Privacy policy

What you give us:

• Account data: your name, username and previous usernames, email address, password (stored hashed so that it can't be recovered), your confirmation that you meet the minimum age, and your acceptance of the terms and when.
• Profile: photo, cover image, bio, city and interests.
• Preferences: language, theme, button side, your device's time zone, and privacy and notification settings.
• Your content: memories and moments, photos, titles and text, dates, the places you choose, drafts, comments, reactions and ratings, and links between your memories and others'.
• Connections: who you follow and who follows you, follow requests, who you block or mute, and places you follow.
• What you send us: reports, takedown requests, appeals and their attachments.

What we get from others: if you sign in with Google, we receive your name, email address and photo from it. Others may mention you in their content or link their memories to yours, according to your settings.

What is collected automatically:

• An essential cookie that keeps you signed in, and one that remembers your language.
• Your IP address: we use it momentarily to prevent abuse (such as repeated sign-in attempts) and don't store it in our database, but our hosting provider keeps standard server logs that include it for a limited period.
• Aggregate usage statistics (such as how many memories are published) that don't include who you are or what you wrote, through Vercel Analytics without cookies.
• If you turn on notifications on a device: the push subscription address your browser gives us.

Photo metadata: when you pick photos, your device reads when and where they were taken to suggest the moment's date and place. The location is not sent as part of the photo, and the photo is stored re-encoded without its metadata. What we keep is the date and place you choose.

• To provide the Service: creating your account, showing your content to whom you choose, the timeline, maps, search and notifications.
• To contact you: email confirmation, password reset and important notices, and the weekly digest if you turn it on.
• Safety and moderation: preventing fraud, spam and abuse, reviewing reports and enforcing the terms.
• Improving the Service: using aggregate statistics that don't identify you.
• Complying with the law, and answering requests from competent judicial or official authorities.

We don't sell your personal data, show ads, or build profiles of you for advertising.

We process your data under Egypt's Personal Data Protection Law No. 151 of 2020 and its executive regulations, on the basis of: the consent you give when signing up and when turning on optional features (which you can withdraw at any time without affecting what came before); the processing being necessary to provide the Service you asked for; our legal obligations; and our legitimate interest in protecting the Service and its users.

• Public content and your public profile: anyone, even without an account, and search engines may index them.
• Followers-only content: only followers you accept. If your account is private, only your accepted followers see any of it.
• Private content: no one else within the Service.
• Your email address isn't shown to anyone else.
• Our moderation team may view any content, including private content, when reviewing a report or violation or under a legal obligation, and that access is logged.

We use providers who process data on our behalf, on our instructions and only as far as needed. Currently:

• Vercel: hosting and aggregate statistics.
• Prisma Postgres: the database.
• Cloudinary: photo storage and processing.
• Resend: sending email.
• Geoapify (and Mapbox where used): place search; it receives the search text and coordinates.
• OpenFreeMap, OpenStreetMap data and Amazon's terrain servers: your browser loads map tiles from them directly, so they receive your IP address.
• Google: if you choose to sign in with Google.
• Your browser's push service (for example Google's, Apple's or Mozilla's): if you turn on notifications.

Some of these providers may store or process data in countries outside the Arab Republic of Egypt, including the United States and countries of the European Union. We choose providers that commit to reasonable levels of protection, and by agreeing to this policy you agree to this transfer.

We don't disclose your data to anyone beyond those above except: with your consent; to meet a legal obligation, a court order or a request from a competent official authority; to protect our rights or anyone's safety, or to investigate a violation; or if the Service is transferred to another party bound by this policy.

• We keep your data as long as your account exists.
• When you delete your account, your content disappears at once and we erase it permanently after 30 days. Removing photos from storage and backups may take a limited extra time.
• When you delete a moment or photo, we delete it and remove its file from storage.
• We may keep the minimum data needed for longer where the law requires it, to settle a dispute, to stop a banned account from returning, or as records of moderation decisions.
• Your comments and reactions on others' content are deleted with your account.

You have the right to know what we hold about you, get a copy of it, correct it, delete it, withdraw your consent, and object to or ask us to restrict processing, within the limits set by law. Most of this you can do yourself:

• Download a copy of your data, and delete your account: from Settings.
• Edit your profile, preferences and each moment's privacy: from Settings and from each moment.
• Block, mute and sign out of every session: from Settings.

For any other request: the request form. We may ask for proof of identity before acting on it. You also have the right to complain to Egypt's Personal Data Protection Center.

We use essential cookies only: to keep you signed in and to remember your language. Your browser also stores some preferences locally (such as theme and button side) and drafts you haven't published yet. We don't use advertising or cross-site tracking cookies.

We take reasonable technical and organisational measures to protect your data, including encrypted connections, hashed passwords, and two-step verification for the moderation team's access. But no system is completely secure, and we can't guarantee the security of data absolutely. If a breach affects your data, we will act and notify those we must, as the law requires.

The Service is not meant for anyone under 16, and we don't knowingly collect their data. If we learn an account belongs to someone under that age, we delete it. If you are a parent or guardian and believe your child has created an account, contact us.

We may change this policy, update the "Last updated" date at the top of this page, and announce material changes on the Service before they take effect.

For any question about your privacy: the request form.