Privacy Policy

Last updated: June 2026

Memory4Me is a personal memory log run by AkiCreative. This policy describes what we collect, how it's used, and how it's stored. The short version: we collect the minimum we need to run the service for you, we don't sell anything, and your memories are yours.

What we collect

• Account info. Your name, your email, and optionally a hashed password. You can sign in with a password or with a one-time email link; passwords are not required.
• Bot connection. The Telegram chat ID you pair to your account so our single shared bot (@Memory4MeBot) can deliver replies to the right person. Pairing happens via a short, expiring code; we don't store your Telegram username or profile data.
• Memories. The text, photos, and AI-parsed metadata you save via the bot or the web dashboard. The free-text body of every memory (your raw text, the AI-generated summary, and the free-form structured blob) is encrypted at rest with AES-256 using a key that lives only on our application server.
• Billing. If you become a member, Stripe stores your payment details; we don't. Through Laravel Cashier we store your Stripe customer ID, membership status, and limited card metadata Stripe returns to us (card brand, last four digits). A membership is required past the free trial because every memory runs through Google Gemini, which has a per-request cost.
• Logs. Minimal server logs (timestamp, route, response code) for debugging and abuse prevention. Sensitive request fields (passwords, tokens, API keys) are stripped before any log line is written.

What we do with it

• Run the app: show you your memories, your dashboard, your people.
• Send your text to Google Gemini for AI parsing (category, entity, location, people, rating, sentiment). Read Google's privacy policy for what they do with API inputs.
• Send your memory data to Telegram when our bot delivers a reply to the chat you paired. Telegram is a transport; they see anything your bot sends or receives.
• Send transactional email through Resend. Currently only one-time sign-in links and (later) membership receipts.
• Charge memberships and run the billing portal through Stripe.

What we don't do

• We don't sell or share your data with advertisers.
• We don't read your memories. Staff can technically decrypt the database to fix bugs or restore data, but we don't browse it.
• We don't share your data between users. Every Memory4Me account is isolated; your memories, your people, your photos are scoped to your row.
• We don't use your memories to train AI models.
• We don't track you across sites.

Where it's stored, how it's protected

Memory4Me is hosted in the United States. Photos are stored in S3-compatible object storage. Database backups are encrypted at rest.

The free-text body of each memory (the raw text you wrote, the AI summary, and the free-form structured blob) is encrypted at rest with AES-256 using a key that lives only on our application server. Someone who steals just the database cannot read your memories. AI-extracted structured fields (category, location, people, tags, ratings) stay plaintext so that the dashboard, filters, and search keep working. These are the labels, not the content.

This protects against database-level breaches and backup leaks. It does not protect against a full server compromise (where the attacker has the application key) or against Google Gemini seeing the text we send for parsing. If you wouldn't tell it to a stranger, don't put it in Memory4Me.

Sign-in

We default to magic-link sign-in: you enter your email, we send a one-time link valid for 15 minutes that signs you in on click. The link is a server-signed URL; tampering with it returns a 403. Sends are rate-limited to 3 per email per 5 minutes. We never reveal whether an email is registered; unknown addresses get the same "check your inbox" message.

You can also set a password and sign in with that instead. Passwords are stored as bcrypt hashes, never in plaintext.

Your data

Export everything you've saved as a CSV from Settings → Profile → Your data. One row per memory, encrypted entries decrypted for you, photos listed as URLs you can download separately. No request needed, no waiting.

Delete individual memories from the web dashboard or via the bot. To delete your entire account and everything in it, email hello@memory4.me from the address on your account. We'll remove your row and all associated memories, people, and assets. The Stripe customer record gets a deletion request too.

Cookies and analytics

We use first-party session cookies for login (required) and CSRF protection (required).

The public landing page only (memory4.me/) loads Google Analytics (GA4) to help us understand how visitors find the site. Google Analytics sets its own cookies and may collect your IP address, browser, device, and referrer. It runs on the marketing page exclusively: once you sign in, the dashboard and the rest of the app load no analytics or tracking scripts. Read Google's privacy policy for what they do with that data, or block the script with any standard ad/tracker blocker if you prefer.

Changes

If we materially change this policy, we'll email registered users. Trivial wording fixes won't trigger an email.

Contact

Questions? hello@memory4.me