Security and privacy, explained plainly
Memo encrypts your memories on your device; here is exactly what the server can and cannot see.
Profiles and group trips are separate from your personal encrypted vault. Names, photos, group memberships and shared locations are readable on the server. Locations are shown only to accepted trip members and erased when sharing stops or expires.
Encryption on your device
Your device encrypts every memory with keys derived from your password (Argon2id) before upload. Text memories are stored on the server only as ciphertext.
Your password never reaches us
We receive only a derived authentication key, which cannot decrypt anything. Website passwords you store are encrypted — never hashed — so only you can reveal them.
Password reset by SMS
Your recovery key is stored on our server, encrypted with a server key. After you confirm your number with an SMS code, the server releases it to your browser so you can set a new password without losing data. This means anyone who controls our server and that key could decrypt your memories; every such release is logged.
Voice, photos and files stay on your device
Attachments are encrypted and kept only in this browser or app. They are not uploaded or synced, so they are not available on your other devices, and clearing the browser's site data removes them.
Secrets stay sealed
Secret fields are stored in a separately encrypted part, revealed only after you re-enter your password, and hidden again automatically. They are never indexed or shown in notifications.
What we can see
Your mobile number, when you sign in, how many records you have and their approximate size, group-trip details you share, and — only if you turn on reliable notifications — when reminders are due.
Honest limits
A web app is only as safe as the code it loads; we use a strict Content Security Policy and no third-party scripts. A device infected with malware can read what you unlock. Browsers cannot block screenshots.