Privacy

The short version

We collect what we need to run your account and keep your todos in step on your devices. Nothing more.
We do not sell your information. We show no advertising and do not track you across other companies’ apps or websites.
Your todos belong to your account. You can download them, and you can delete the account.
Your data is stored with Amazon Web Services in Mumbai, India.

Who we are

Memoratu is operated by Subendran RV, Coimbatore, Tamil Nadu, India.

Questions about privacy: support@memoratu.com.

What we collect in the Memoratu app, and why

This covers the iPhone, Mac and web apps, and the command-line tool.

Account details. Your email address, your name, and a password. The password is never stored: we keep only a one-way scrambled form of it (Argon2id), which cannot be turned back into the password. We use these to create and secure your account.
Your time zone. Sent when you sign up, so that “today” means your today.
Your content. Your projects, lists and todos, any images you attach to a todo, your Now cards, your settings and preferences, and the activity log of changes inside your account. We use it to show it back to you, on every device you sign in on, and to the people you choose to share with.
Your devices. Each time you sign in, we keep a session with a device name (the name your app gives, or a short label made from the browser or app that connected), when it was created, and when it was last used. We use this so you can see where you are signed in and sign any of them out.
Notifications inside the app. Messages the app shows you, for example when someone shares a project with you. They are kept for 30 days and then removed.
How you found us. If you arrive from a link that carries a campaign code, we keep that code, any campaign tags on the link, the website the link came from, and the page you landed on, once, with your sign-up. We use it to learn which of our own posts and links bring people in. No IP address is part of this.
Emails we send you. We send the mail the account needs: verifying your address, deletion codes, sharing invitations, and billing notices when payments are switched on. We do not send marketing email unless you subscribed to the newsletter below.

Technical logs and your IP address

Our servers write one line per request: the page asked for, the result, how long it took, and the name of the app or browser. We do not store IP addresses in our logs or our database. The log carries only a scrambled stand-in for the address that is created with a random key, replaced every day at midnight UTC and never written down, so it cannot be turned back into your address. It lets us see that one caller made thousands of requests in a day; the next day it is a different value. Request contents, passwords and access tokens are not logged.

To stop abuse, your address is held in the server’s memory for a short time to count how often you try something (for example, signing in). It is not stored.

How we use it

To run your account, sync your todos, send the mail described above, keep the service secure and fair, work out which of our own links bring people to Memoratu, and answer you when you write to us. We do not use your todos for advertising, and we do not train AI on them.

We do not sell your information and we do not share it for advertising. We do not track you across other companies’ apps and websites. Memoratu uses no third-party advertising or tracking tools.

People you choose. When you share a project, the people you invite can see what is in it. A shared project can lose work if the other person deletes their account.
Amazon Web Services stores and processes your data for us, in the Mumbai region, and sends our email through its email service. It acts on our instructions.
Apple and Google, where you use notifications that reach you outside the app, deliver them to your device. The notification text passes through their services.
Apple and Google take payment for subscriptions bought in the iPhone or Android app. They handle your payment details; we never see your card number.
The law. We will disclose information only where the law requires it.

Our support team can look inside your account only when you grant access, for a limited time, and every look is logged. You can end that access whenever you like.

Where your data is kept

On servers run by Amazon Web Services in the Mumbai (ap-south-1) region, India. If you use Memoratu from outside India, your information is sent to India to be stored.

How long we keep it

While your account is open, we keep your content so it can sync and so you can get it back.
When you delete a todo, list or project, it is first marked as deleted, so that your other devices learn about it. It is permanently erased 30 days after you delete it.
Backups of our database are kept for 35 days and then removed. Something erased from the live service can therefore remain in a backup for up to 35 days, and is never restored into your account once you have deleted it.
Notifications in the app are removed after 30 days.
Sessions end when you sign out or they expire.
Server logs hold no IP address and no content (see above).

Your choices: download and delete

Download your data. You can ask the service for a copy of your own data: your profile, settings, projects, lists, todos, images, devices and billing records, as one file. It never contains passwords, access tokens or other people’s details. It can be requested a limited number of times a day.

Delete your account. When you ask to delete an account, there is a 24-hour window. During it you can still sign in and cancel. After it closes, the content of the account is deleted, including todos the account had shared into other people’s accounts. Deleting an account does not delete the people invited to it. Today, ask by email: write to support@memoratu.com with the subject “Delete my account”. In the app, Profile → Delete account arrives in the next app update. The steps, and what is deleted and when, are on our Delete your account page.

Delete you. You can also have your own sign-in identity deleted. Your email address is then erased from our records. To stop the same address being used to start unlimited free accounts, we keep a one-way fingerprint of it, from which the address cannot be recovered.

Everything else: to correct or ask about your information, write to support@memoratu.com from the address you signed up with.

Children

Memoratu is for people aged 13 and over. It is not made for, or directed at, children under 13. We do not knowingly collect information from anyone under 13, and if we learn that we have, we will delete that account and its data. If you believe a child under 13 has an account, write to support@memoratu.com.

Security

Connections are encrypted. Passwords are stored only as scrambled forms. Access tokens are stored the same way. Every rule about who can see what is enforced on our server, not in the app. No system is perfectly safe, and we cannot promise it.

This website

memoratu.com is a set of static pages. It sets no cookies, runs no advertising, and loads no scripts, fonts or images from anyone else. We do not run analytics today. If we add measurement later, it will be cookieless, and this page will say exactly what it records before it goes live.

The JavaScript on the site is ours and runs in your browser. It opens and closes the menu on a phone. On the newsletter form it writes the address of the page you are on into the form, and, if the link you followed carried a campaign code (?c=), that code too, so we know which page or post people subscribe from. On our documentation pages it steps you through a tutorial, copies a command when you click copy, and keeps the step you have reached in your browser’s sessionStorage for that one tab, so a reload does not lose your place.

The site is available in several languages. If you choose a language from the language menu, your choice is remembered in your browser’s localStorage, under the name memoratu-lang, so the home page can offer it to you next time. On the home page only, if you have made that choice, or if your browser says it prefers one of those languages, a small bar asks whether you would like to view the site in it. If you close the bar, that is remembered the same way. Neither value is ever sent to us or to anyone else, and the site never moves you to another language by itself. That is everything the JavaScript does.

Our hosting provider keeps ordinary server logs, as every web host does.

If you subscribe, we keep your email address, the page you subscribed from, any campaign code, which version of the sign-up wording you agreed to, and when you subscribed and confirmed.

You confirm first. We send one email with a confirmation button. Nothing else is sent until you press it.
Unconfirmed sign-ups are erased after 7 days.
Every email has a one-click unsubscribe link. When you unsubscribe, your address is erased. We keep only a one-way fingerprint of it, which cannot be turned back into the address, so that we never email it again by mistake.
If an email bounces permanently, or is marked as spam, we stop emailing that address for good.
Your address is not shown to our team. Inside our admin tool every subscriber appears as a numbered id. Only people the account owner has given that specific permission can see an address, and each time they do it is recorded.
The emails come from news@memoratu.com and are delivered for us by Amazon Web Services.
When you submit the form, your IP address is used for a short time, in memory only, to stop the form being abused. It is not stored.

Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and tell signed-in users in the app or by email before the change takes effect.

Contact

Write to support@memoratu.com.