Connected AI providers — which provider and model you chose, and your API key encrypted at rest. We keep a masked preview so you can tell which key is which.
• Connected social accounts — the access tokens needed to publish on your behalf, if you connect one.
• Usage counts — how many times each feature has been used by your account.

We do not sell your data. We do not use your designs to train models. We do not send marketing email you did not ask for, and there is no advertising tracking in the app.

We do run Google Analytics to see which pages get used. It records the pages you visit, a rough location from your IP address, and your browser and device — it does not see your designs or anything you type into them.

• Object storage — an S3-compatible provider holds uploaded images and offloaded documents.
• Email delivery — verification, password reset and design-share messages go through our mail provider, which sees the recipient address and the message.
• AI providers — only when you use an AI feature, and only to the provider whose key you connected. Their terms govern what happens next.
• Stock libraries — searching stock imagery sends your search term to whichever of Unsplash, Pexels or Pixabay you are browsing. The request goes through our server, so they do not see your address or your account.
• Google — Analytics receives page views as described above, and signing in with Google exchanges your email, name and profile picture with them.
• Sentry — when something in the app breaks, the error and the page it happened on are sent to our error tracker so we can fix it. Your designs, your uploads and your session token are never part of that report.

To confirm: Name the specific providers you use, and the country each stores data in. If you have users in the UK or EU you also need a lawful basis, a data-processing agreement with each provider, and a named contact — that is a conversation with counsel, not a paragraph.

Your work stays until you delete it or close your account. Deleting a design removes its stored document; files in your Uploads library survive that on purpose, because they are yours and may be used elsewhere. Closing your account removes everything, including the files, and cannot be undone.

• See it — Settings has an export: one JSON file with your profile, every design and a list of your uploads.
• Correct it — your profile is editable at any time.
• Remove it — delete individual designs and uploads, or close the account entirely from Settings.
• Cut off access — disconnect an AI provider or a social account, or end every open session, from Settings.

Passwords are hashed with bcrypt and never stored or logged in the clear. AI keys are encrypted at rest. Sessions use signed tokens that you can invalidate everywhere from Settings, and changing your password ends every other session automatically. Sign-in, registration and password-reset requests are rate limited.

No system is perfect. If you find a security problem, please report it before disclosing it publicly.

Your session is kept in your browser's own storage rather than in a cookie, and there are no advertising cookies. Google Analytics sets its own cookies to tell repeat visits apart.

Memo Editor is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will remove it.

We will announce material changes in the app before they take effect. The date at the top of this page always reflects the current version.