About Memoir
Who runs it
Memoir is made by David Orban and run by Actioneer, Inc., New York.
You can write to us at memoir@ai.davidorban.com.
What we promise about privacy
A memoir is private family material. Every memoir made through sign-up is encrypted with its own key. There are two ways to hold that key, and you choose.
Standard: sign in and it opens
This is how every memoir starts. You sign in with Google, Apple, a code sent by email or a passkey. There is no link to keep and nothing to lose, and a new phone or computer works as soon as you sign in.
The key to your memoir is kept locked by a second key that lives only in the server's settings, apart from the data and from every backup. A stolen disk or a leaked backup opens nothing. No tool our staff use can open a memoir.
What Standard does not give: the company holds both keys, so it could decrypt a memoir by deliberate effort. In Standard our promise is "we have built no way to read your memoir and we do not". It is not "we are unable to".
Private lock: only you can open it
You can switch on Private lock in your settings. Your device then makes a secret of its own, your memoir's key is locked with it, and the server's copy is destroyed. From then on the company cannot decrypt what is stored at all.
You still sign in as before, and your device supplies the secret. You also get a recovery sheet, shown once, to print or write down, so a new device can open your memoir. You may name one family member whose own secret also opens it.
If your device's copy, the recovery sheet and that family member are all lost, nobody can open your memoir, not even us. Memoir says so before you switch Private lock on. It can be switched off again only by someone who can still open the memoir.
The promise, row by row
This holds in both ways, except where a row says otherwise. It includes the two things we cannot promise.
| Claim | True? |
|---|---|
| Nobody with access to the server's disk, database, backups or logs can read your memories. | Yes. In Standard the key is kept apart from the data and from backups; with Private lock the server does not have it at all. |
| No administrator command or screen can open your memories. | Yes. The tools we use to look after Memoir refuse to open a protected memoir. |
| We can see that your account exists, its email, its plan, and counts such as how many memories and photos it holds and when it was last used. | Yes. That is account data, kept apart from the memoir. |
| Your words never exist unencrypted on the server. | No. The interviewer is a language model that runs through our server. While you are in a conversation, your words are in the server's memory and are sent to the model provider. |
| A dishonest operator could never get at your memories. | No. Someone who changes the server's code could capture your key the next time you sign in. The design removes standing and accidental access, and makes deliberate access require a visible change to the code. It does not make it impossible. |
While you use Memoir, the key is held in the server's memory and is dropped after 30 minutes without use or when you sign out. No key is ever written to a log.
Where this stands today
Sign-up, Standard and Private lock are being built and are not open yet.
The few people who used Memoir before sign-up existed keep their personal link and have their memories stored as before, in a form the people running the server can read. Each of them can choose to move to Standard; nobody is moved without being asked, and the old link stops working only after they have signed in and opened their memoir.