Draft, under legal review

Privacy

Draft of 14 November 2026. This page may change before it is final.

This page says what Memoir keeps, who else receives any of it, and how to have it deleted. Memoir is run by Actioneer, Inc., New York. Questions go to memoir@ai.davidorban.com.

What Memoir keeps

• Your name, your language and the topics you can talk about.
• Your conversations: what you wrote or said, as text, and what the interviewer asked.
• Your memory cards, made from those conversations, each with a quote in your own words.
• Photos you add, as a smaller copy. The date and place your camera recorded are read from the original file; the original file is not kept.
• When you speak, the words, as text. The sound of your voice is not kept.
• Your twin's search index, which holds the text of your memory cards. It runs on Memoir's own server.
• Documents, or transcripts of earlier interviews, that you or your family give us to import, and the memory cards made from them.
• If you have a personal link from before sign-up: a fingerprint of it, never the link itself.
• When sign-up and payment open: your email address, your plan, and counts such as how many memories and photos your memoir holds and when it was last used. This is account data, kept apart from the memoir.

What your browser keeps

If you have a personal link, your browser keeps it in its own storage, so you do not have to open the link each time. With Private lock, your device also keeps the secret that opens your memoir. Memoir sets no cookies and uses no trackers, analytics, advertising, or scripts or fonts from other sites.

Who else receives something

• Anthropic runs the language model that conducts the interview and writes the memory cards. For each answer you give, it receives the conversation so far, what is already known on the topic, and any photo you add. It receives them for the length of that request.
• OpenAI runs the voice model. When you choose to speak, your voice goes from your browser to OpenAI, and the words of both sides come back as text, for the length of the conversation.
• The twin's answers are written by a language model from the memories the twin finds. The provider that does this will be named here before this page is final.
• Gladia may transcribe a recording of an interview held elsewhere, if you or your family give us one to import.
• Clerk will handle signing in when sign-up opens. Clerk sees your email, how you sign in and when, and nothing of the memoir.
• Stripe will handle payment when paid plans open. Stripe sees the buyer's email, card details and plan; we see the email and the plan, not the card. Nothing from the memoir goes to Stripe.
• Email will carry sign-up confirmation, receipts and support. Under sign-up it never carries your personal link or any memory. Before sign-up existed, the first people using Memoir received their link by email.
• Hetzner stores Memoir's backups, which are encrypted before they leave the server.

Encryption

• The connection between your browser and Memoir is encrypted (HTTPS).
• Backups are made every hour and are encrypted.
• Every memoir made through sign-up will be encrypted with its own key: conversations, memory cards, photos, documents, the timeline, the map and the twin's search index. There are two ways to hold that key.

Standard

This is the default. The key to your memoir is kept locked by a second key that lives only in the server's settings, apart from the data and from every backup, so a stolen disk or a leaked backup opens nothing. No tool our staff use can open a memoir. But the company holds both keys, so it could decrypt a memoir by deliberate effort. In Standard our promise is "we have built no way to read your memoir and we do not". It is not "we are unable to".

Private lock

You can switch this on in your settings. Your device makes a secret, your memoir's key is locked with it, and the server's copy is destroyed, so the company cannot decrypt what is stored at all. A recovery sheet you print or write down, and one family member you may name, can also open it. If all of these are lost, nobody can open your memoir, not even us.

In both

• While you use Memoir, the key is held in the server's memory and is dropped after 30 minutes without use or when you sign out. No key is ever written to a log.
• During a conversation your words are in the server's memory and are sent to the model providers named above. Someone who changed the server's code could capture a key the next time its owner signs in. The design makes that require a visible change to the code; it does not make it impossible. The About page sets out the whole promise.
• Sign-up, Standard and Private lock are being built and are not open yet. The people who used Memoir before sign-up have their memories stored as before, in a form the people running the server can read, until they choose to move.

Logs

Memoir's logs hold no words you said or were told.

Who can open your memoir

When sign-up opens, you open your memoir by signing in, and with Private lock only your device, your recovery sheet or the family member you name can open it.

If you have a personal link from before sign-up, anyone who has that link can read your memories and add to them. Keep it private. If you think someone else has it, write to us: we issue a new link and the old one stops working.

Removing and deleting

• You can remove any memory card yourself, in the app. It is taken out of your twin too.
• To delete everything, write to memoir@ai.davidorban.com. We delete your conversations, memory cards, photos and twin.
• Copies in backups made before the deletion are not changed. How long they are kept will be stated here before this page is final.

Search engines

The public pages (this one, the home page, About, Terms and Sign up) may appear in search results. The app and everything in it are marked so that search engines do not index them.