Privacy Policy

Last updated: 2026-09-30

Memofu (“we”, “us”) is a private pet memory and health-log service. Privacy is not a feature of Memofu — it is the product. This policy explains what we collect, why, and the choices you have.

What we collect

• Account data: email address, display name, and locale, used to operate your account.
• Your content: the photos, videos, health records, and notes you add. Health records include the medication doses and daily care entries (such as meals, walks and potty breaks) your family logs, each with the family member who recorded it. Your content stays private to your care circle; there is no public feed.
• Usage data: a small set of product events (for example, “a post was created”) used only to improve the service. Inside the Memofu app these events are recorded in our own database and are also sent to PostHog, our product-analytics provider, on servers in Virginia, United States — see Analytics in the Memofu app. On this website we also use Google Analytics 4 and Microsoft Clarity, which are on by default and which you can turn off at any time — see Analytics on this website. We never use advertising or cross-site trackers, and we never link what you do in Memofu with data any other company holds about you.
• Crash reports: when the Memofu app or our server runs into an error, a report goes to Sentry, our error-monitoring provider, on servers in the United States. It says what went wrong and where in our code, and includes your device model, operating-system version and app version, and a short trail of the app’s most recent steps. Before a report leaves, we remove every link or code that could open your data, the parameters of every web address, and the identifiers of your circle, your pets and your photos — and a report is never tied to your Memofu account. Reports from the app do carry a random identifier that Sentry’s crash-reporting software generates on your device for each installation of the app. It is not your Memofu user id and is never linked to your account; it lets us count how many devices a problem affects. The app also sends it at the start and end of each session, noting whether the session ended in a crash, so we can see how often the app crashes. Reinstalling the app replaces it with a new one — though on Android the old one can come back if the app is restored from a device backup. Like any internet service, Sentry sees the IP address a report from the app is sent from.
• Support messages: when you contact us, we keep your message and email address so we can reply. Your IP address is used only to limit repeated messages and is deleted automatically within three days.

Launch waitlist (closed): before the app launched, you could leave your email address in a form on our home page. We closed that form when the iPhone app launched and no longer collect addresses. If you left one, it stays in our database (hosted by Supabase, listed below) together with the language of the page, the phone you chose (if you chose one), the page you reached the form from (our home page, or an invitation or pairing link), the version of the wording you agreed to, and when you signed up (and when you last sent the form again, if you did). We use it only for the launch note the form promised, never for anything else, and send nothing until we can send it the way the law requires. Even then, we first send one message, with no advertising, asking you to confirm the address, and send the note only to confirmed addresses. We delete it 30 days after that note, and in any case one year after you signed up: if the note never goes out, the address is deleted unused. To have it deleted sooner, ask us through the support page and we will delete it. While the form was open, your IP address and a short one-way code made from your email address were used only to limit repeated sign-ups; they are deleted automatically within three days.

What we never do

• We never sell your personal data.
• We never show advertising.
• We never make your content public.
• We strip photo GPS location data on your device before upload.

Analytics on this website

This section is about memofu.com only. The Memofu app has its own analytics, described in Analytics in the Memofu app. None of the tools below ever run on a private share page (/v/…), an invite page, or a widget-pairing page.

These tools are on by default. You can turn them off for this browser at any time using the control below, and doing so deletes our identifiers immediately.

The events we record are: which pages you viewed, clicks on calls to action and store badges, clicks on links leaving this site, how far down a page you scrolled, whether an article was read through, and how quickly the page loaded and responded for you. We never record what you type, and none of it is connected to a Memofu account — this website has no sign-in.

The random identifier is generated in your browser, is never shared with anyone else, and is deleted the moment you turn analytics off. It identifies a browser, not a person, but we treat it as personal data all the same. If you are in the EU, the UK or Switzerland and would rather not be measured at all, the control below is the switch — and your browser’s own tracking protection or an ad blocker will also stop these scripts from loading.

Google Consent Mode v2 is configured so that every advertising signal — ad_storage, ad_user_data and ad_personalization — stays denied permanently. We do not advertise and do not intend to.

Analytics in the Memofu app

The Memofu app records a small, fixed list of product events — things like “the app was opened”, “a post was created”, “a weight was recorded”, “the paywall was shown”. Each event carries its name, when it happened, your Memofu user id (once you have signed in), a random identifier the app creates for your installation, a random identifier for the app session, and details of your device: its platform, manufacturer and model, operating-system version, screen size and time zone, whether it is an emulator, the app’s version and build, and your language and country. It never carries the contents of a post, a photo, a health record, a name, an email address, or the identity of a circle.

These events go to two places: our own database at Supabase, and PostHog (PostHog Inc.), our product-analytics provider, on servers in Virginia, United States. PostHog also receives your purchase and subscription events from RevenueCat, so that we can see whether a feature helped before someone subscribed. PostHog processes this data for us under a data-processing agreement and never uses it for its own purposes. If you are in the European Economic Area, the UK or Switzerland, sending it there is a transfer of your data to the United States: that agreement includes the EU Standard Contractual Clauses, with the UK and Swiss addenda, and PostHog participates in the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

We use it to answer questions like “where do people get stuck in setup?” and “which features do families still use after a month?” We do not use it to profile you, to advertise, or to decide anything about you individually.

Session replay

Memofu can record an anonymised replay of a session in the app, so we can see where a screen confuses people. When it is on:

• it records masked screenshots of the app’s screens — all text and all images are replaced with grey blocks before the screenshot leaves your phone — plus where you tapped and how you moved between screens;
• it never records what you type, your photos, your pet’s health records, or anything on a screen in readable form, and it is switched off entirely on the sign-in, health and photo screens;
• it applies only to a small random sample of sessions, not to everyone;
• it is off unless we switch it on, and we can switch it off again for everyone at once.

How long we keep it, and how to have it erased. PostHog keeps events for up to one year on our current plan, and we cannot shorten that period — so deletion, not expiry, is the tool we use. When you delete your Memofu account, we delete your PostHog person record along with every event and every replay belonging to it. You can also ask us to do that on its own, without deleting your account, through the support page.

There is no on/off switch for this inside the app yet. We would rather say so plainly than imply a choice that does not exist. If you would rather not be measured at all, contact us and we will delete your analytics record and exclude you.

How your content is shared

Only people you invite to your circle can see your content. Share links you create are private URLs — anyone with the link can view your circle’s timeline until the link is turned off, which you can do at any time.

When a share link is opened we record which posts appeared on the reader’s screen, when each was first seen, and any hearts they send, and we show that to the editors of the circle that created the link. We do not use the reader’s name, account or cookies. Their IP address is used only to rate-limit abuse and is deleted automatically within three days. Turning a link off also deletes the looks and hearts recorded through it.

Health links work differently. An owner or co-owner of a circle can create a read-only link to one pet’s health record for a vet, a boarding facility or a sitter. It shows the pet’s name and profile (species, breed, sex and age), the allergies and care notes recorded for it, its current medications, its vaccines and preventives, its last 24 weigh-ins and the dates, clinics and reasons of its vet visits, along with the recipient name typed when the link was made. It never shows photos, visit or weigh-in notes, costs, or the name of anyone in your family. The link stops working when the period chosen for it (one day, one week or one month) ends, or as soon as it is turned off. Nothing about the reader is recorded: we count how many times the link was opened and when it was last opened, and their IP address is used only to rate-limit abuse and is deleted within three days. The link’s details, including the recipient name and those counts, are deleted 90 days after it expires.

Data retention and deletion

You can delete your account at any time, from the app. Deletion takes effect immediately: you are signed out, and your profile stops appearing anywhere in the service. The posts, comments and health records you added to a circle you share with other people stay with that circle, so the family you built the album with does not lose it.

A photo you remove from a vet visit or an expense, or that goes with one you delete, is erased permanently 30 days later, unless it is still shown elsewhere in the circle, or it must be kept because of a report or a moderation decision: while we review it, and afterwards for as long as the law requires. Other deleted data is not erased on a fixed schedule. If you want the content you added erased permanently, ask us through the support page and we will carry out the erasure and confirm it to you. We would rather describe exactly what our systems do than publish a deadline we cannot prove we kept.

You can export all of your data, free, at any time before (or instead of) deleting.

Who processes your data for us

These are every company that handles your data on our behalf. They may process it outside your country, including in the United States, under contracts that hold them to this policy.

• Supabase (Supabase Inc., USA) — hosting and storage for your account and your content.
• PostHog (PostHog Inc., USA; our data is stored in the United States, in Virginia) — product analytics for the Memofu app. It receives the product events listed above, your Memofu user id, the random installation and session identifiers the app creates, the device details listed above, your purchase and subscription events forwarded by RevenueCat, and — while session replay is switched on — masked screenshots of app screens. It never receives your photos, your health records, your posts, your name or your email address.
• Sentry (Functional Software, Inc., USA; our data is stored in the United States) — error monitoring for the Memofu app and our server. It receives the crash reports described above, with links that could open your data, web-address parameters and the identifiers of your circle, pets and photos already removed, and the IP address a report from the app is sent from. From the app it also receives the random per-installation identifier described above, on crash reports and at the start and end of each session: it is never linked to your account, it is used to count how many devices a problem affects, and it is replaced when the app is reinstalled (on Android it can be restored from a device backup). It never receives your content, your name, your email address or your Memofu user id, and it keeps reports for up to 90 days. If you are in the European Economic Area or the UK, this is a transfer to the United States, made under Sentry’s data-processing agreement, which includes the EU Standard Contractual Clauses with the UK addendum; Sentry also complies with the EU-U.S. Data Privacy Framework.
• Vercel (Vercel Inc., USA) — hosting for this website and for our API.
• RevenueCat (RevenueCat, Inc., USA) — purchase and subscription processing. It receives your Memofu user id, the receipt the app store issues for a purchase, and basic store and device information such as country and app version — so that Premium can be recognised on your other devices and restored if you reinstall. It never receives your content, your email address, or your card details. It forwards your purchase and subscription events to PostHog, listed above.
• Apple and Google — payment processing through their app stores. We never see your card details.

Your rights

Depending on your region (including GDPR and Japan’s APPI), you have the right to access, correct, export, and delete your personal data. The export and deletion tools are built into the app; for anything else, contact us via the support page.

Children

Memofu is intended for users aged 17 and over.

Changes

If we change this policy, we will update this page and note the date above. Material changes will be announced in the app.

Contact

Questions? Reach us through the support page.