Privacy Policy

In short

Momentbound stores your photos and videos so you can organise them into albums and journeys and share them with people you invite.

• Your media is private by default. It is visible to you, to people you invite to a library, to anyone holding an invite link or a published scrapbook link you create, and to anyone who scans a physical tag you have marked public. Public access is off unless you turn it on.
• We do not sell your data, we do not use it for advertising, and we do not use it to train AI models.
• Error, performance, and product-usage tools (crash reports, basic analytics, and masked session replay) help us fix the product. They are not used to profile you for ads or to sell usage patterns. Optional tools need your consent on the web (a cookie banner) and an equivalent in-app choice on mobile. See sections 4.9a and 12.
• Your photos may contain location data. If they do, we read it to place them on maps. To turn coordinates into place names we send a reduced-precision version to Google — never the exact position we hold. Guest and shared downloads never contain embedded GPS; library members may get original metadata restored when they download. You can control how precisely locations appear to guests.
• We never see your password or your card details. Our sign-in provider and our payment provider hold those.

The full policy below is the binding version.

1. Who we are

Momentbound is operated by:

Tollånes Development (enkeltpersonforetak, Norway) Organisation number: 836547152 Postal address: 4639 Kristiansand, Norway

We are the data controller for the personal data described in this policy.

Contact:

• Privacy questions and rights requests: privacy@momentbound.app
• General support: support@momentbound.app
• Reporting abuse or illegal content: abuse@momentbound.app
• Security vulnerabilities: security@momentbound.app

We have not appointed a Data Protection Officer.

2. Who this policy covers

• Account holders who sign up and own or join libraries.
• Guests who open an invite link without creating an account.
• People appearing in uploaded media, who may not be users at all.

If someone uploaded a photo of you and you want it removed, contact privacy@momentbound.app. Section 5.1 explains on what basis we hold media that shows you, and section 11 explains what you can ask us to do about it.

3. Minimum age

You must be at least 13 to create an account, and guests must be at least 13 to upload. When you first sign in we ask for your date of birth. We store it as a calendar date, write-once, and use it only to apply two product rules: whether you may hold an account (13), and whether you may buy a paid plan (18). We do not verify the date. We do not use it for marketing.

We do not apply a separate age rule to optional analytics. Optional analytics and masked session replay stay off on your device until you turn them on, on the web cookie banner or the mobile first-launch screen (section 12), whatever your age. Vercel Web Analytics, which stores nothing on your device, runs for everyone who visits the website. Section 4.9a explains both.

You cannot change your date of birth yourself once it is saved. If you entered it wrongly, contact privacy@momentbound.app and ask us to reset it so you can enter it again; we may need to verify your identity first, and we keep an internal record of any reset.

Guests on an invite link do not give a date of birth. Before their first upload they confirm they are 13 or older with a checkbox, and we record that they confirmed it and when.

We do not knowingly create accounts for anyone under 13. If we learn that an account belongs to someone younger, we will delete it.

13 is both Momentbound's account floor and the Norwegian age at which a child can generally give their own consent to processing of personal data in connection with online services where consent is the legal basis (GDPR Article 8). Other EEA countries set that Article 8 age between 13 and 16. Paid plans are a separate question: Stripe Checkout is only offered to accounts whose recorded date of birth makes them 18 or over. Under-18 accounts stay free.

Adults do upload photos and videos containing children — family libraries are a core use case. That media belongs to the uploader's library and is governed by the same privacy rules as any other media. It is the uploader's responsibility to have the right to upload and share it.

4. What we collect

4.1 Account and profile

Data	Why	Required
Email address	Account identity, service emails	Yes
Username	Your handle. Any signed-in Momentbound user can find you by searching part of it — that is how friend requests are addressed	Yes
First and last name	Optional; held by Clerk and synced as a display name when present	No
Date of birth	Account floor (13+) and purchase floor (18+). Self-asserted, write-once	Yes (accounts)
Profile picture	Shown beside your name to people who share a library with you, and to anyone who finds you by username	No
Short bio	Optional self-description. Returned with your profile to any signed-in user who finds you by username	No
Notification and cellular-upload preferences	Honour your choices	No
Friend connections	The friends feature	No

Sign-in is handled by Clerk. Passwords, social-login identities, sessions, and any multi-factor settings are held by Clerk. We never receive or store your password.

4.2 Photos and videos

When you upload media we store:

• The file you uploaded, subject to the retention rules in section 8. If you apply a look when you take the photo, or edit it later, what we serve and what you download becomes your edited render, and we keep the version from before the edit so you can undo it. That pre-edit copy counts toward your library's storage and goes when you delete the photo. Embedded GPS / location is removed when the file arrives and stored separately. For photos we keep presentation metadata in the stored file (orientation, capture time, camera and exposure) so the picture still displays the right way up; location-bearing EXIF, XMP, and IPTC leave the object. For videos only the location box is overwritten; capture date and the rest of the container stay. Removing location never re-encodes anything, so an unedited file keeps its full resolution and quality.
• The location metadata we removed, kept so we can put it back when a library member downloads the original. Guest and shared-link downloads receive the stored file without embedded GPS. The sidecar is never handed to guests, is never served as its own object, and is deleted with the photo or video.
• Optimised versions we generate for fast display — previews, thumbnails, and compressed video. These are re-encoded and carry no location or camera metadata.
• File details: original filename, format, size, dimensions, video duration. For photos we also copy a small set of camera details out of the file and into our database (make, model, lens, aperture, shutter, ISO, focal length, orientation) so we can show them without re-reading the original.
• Capture time and its timezone offset, read from the file's metadata, used to order journeys chronologically. We also record the UTC offset your device reported at upload. It is not a capture offset; we fall back to it only to decide the local day of an item whose file carries no capture time at all.
• A content fingerprint: a SHA-256 checksum of the file's bytes. Your device calculates it before the upload starts and we recalculate it from the bytes we received, which is how we confirm the file arrived intact. We keep it so we can recognise the same file uploaded twice into the same library — to skip the duplicate at upload time, and to offer a duplicate clean-up screen. It is compared only within your own library, never against anyone else's, and it says nothing about what is in the picture.
• Your edit settings — the crop, rotation and colour sliders you moved, and when you last edited the photo — stored so an edit can be changed or undone.
• Captions you write.

4.3 Location

This is the most sensitive data in the product, so we describe it precisely.

Photos and videos from phones and cameras often contain GPS coordinates. When present, we read those coordinates and store them at the precision contained in the file (typically up to six decimal places). Decimal storage is not the same thing as GPS accuracy — a phone is usually far less precise than that. You can also set a location manually by searching for a place.

Photos and videos you take inside the app. Camera captures usually carry no GPS of their own, so when you open Momentbound's camera we ask your phone for your position and attach it to the photos and videos you take there, stored to six decimal places like any other coordinate. Your phone asks for the permission the first time you open the camera. We read your position only on that screen, never in the background, and refusing the permission simply means those captures have no location.

We use coordinates to:

• Place media on album trip maps and your personal life map
• Group media into journeys and sections by place
• Derive a human-readable place name

Three separate things happen with third parties, and it is worth being precise about which is which.

Place names. To convert coordinates into a place name ("Bergen, Norway") we send them to Google Maps Platform, which may process them outside the EEA and which receives them as an independent controller rather than as our processor — see section 6.3. We reduce their precision before we send them. We round latitude and longitude to three decimal places, so what leaves us identifies a grid cell rather than a point: roughly 110 m north to south, and narrower east to west the further north you are — around 60 m in southern Norway, under 40 m in Finnmark. Google never receives the precise position stored against your photo. Reducing precision can occasionally change the label we get back, where a cell straddles the boundary between two named areas. We store the resulting place name on that photo, album, or journey section only. Nearby photos at the same reduced-precision cell each get their own Google lookup. We do not keep a shared cell cache.

We discard any street-level result Google returns — place names are never street addresses.

Map backgrounds. The map images themselves come from Mapbox, which receives the area of the map you are looking at, your IP address, and a random Mapbox visitor identifier that Mapbox's own library stores in your browser (section 12). Mapbox does not receive your photo locations. Your coordinates travel from us to your own device, which draws them on top of Mapbox's background images.

Place search. When you search for a place by name:

• On the website, the typed text is sent to Google Places through our servers when that path is configured. No coordinates and no account identifiers are included, and Google does not receive your IP address for those searches.
• If that path is empty or unavailable, the website falls back to Mapbox Search in your browser.
• On mobile, place search goes to Mapbox Search from the device.

Mapbox Search receives the text you typed and your device IP. It does not receive your photo coordinates.

Your controls

• New albums default to city-level precision for shared maps. Guests see the city, not the exact spot. (If you change your account default, new albums follow that instead.)
• You can change precision per album. If you choose exact coordinates for a shareable link, we warn you at the time, because exact locations of a home, school, or workplace can be used to find people.
• Guest and shared downloads never contain embedded GPS. Authenticated library members may receive restored original metadata — including location — when they download the file through the member download path. This applies to the stored original; optimised previews never carry location.
• You can delete media, which removes it from view immediately and cannot be undone. Coordinates stored on the row are purged with the file after the 30-day delay described in section 8.

4.4 Libraries, sharing, and guests

• Library details: name, owner, plan, storage used.
• Membership: who is a member of which library, and their role.
• Albums, journeys, and sections, including titles and ordering.
• Invite links: the link code, what it permits, when it expires, upload caps. Album invite links expire; library member invites and published scrapbook share links do not — see the table in section 8.
• Guest identity: if you use an invite link without an account, we store the name you give and a random technical identifier generated in your browser (a UUID kept in local storage). It lets us attribute your uploads and reactions consistently within that library on that device. It is not derived from your hardware, IP address, or cookies from other sites; clearing the site's data creates a new identifier; and it is not linked to any Momentbound account.
• Guests who upload also confirm they are 13 or older, and accept the Terms and Acceptable Use. We record those assertions against the guest contributor row.
• Reactions and comments you leave.
• Scrapbooks, their pages, stickers, and exported PDFs.
• Physical tag links, where used, and whether you have marked a tag public.
• Your notification inbox. When something happens that concerns you — a comment or reaction on your photo, a friend request, an album invite, your photos finishing processing, or a copy of your data being ready — we store a notification for you. It records who acted, what it was about, and the text we show you, which can include the first 120 characters of a comment, an album title, or the name a guest gave.

A guest can erase what they contributed from the invite page while they still have a guest session, or by writing to privacy@momentbound.app. Erasure removes your uploads, comments and reactions, and stops storing your name on the guest record; the row itself is kept in anonymised form because it is what the Terms/AUP acceptance evidence hangs off. One thing it does not reach: a notification we already sent to the member whose photo you commented on or reacted to may still show the name you gave and a short excerpt of your comment.

4.5 Devices and notifications

If you enable notifications we store a push token for each device, the platform, and when it was last seen. Tokens are sent to Expo, which relays messages to Apple or Google for delivery.

The message text travels with the token. It is written to be readable on a lock screen, so it can contain the name or username of the person who acted, the title of the album involved, and the first 120 characters of a comment someone left on your photo. A small technical payload travels with it too: the notification's identifier, its type, and the screen it opens. Expo, Apple and Google therefore see that text, not only the token. If you would rather it did not pass through them, turn push notifications off in Settings — we stop sending, and the same events still appear in the app's Activity list.

4.6 Payments

Paid plans are handled by Stripe. We store your Stripe customer identifier and your plan state. Card numbers, billing addresses, and tax details go directly to Stripe and never reach our servers. We do not send your date of birth to Stripe. Checkout is refused on our side if the account is under 18.

4.7 Support and email

If you email us we hold the message and your address for as long as needed to handle the request, and for up to 24 months afterwards so we can recognise a recurring problem or a follow-up to an earlier conversation. After that the thread is deleted. (Mailbox hygiene is manual; there is no automatic job.)

If you request early access through our launch waitlist, your email is stored with Clerk, which manages approval and the account invitation.

Some service email reaches you through Resend, our email provider: when a data export you asked for is ready to download, when a library's paid plan ends, and before photo originals a plan was holding are deleted. The plan and originals emails go to the library's owner, not to every member. Resend receives your email address and the name on your account, and for the library emails the library's name. These are not marketing and there is no setting to switch them off — they tell you about your own account or your own files.

If you separately subscribe to product news in the website footer, your email is stored with Resend until you unsubscribe. Joining the access waitlist does not subscribe you to marketing email.

4.8 Abuse reports

Anyone who can see content can report it, including guests with no account. When a report is filed we store:

• The category chosen and any description written.
• Which content was reported, and which shared page or album it was reported from.
• A snapshot of the reported item taken at that moment — for a photo, its filename, caption, and who uploaded it. We keep this so a report stays reviewable if the content is later edited or deleted; otherwise anyone could erase the evidence of a report against them.
• A contact email, only if the reporter chooses to give one. Reporting anonymously is fully supported.
• The reporter's account or guest identity, where we already know it from the session. We do not ask for it.

Reports are stored in our own database. We send ourselves a notification when one arrives. That notification is a pager, not the case file: it contains the reference, category, target identifiers, and — if the reporter chose to leave one — their contact email. It does not contain the reporter's free-text description.

We look at reported content in order to act on the report. Access is limited to the reported item — there is no route from a report into the surrounding album — and every time reported content is opened for review it is recorded in our application logs (who opened it, and which report). See section 6.4.

4.9 Technical and security data

Our hosting providers log requests, IP addresses, and errors, and we count requests for rate limiting. This protects the service against abuse and helps us fix faults.

4.9a Website analytics, errors, and product usage

Page views (website only). We use Vercel Web Analytics to understand which pages are used. It records page paths (with invite, share, tag, join, album, and similar identifiers removed), referrers, and coarse device or region signals. Visitors are counted with a one-day hash derived from the request, not a cookie or a lasting identifier. It does not set a cookie or write to local storage. There is no cross-site tracking and no advertising profile.

Errors, performance, and masked session replay — product improvement only, not advertising. After you accept Analytics on the web cookie banner or the mobile first-launch screen (section 12), we use Sentry on web and mobile:

• Crashes, errors, and performance (what broke, how slow a screen was).
• Sentry Session Replay, with all on-screen text masked and all photos, videos, and other media blocked, so private media is not sent as readable frames.

These tools exist so we can improve Momentbound. We do not sell usage patterns, we do not build advertising profiles, and we do not share this with other companies for their marketing. If you refuse Analytics, the Sentry client SDK does not initialise on that device. Server-side error reporting on our API, worker, and website host does not store or access information on your device and is not gated by that banner.

Optional preferences on the device. After you accept Preferences on the same banner or first-launch screen, we store the last album type you created, timestamps for when you last looked at an album or your home feed, and — in the app — which album or library your last capture went to and which camera look you last selected, so those still apply the next time you open Momentbound. If you refuse Preferences, those values last only for the current visit.

4.10 What we do not collect

We use no advertising tools and no cross-site tracking. We do not build advertising profiles, we do not infer interests for ads, and we do not track you across other services. We do not run face recognition or automated analysis of image content. We do not use your photos, videos, or captions to train AI models.

We use error reporting on our servers, and — with Analytics consent — Sentry on your device including masked session replay, for product improvement.

5. Why we process it, and on what legal basis

Purpose	Legal basis
Providing your account, libraries, albums, and media storage	Performance of a contract
Processing uploads into optimised versions	Performance of a contract
Reading capture time and location from your files, and taking a location from your device when you capture inside the app, to organise journeys and maps	Performance of a contract — organising memories by time and place is part of the service you asked for. Location is not required to store or share a photo; you can still use Momentbound if a file has no GPS
Sharing with members and invited guests as you direct	Performance of a contract
Taking payment and enforcing storage limits	Performance of a contract
Sending service emails (sign-in and security mail sent by our sign-in provider, data-export-ready notices, and the plan-ended and camera-originals-deletion notices)	Performance of a contract
Push notifications	Your consent, via your device permission
Security, abuse prevention, fraud prevention, rate limiting	Legitimate interests
Understanding which website pages are used (Vercel Web Analytics)	Legitimate interests
Error and performance monitoring (Sentry)	Legitimate interests in keeping the service working; and consent where the client SDK stores or accesses information on your device beyond what is strictly necessary
Product-usage analytics and masked session replay (Sentry Session Replay)	Your consent (Analytics on the cookie banner / mobile first-launch screen)
Optional interface preferences in local storage (last album type, last-seen timestamps)	Your consent (Preferences on the cookie banner). They are not strictly necessary
Receiving abuse reports, reviewing the reported content, and acting on it	Legitimate interests — keeping the service safe for the people using it and for the people appearing in it
Keeping a record of reports and what we decided	Legitimate interests; and legal obligation where an authority requires us to preserve or hand over something specific
Storing and displaying media that shows people who are not our users	Legitimate interests — see 5.1
Attributing guest contributions within a library	Legitimate interests
Access-waitlist requests and invitations	Your consent
Marketing emails	Your consent through the separate mailing-list form
Responding to legal requests and keeping accounting records	Legal obligation

Where we rely on legitimate interests, we have weighed them against your interests and rights and believe the processing is limited and expected. Short internal assessments covering depicted people, abuse and security, guest attribution, and analytics are kept with our data inventory. You may object — see section 11.

5.1 People who appear in media

Our agreement is with the person who holds the account. Someone who simply appears in a photo has no agreement with us, so we cannot rely on that agreement to justify holding their image. We rely on legitimate interests instead: the uploader's interest in keeping and sharing their own memories, and our interest in running a service that lets them.

We believe that is a fair balance largely because of what this service deliberately does not do. We run no face recognition and no automated analysis of image content, so we do not identify anyone in a photo and cannot search for a person across the service. Media is private by default and reaches only the people an uploader invites. Guest and shared downloads never contain embedded GPS, album maps default to city-level precision, and we do not use media for advertising, for profiling, or to train AI models.

We usually cannot tell you directly that we hold a photo of you, because we do not know who is in it and have no way to contact you. Identifying every person in uploaded family media would itself require invasive processing such as face recognition, which we refuse to do. Where we do become aware — for example because you write to us — we will tell you what we hold. For everyone else, this policy is that notice. The internal Article 14 assessment is in ../article-14-assessment.md.

You can object. Use the Report action on the item, which works without an account, or write to privacy@momentbound.app. Section 11 explains what happens next. It is the uploader's responsibility to have the right to upload and share media showing other people; ours is to act when someone tells us they object.

6. Who we share it with

We do not sell personal data and we do not share it for advertising.

6.1 People you choose

• Members of libraries you belong to
• Anyone holding an invite link you create or a scrapbook share link
• Anyone who scans a physical tag you marked public. A tag pointing at a photo or at a journey day can be opened without an account and without an invite. Turning the tag's public switch off removes that anonymous access; if the album still has a live invite link, the tag then opens the same invite page as that link
• Anyone those people show it to

Album invite links work for whoever holds them. If a link is forwarded, the new holder gets the same access until the link expires or you revoke it. You can revoke and rotate an album invite at any time, and an album invite expires after 30 days.

A published scrapbook's share link is permanent today. Once you publish, anyone holding the link can open that scrapbook. We cannot yet revoke the link, rotate its code, or set it to expire, and re-publishing reuses the same link rather than replacing it. The link stops working only if you delete the album the scrapbook belongs to, or delete the library. Treat publishing a scrapbook as making it public to anyone the link reaches.

Pasting a share link into a chat shows a preview card. When anyone pastes an album invite link or a published scrapbook link into a chat or social service, that service fetches the link to draw its preview. For an album invite that grants viewing, we answer with the album's title, its description, its dates and photo count, and the album's cover photo. For a published scrapbook, we answer with its title, its page count and the image of its first page. An invite that only allows uploading gets the title and nothing from inside the album. The card that service draws is a copy of that content on its own servers, held under its own privacy policy and retention, not ours — we cannot instruct it to delete the copy. We keep no copy: each card is rendered per request and never stored. Revoking or expiring the invite stops us serving new cards at once; a card already drawn in a chat stays there.

6.1a Other account holders who look you up

Momentbound has a friends feature, and it works by username. Any signed-in Momentbound user can search for part of a handle and get back the matching accounts' username, display name, profile picture, and bio — there is no shared library or existing connection required, and no setting that hides you from that search. Your email address, your libraries, your albums, your media, and your locations are never part of it. If you would rather not be found, choose a handle that does not identify you.

6.2 Service providers

Provider	What it does	What it receives	Acts on our instructions?
Clerk	Sign-in, accounts, and access waitlist	Identity, credentials, sessions, waitlist email, IP	Yes — DPA by reference
Cloudflare	Media storage and delivery (R2, EU jurisdiction by configuration)	Your photos and videos; and, because media is delivered from Cloudflare's network, a request carrying the viewer's IP address and browser or device type each time media or a scrapbook page is loaded	Yes — DPA by reference
Railway	Hosting for our API and background worker (EU West — Amsterdam)	Request and application data in transit, service logs	Yes — DPA executed
Aiven	Managed PostgreSQL for our database (Amsterdam, on DigitalOcean infrastructure)	Everything stored in the database	Yes — DPA by reference
Vercel	Hosting for our website and web app; privacy-friendly Web Analytics	Requests, IP addresses; analytics events; the album cover or scrapbook page rendered into a link preview card (handled in memory per request, not stored)	No — not during our beta. See below
Mapbox	Map rendering, and place search from the device (mobile; web fallback)	Map viewport, IP, device details; typed search text	Yes — DPA by reference
Expo	App builds and notification delivery	Push tokens, device details, and the title and body of each notification (names, album titles, comment previews)	Yes — processor terms in Expo ToS
Resend	Operational email and optional marketing mail	Your account email address and display name; the content of the service emails we send you, which can include a library's name, how much storage it is using, how many camera originals it still holds and the date those are deleted, and how many files are in a data export; mailing-list email addresses; abuse-report pager fields (never the reporter's free-text description)	Yes — DPA by reference
Sentry	Errors, performance, and masked session replay (client SDK only after Analytics consent)	Device/app diagnostics, stack traces, performance traces; masked replay events if enabled	Yes — DPA accepted
Stripe	Payments	Billing identity, payment method, tax data	Partly — see below
Apple, Google Play	App distribution and notification delivery	Push tokens, store account data, and the title and body of each notification (names, album titles, comment previews)	No — see below

Everyone marked yes processes that category of your data only on our instructions, under a data processing agreement with us, provided the DPA actually applies to our account and plan. We keep an internal register of which arrangement applies to which provider.

Our database is hosted by Aiven, not by Railway. Railway runs our API and background worker; the PostgreSQL database those two talk to is a managed Aiven instance in Amsterdam, running on DigitalOcean infrastructure. Aiven's data processing agreement is part of its terms. Because we chose a host in the EEA, that agreement requires Aiven to store the data in the EEA and to move it out only with our approval.

Vercel is not under a data processing agreement with us during the beta. Vercel's data processing agreement covers its Pro and Enterprise plans. Our website runs on the free plan, so that agreement does not apply to us, and we will not claim otherwise. In practice this means Vercel receives every request to our website and app, and the data needed to answer it. That is the page you asked for, your IP address and your browser and device type. It is also the content our server handles on your behalf, because our website calls our API through its own server: album and journey titles and descriptions, comments, contributor names, place labels and map coordinates, and the links to your media. When a shared album link is pasted somewhere that shows a preview card, our server on Vercel also downloads that album's cover photo to draw the card. Your photos and videos are otherwise delivered to your device straight from Cloudflare, not through Vercel. What Vercel does with any of it is governed by Vercel's own privacy policy, not this one. Vercel is based in the United States. We keep the free plan while the service is a small beta; we will move to a plan the agreement covers before Momentbound is generally available, and this row will change when we do.

Stripe is a mixed case. It takes payments on our instructions, but it also decides for itself how to meet its own fraud-prevention, anti-money-laundering, and financial record-keeping duties. For those purposes Stripe's own privacy policy governs, not this one.

Apple and Google Play are not our providers in this sense. They distribute the app and relay notifications under their own developer and platform terms, and they decide their own purposes for what they collect when you install or update an app, or when a notification passes through their systems. We cannot instruct them, and their own privacy policies apply to that data.

6.3 Google Maps Platform

Google is not one of our service providers. When we turn coordinates into a place name, or when you search for a place through the server-side Google path, Google receives that request as an independent controller of the data — it decides its own purposes for it, under its own privacy policy, rather than acting on our instructions.

For European customers, Google's controller terms identify Google Ireland Limited as the European controller of that data. Google may still process it outside the EEA under those terms. Saying the request “is sent outside the EEA” would overstate what we control; saying Google may process it outside the EEA is the accurate version.

What Google receives is limited:

• Coordinates reduced to a three-decimal-place grid cell (section 4.3), never your stored precise location
• The place text you type when a search uses the server-side Google path

Google's handling of that data is governed by the Google Maps Platform terms and Google's own privacy policy, not by this one.

6.4 Us, when handling a report or a support request

We do not browse private libraries out of curiosity, and there is no internal tool for wandering through albums.

We do allow limited, authorised access for specified purposes:

• Reported content, so we can decide whether it breaks the rules. That access is limited to the specific item reported, restricted to accounts we have granted moderation access, recorded when the item is opened, and used only to handle that report.
• Support you ask for — for example if you write to us about a corrupted file and we need to look at that file to help. We use storage and subscription information first; we open content only when the request cannot be answered without it.
• Security and legal investigations, narrowed to what is required.
• Preparing a copy of your data on request. If you ask us for your data and cannot use Settings → Your data yourself, a member of staff can start the same export for you. Starting it requires a fresh sign-in and is recorded in our staff audit log, the archive is delivered to you and not to us, and you are notified in the app and by email when it is ready, whoever started it.

If we decide reported content breaks the rules we may remove it. See section 10.

6.5 Legal and safety

We may disclose data where legally required, to respond to a valid legal request, to protect someone's safety, or to investigate abuse. We verify requests, narrow them to what is required, and tell you unless we are prohibited from doing so.

7. International transfers

We have configured our media files to be stored in Cloudflare R2 under the European Union jurisdiction, our API and background worker to run on Railway in EU West (Amsterdam), and our database to run on Aiven in Amsterdam. We keep those primary stores in the EEA as a matter of how we have set the services up. Cloudflare and Railway reserve the right to process data elsewhere under their agreements, so where that happens the transfer safeguards below apply. Aiven's agreement goes further: it keeps our database in the EEA and needs our approval to move it out.

Several other providers are based in the United States or process data globally. In particular, sign-in data is not held in the EEA — Clerk may process it wherever it and its own providers operate — and our email provider, Resend, is US-only. Payments, map rendering, push delivery, and our website usage analytics (Vercel) are likewise global. Our error and performance reporting, Sentry, ingests into Sentry's EU region, but Sentry is a US company and may process data elsewhere.

Where personal data leaves the EEA we rely on one of:

• an adequacy decision, such as the EU–US Data Privacy Framework (DPF), or
• the European Commission's Standard Contractual Clauses (SCCs).

Provider	Safeguard we rely on	Where to read it
Clerk	DPF; SCCs as fallback	clerk.com/legal/dpa
Cloudflare	SCCs and DPF. EU R2 is configuration, not a contractual residency guarantee	Cloudflare customer DPA
Railway	SCCs and DPF (DPA executed). Compute configured in Amsterdam	Copy of the executed DPA available on request
Aiven	None needed while the data stays in the EEA. Aiven's DPA requires it to store EEA-hosted data in the EEA and to transfer it out only with our approval	aiven.io/dpa
Vercel	SCCs (2021, modules 1–3) and UK IDTA, if the DPA applies to our plan	vercel.com/legal/dpa
Mapbox	SCCs module 2, deemed signed with the DPA	mapbox.com/legal/dpa
Expo	SCCs named in Expo Terms §3.2	Expo Terms of Service
Resend	DPF and SCCs	Resend DPA / Terms
Stripe	DPF and SCCs modules 1–2	Stripe DPA
Google Maps Platform	Independent controller. Google Ireland Limited is the European controller for European controller data; Google's own onward-transfer terms apply	Google controller terms
Sentry	DPF; SCCs module 2 and the UK Addendum as fallback. Our projects are configured on Sentry's EU region; that is configuration, not a contractual residency guarantee	sentry.io/legal/dpa

You can ask us for a copy of the clauses, or where they are available, at privacy@momentbound.app.

8. How long we keep it

Your media

• Paid plans on Original quality keep your original files for as long as your subscription stays on that plan for the library.
• Free libraries, and paid plans on a compressing quality setting, keep the optimised version indefinitely and the original only for a grace window: 30 days for photos, 7 days for video, counted per item. After that the original is removed and the optimised version remains — that is what you see and share. Where a photo was filtered or edited, the unedited copy is kept for as long as the photo exists, so the edit stays reversible.
• If you move a library to Original quality while originals are still inside their grace window, those originals are kept rather than removed, and start counting toward the plan's storage.
• If you move away from Original quality, existing originals start their grace window from that point. If a paid plan ends and the library was not already on Space saver, we lower quality to Space saver and restart that clock. Changing the setting back does not restore originals that were already removed.
• When you delete media, it disappears from the app straight away and you cannot undo it — there is no trash and no restore. The file, its renders, and any stored metadata stay in our storage for at least 30 days before a background job removes them for good, and they keep counting toward that library's storage quota until it does. The separate 7-day cleanup of unreferenced files described in the table below does not extend that.
• We may close a free library after a long period of inactivity (our current rule of thumb is 24 months). If we start doing this, we will email the owner in advance. There is no automated job for this today.

Everything else

Data	Kept
Account and profile	Until you delete your account. An empty, anonymous record is kept after that so other people's albums do not break
Library, album, and journey structure	Until deleted, or with the library
Album invite links	30 days from when they are created or rotated, or sooner if you revoke them
Library member invites	Until the owner deletes them; they do not expire on their own
Scrapbook share links	Until the album or the library is deleted. No expiry and no revocation today
Guest contributor records	With the library. Anonymised if the guest erases; notifications already sent to a member may still carry the name and a comment excerpt
Media, comments and reactions you added to a library you do not own	Kept with that library after your account is deleted
Comments and reactions	Deleting a comment hides it at once. The text stays in our database until the album or library it sits in is deleted — or, for a comment on a photo or video, until that item's 30-day deletion window runs out. Removing a reaction deletes it at once. A guest who uses the erasure control in section 4.4 has their comments and reactions deleted straight away
Scrapbooks, their pages, and exported PDFs	With the scrapbook, which is removed when its album or library is deleted. The files then fall under the unreferenced-files row below
Custom stickers you upload	With the library, because a sticker can be reused across scrapbooks
In-app notifications	In your feed, until you delete your account. A notification about something you did stays in the feed of the person it was sent to, showing you as a removed user
Push tokens	Until revoked, replaced, or the account is deleted
Billing records	Stripe retains these to meet accounting and tax law, typically several years
Support email	24 months after the conversation ends
Access waitlist	Until it is approved, denied, or withdrawn
Marketing mailing list	Until you unsubscribe. Your address then stays with our email provider marked unsubscribed rather than being deleted — that record is what stops the signup form putting you back on the list. Email privacy@momentbound.app to join again, or to have the record removed altogether
Security and request logs	Short retention set by our hosting providers
Abuse reports	24 months after the case is closed. Kept even if you delete your account, so a report cannot be erased by the person who filed it — but your contact detail is removed with the account. Evidence we are legally required to preserve for an authority is kept for as long as that obligation lasts
Unreferenced files in our storage	Files that no longer belong to any record — usually an interrupted upload, or a leftover after a deletion finishes. They are not a copy of anything you can still see or restore, so there is nothing to recover from them. Deleted within 7 days of us detecting them
Place names on a photo	With that photo
Error / usage analytics	Provider defaults; we will not keep session recordings longer than needed to debug a product question

Deleted data may persist in encrypted backups for a limited period before ageing out. Backups are not used to restore individual deleted items.

9. Deleting your account

You can delete your account from within the app, or from our website at momentbound.app/delete-account if you no longer have the app installed.

We ask you to confirm your identity first, because deleting an account is irreversible and we will not act on a session someone else may have left open.

If you own a library that has other members, we will not delete your account yet. We stop and ask you to transfer that library to one of its members first. This is deliberate: deleting it would destroy photos belonging to people who never asked to lose them. Transferring hands the library, its albums, and its media to the new owner, who then chooses their own plan. It does not hand over your payment method.

Once no shared library stands in the way, deletion runs in this order:

1. Any active subscription for a library you own is cancelled. This happens before anything is deleted, and if the cancellation fails we stop and delete nothing — so an account can never be deleted while its subscription keeps billing.
2. Your sign-in record is deleted, before any of your data is touched, so the account cannot be used to sign in again while the rest runs. This also fails safe: if we cannot remove the login, nothing is deleted and you can retry.
3. Any copy of your data you asked us to prepare is cancelled, and an archive already prepared is removed from storage rather than sitting out its normal 24-hour window.
4. Libraries you own are deleted, along with all media in them, including media that other members or guests uploaded to them.
5. Your profile, memberships, pending ownership transfers, friend connections, notifications, and push tokens are deleted, and your identifying fields are cleared.
6. Media is purged from storage on the normal 30-day schedule.
7. The app confirms when deletion has completed, then signs you out.

Photos and videos you uploaded to libraries you do not own stay in those libraries. We do not remove them, because they are part of an album other people share. Your name and profile are removed with the account, so those contributions are no longer shown as yours. If you want that content gone, delete it yourself before you delete your account — you can delete media you uploaded even in a library you do not own. Once your account is gone you can no longer do that, and you would have to ask the library owner.

Some data survives deletion where the law requires it — chiefly billing and accounting records held by Stripe, and abuse or security records where we need them to protect the service or to meet a legal obligation.

Abuse reports you filed are kept, so that someone cannot erase the record of a report they made about another person by closing their account. Your contact detail is removed from those reports along with the rest of your account.

Guests who never had an account use the guest erasure control in section 4.4 instead of this flow.

10. Who can delete media in a shared library

• The library owner can delete anything in their library.
• The album owner can delete any media in that album.
• Other signed-in members can delete only media they uploaded.
• Guests on an invite link can delete only media they uploaded themselves.
• We can remove an individual photo or video that has been reported to us, if we decide it breaks our rules. We remove the reported item only, and we record the decision and the reason. We do not delete albums, libraries, or an uploader's other content this way.

If you need something removed that you cannot delete yourself, ask the library owner, or use the Report action on the item itself. Contact privacy@momentbound.app if neither is possible or appropriate.

11. Your rights

Under the GDPR you can ask us to:

• Give you access to the personal data we hold about you
• Correct inaccurate data
• Delete your data
• Restrict processing, or object to processing we base on legitimate interests
• Send you a copy of your data in a portable format

You can also withdraw consent at any time — for notifications, marketing, and the optional analytics, crash reporting and masked session replay described in section 12 — and complain to a supervisory authority.

Each of these rights carries conditions and exceptions set by the GDPR itself, so none of them is absolute. Most of the time we will simply do what you ask. Where a right does not apply — because we have to keep something to meet a legal obligation, for instance, or because acting would harm someone else's rights — we will tell you what we are relying on and why.

To exercise any of these, email privacy@momentbound.app. We respond within one month, and will tell you if we need longer.

We may need to verify your identity before giving you access to, or a copy of, personal data — acting on an unverified access request would hand your data to whoever asked. We will ask for the minimum needed.

We do not ask you to prove who you are to request removal of media showing you or your child. Tell us what to remove. An unverified removal request takes content down rather than disclosing it, so the risk runs the other way: requiring proof would deter the people most likely to need this. You can also use the Report action on the item without an account.

Data export. You can request a copy of your account details, your media — including media you uploaded to libraries you do not own — your albums and journeys, your comments and reactions, the scrapbooks in your albums, your friends and memberships, and the policy versions you accepted, in a format usable without Momentbound, from Settings → Your data in the app or on the website. Exported originals may have the location metadata we removed at upload put back, in the same way a member download does (section 4.3). We prepare a multi-part archive (including media), notify you when it is ready, and delete it after 24 hours. The archive does not count against your library storage.

If you appear in someone else's media, you can use the Report action on the item — you do not need an account to do this — or contact privacy@momentbound.app. We will assess the request and, where appropriate, remove the content. We may need to contact the library owner.

A note on reports about you. If someone reports content you uploaded, we keep a record of the report, our decision, and the reason. You can ask what we hold about you, but we will not disclose the reporter's identity or contact details, because doing so would expose them to retaliation and discourage people from reporting at all.

Supervisory authority

Our lead authority is the Norwegian Data Protection Authority:

Datatilsynet — https://www.datatilsynet.no Postboks 458 Sentrum, 0105 Oslo, Norway

If you live elsewhere in the EEA you may also complain to your national authority.

12. Cookies, app storage, and consent

Norwegian e-commerce law (Ekomloven § 3-15) applies to cookies and similar technologies that store or access information on your device, including local storage. The exemption is narrow: the storage must be a prerequisite for the service you asked for.

Strictly necessary (no consent banner):

• Sign-in and session cookies, set by our sign-in provider, so you stay logged in.
• A guest session token for an invite link you opened, so your uploads and reactions are accepted.
• The random guest identifier described in section 4.4, so contributions on that device stay attributed inside that library.
• The name you gave as a guest, kept on the device so an invite page you come back to does not ask for it again, and so it can be attached to what you upload.

Optional convenience — these are not strictly necessary. They remember the album type you last created, when you last looked at an album or at your home feed, and — in the app — which album or library your last capture went to and which camera look you last selected. They are written to the device only after you accept Preferences. Refusing Preferences still lets you use Momentbound; unread badges, last album type, and your last capture album and camera look then last only for that visit.

Optional product-improvement tools (consent required before they load on your device):

• Web: a cookie banner for Sentry, masked session replay, and optional preference storage. If you have an account you can change the choice later in Settings. Signed out, clear this site's data in your browser to be asked again.
• Mobile: a first-launch consent screen (and Settings controls) before optional analytics, crash, or replay SDKs initialise. Store privacy labels (App Store / Play) will list them. We do not use these tools for advertising, so we do not expect Apple's App Tracking Transparency prompt to apply; if that changes we will show it.

You can refuse optional tools and still use Momentbound. Vercel Web Analytics, as used today, does not set a cookie or write to local storage; it is not an excuse to skip consent for the optional items above.

Maps. Album maps, the trip map, the life map, and the map on our front page load Mapbox's map library in your browser. That library writes a random Mapbox visitor identifier to your browser's local storage and tells Mapbox that a map was loaded. The identifier is Mapbox's, set by their library, and their web map library gives us no way to switch it off — so unlike the items above, this one is not behind the banner. It is not used for advertising and it does not identify you to us. Mapbox does not receive your photo locations (section 4.3).

In the mobile app these values are held in the device's secure storage. On Android that is storage belonging to the app, and it goes when you uninstall. On iOS it is the system keychain, which iOS does not clear when you delete an app and which can be restored to a new device from an encrypted backup. Turning Preferences off in Settings stops us writing the optional values and removes the ones behind unread badges and the last album type. We keep the record of your consent choice itself so the app remembers what you decided. If you want everything removed from an iOS device, ask us at privacy@momentbound.app.

We store nothing for advertising or cross-site tracking, in either place, and none of it is readable by another site for that purpose.

13. Security

• All traffic is encrypted in transit.
• Media is held in a private storage bucket that is not publicly listable, and is served through short-lived signed links or a controlled delivery domain.
• Embedded location is removed from uploaded files when they arrive and held separately. Guest and shared downloads therefore cannot reveal where a file was taken from the file itself. Member original-downloads may restore that metadata.
• Administrative access is limited to the purposes in section 6.4.
• We apply rate limits and validate uploaded files.

No service is perfectly secure. If you find a vulnerability, please tell us at security@momentbound.app rather than publishing it.

14. AI and automated decisions

We do not use your photos, videos, or captions to train AI models. We do not run face recognition or automated content analysis. We make no automated decisions that have a legal or similarly significant effect on you.

If this ever changes, we will update this policy and, where required, ask for your consent first.

15. Beta

Momentbound is early software. During beta:

• We intend to keep your uploads and to migrate them as the product changes.
• We cannot guarantee against data loss. Keep your own copies of anything irreplaceable.
• Features, limits, and this policy may change.

16. Changes to this policy

We will post any new version here with a new effective date. For changes that materially affect how we use your data, we will notify you by email or in the app before they take effect. Previous versions are archived and available on request.

17. Contact

Tollånes Development Privacy: privacy@momentbound.app Support: support@momentbound.app Abuse: abuse@momentbound.app Security: security@momentbound.app