Privacy

Momento is a diary you share a moment at a time. A moment you keep private can be read by you and by nobody else; a public moment can be read by anyone, and you can make it private again whenever you like. The choice is on every page, one tap. Momento has no advertising, no analytics and no trackers. It keeps what it needs to be your diary, and nothing it keeps is sold or used for anything but being your diary. The companies that touch any of it are named below, and what each one sees.

Naming a place. When you add a place to a page, Momento can ask the phone where you are and put a name to it — a neighbourhood and a city. That happens on the phone, with the phone's own maps: the coordinates are never sent to Momento or to anyone else, and only the name you keep is saved on the page, as part of what you wrote. You can type a place instead, and you can refuse the permission; nothing else changes.

Google Cloud (Firebase) hosts the diary: the server runs and the database sits in Google's Belgium region, in the European Union, under Google's data-processing terms. Google holds the bytes; it does not read them for its own ends.

Apple and Google confirm who you are when you sign in, and take the payment when you buy. A purchase is confirmed with the store that took it — Momento's server asks Apple or Google whether the receipt is real, and keeps the store's reference for it — and nothing else changes hands: no card, no name, no moment. What they keep about a sign-in or a purchase is under their own privacy terms.

Every moment you have not made public. Its words, its mood, its place, its photos. They are stored on Momento’s server so that they follow you between phones, and the server hands them back only to a request carrying your own session. Nothing reads them: no moderation, no filter, no person. Photos in a private moment are exactly as private as the moment — they are served only to you, through the same door.

Your email address, if the provider handed one over when you signed in. Apple does so once and may give a private relay address instead; Google gives the address on the account. It is shown back to you in Settings so you know which account you used, and it is used for nothing else — it is never shown beside anything public, never sold, never given to anyone, and nothing is sent to it. Momento does not send email.

Who you follow and who you have blocked. Blocking is private: the person is never told, and no count of anything is shown to anyone. Following is visible on your page, the way it is on any social product.

A moment you have made public: its words, mood, place, photos and the day it is about, together with your name, handle and profile picture. It appears on your page, in the feeds of the people who follow you, in the Everyone feed, and on a page at a link anyone with the link can open. That page carries a preview so the link shows the moment where it is shared.

You are told this before you make one public, and you can make it private again at any time: it leaves every feed at once and its link stops working within a few minutes, which is how long a copy may sit at the edge of the network. A thing that has been public cannot be made never to have been public — anyone who saw it, and any service that fetched the link, keeps their own copy. Do not make public anything you would not put on a postcard, and nothing about somebody else that they have not agreed to.

Your name, handle, bio and profile picture are public, and so are the counts on your page. People can find you by typing the start of your handle.

You sign in with Apple or with Google. Momento receives an identity token, checks it against the provider’s own keys, and keeps: which provider you used, a one-way hash of the provider’s identifier for you (which is your account id), and your email address if the provider handed one over. The name Apple or Google supplies is used as a first guess at your name, which you can change. Only the name and email scopes are ever asked for — no contacts, no photos, nothing else from either account. With Apple, Momento also keeps a token Apple issues for the app, for one purpose: when you delete your account it is sent back to Apple to revoke Momento's access, so your Apple ID stops listing the app.

A session is a signed token kept in your phone’s keychain. Sign out and it is deleted; delete your account and every session stops working.

Momento is not for children. You must be 13 to have an account, 16 where the law says so, and Momento does not knowingly keep anything from anyone younger. If you believe a child has an account, write to the address below: the account and everything in it is deleted.

Photos are resized on your phone before they are uploaded, and their location data and other metadata are removed in the process — the server receives pixels and a size, nothing about where or with what the picture was taken. Momento only ever reads the photos you choose; it does not scan your library.

Public moments, names and bios are checked for the unmistakable — slurs, threats, content about children — at the moment they are made public, and refused if they match. Private moments are never checked. Anything reported is read by a person and acted on within 24 hours. When a public moment is taken down for breaking the Terms, the account that posted it is recorded as ejected, which turns all its public moments private and prevents any further public posting; its private diary is untouched.

Your IP address is used in memory, briefly, to stop one machine flooding the server. It is never written to the database and does not survive a restart.

There are no analytics. Momento does not know which screens you open, how long you write, or how often you come back.

Ordinary visitors to a shared link are set no cookies.

When you write to us from inside the app, Momento keeps what you typed, the moment you sent it, the word the app used to say which screen you wrote from, your account id, and the email address you gave if you gave one — otherwise the one on your account, so that an answer is possible. It is used to answer that message and for nothing else.

Settings → Delete my account removes your account, every moment, every photo, your likes, your follows, your blocks, your shelf and your handle, immediately. Messages you sent through the box are kept, with the account id and the reply address struck from them. Apple and Google keep the record of a purchase, as they must. Nothing needs to be requested by email, though fatihturker35@gmail.com will do it too.

If something on Momento is about you and is not yours — somebody has made public something you did not agree to — write to the address below. A person reads it, those requests are taken seriously, and they are honoured where the law requires it.

From inside the app: Settings → “Write to us”. From anywhere: fatihturker35@gmail.com. A person reads both.