Privacy Policy — Memglow by LumaPlot

1 Overview

Memglow is a personal relationship memory app built and operated by LumaPlot. We help you capture meaningful details about the people in your life, through voice notes or text, using AI to extract and organize what matters.

We take your privacy seriously. This policy explains what information we collect when you use Memglow, why we collect it, how we use and protect it, and the choices you have regarding your data.

By using Memglow, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the app.

2 Information We Collect

We collect only the information necessary to provide Memglow's core functionality:

Account information. Your email address, collected when you sign in to Memglow via email one-time password (OTP). We use this to authenticate your identity, associate your data with your account, send you service emails about your account (such as account deletion confirmations and notices about stored recordings), and, if you have it enabled, send you a periodic relationship digest email (see Section 3).
Voice recordings. Audio files recorded within the app when you use voice capture mode. These are transmitted to our servers for transcription and are deleted from our servers after transcription completes. On Pro, if you turn on "Store recordings" in Settings, recordings are kept from the time of recording for the period your plan includes (see Data Retention).
Notes and contact data. The text notes you type or dictate, and the names and details of the contacts you enter or create within the app. This information is stored in your account and visible only to you.
iPhone contacts you choose to import. In Memglow 1.7 and later, you can import people from your iPhone's Contacts. Memglow reads your contacts on your device only after you grant access, and saves only the contacts you pick: their name, company, job title, birthday and photo, plus a link to the iPhone contact so that a later change to the name or photo there can be carried into Memglow. Memglow does not upload the rest of your address book. Memglow never adds, changes or deletes anything in your Contacts. It does not watch your Contacts in the background or import anyone on its own: you choose who to import, and the names and photos of linked contacts are updated only when you open Settings → Sync new contacts or re-link a contact. When you import or sync contacts, Memglow does not request phone numbers, email addresses, postal addresses or notes, and it never saves them. If you link a contact by hand using the iPhone contact picker, iOS passes Memglow the whole contact card, and Memglow discards everything except the details listed above before anything is saved. You can import more people at any time from Settings → Sync new contacts, and unlink a contact from Contact settings on that contact's page. To stop Memglow reading your Contacts, turn off its Contacts access in your iPhone's Settings.
AI-extracted facts. Structured information (including family details, interests, career context, life events, and other personal facts) extracted from your notes by our AI system. When you capture a note from the Capture tab, you review the facts before they are saved, and you can uncheck or edit any of them. In Memglow 1.7 and later, the note you capture during onboarding is saved with all of its extracted facts, without a review screen.
Session data. Authentication tokens used to maintain your logged-in session. These are stored encrypted on your device using Apple's iOS Keychain and are never stored in plain text.

We do not collect location data, advertising IDs, or any usage analytics beyond what is required to operate the service. If you allow notifications, we store a push notification token for your device so that we can send them.

3 How We Use Your Information

We use the information we collect exclusively to operate and improve Memglow:

To authenticate your identity and maintain your session securely.
To store, retrieve, and enable full-text search of your notes and contact profiles.
To transcribe voice recordings into text. Audio is processed server-side via OpenAI's transcription API. OpenAI does not use your audio to train its models; its handling and retention of API data are governed by its published policies (linked in Section 4).
To extract structured facts from your notes and keep each contact's summary current. Your note text, the names of the facts already saved for that contact (not their values), and the contact's current summary are processed server-side via Anthropic's API. Anthropic does not use this data to train its models; its handling and retention of API data are governed by its published policies (see Section 4).
On Pro and during the free trial, to prepare an AI Brief when you ask for one. The context you type, the contact's summary, the contact's saved facts other than those marked sensitive, and your most recent notes about that contact are processed server-side via Anthropic's API. Notes that contain a sensitive fact are left out.
To display your saved facts back to you in an organized profile view.
To send you a relationship digest email, if enabled in Settings. The digest is sent to your account email address weekly on Pro or monthly on Core, and includes summary counts (memories, contacts, facts, streak) and the names of contacts whose relationship warmth has cooled. It does not include the text of your notes. You can turn digest emails off at any time in Settings, or via the unsubscribe link included in every digest email.

We do not use your data for advertising. We do not sell your data to any third party. We do not build profiles for third-party use. We do not share your data with any other users of the app.

4 Third-Party Services

Memglow uses the following third-party infrastructure providers. Each is used strictly to operate the app and is not permitted to use your data for any other purpose:

Supabase Provides our database, user authentication, and file storage infrastructure. Your notes, contacts, and account data are stored in Supabase's encrypted database with row-level security. Supabase cannot access your data across user accounts. supabase.com/privacy ↗

OpenAI (transcription API) Used server-side for voice-to-text transcription. When you record a voice note, the audio file is transmitted to OpenAI only for the purpose of transcription. OpenAI does not use your audio to train its models. Under its published API data policies, OpenAI may keep abuse monitoring logs for up to 30 days, or longer where the law requires. API credentials are never stored in the app and are never accessible from your device. openai.com/policies/privacy-policy ↗

Anthropic Used server-side for AI fact extraction, contact summaries and, on Pro, AI Briefs. For extraction, Anthropic receives your note text, the names of the facts already saved for that contact and the contact's summary. For an AI Brief, it receives the context you type, the contact's summary, its saved facts other than sensitive ones, and your recent notes about that contact. Anthropic does not use this data to train its models. Under its published API data policies, it deletes API inputs and outputs within 30 days, except where it must keep them longer to enforce its usage policy or to comply with the law. API credentials are never stored in the app and are never accessible from your device. anthropic.com/privacy ↗

Resend Used to send email from Memglow: the relationship digest, if you have it enabled, and service emails about your account, such as account deletion confirmations and notices about stored recordings. It also sends internal alerts to our own team when an account's usage is unusually heavy, and those alerts include the account's email address. Your email address and the content of each email are transmitted to Resend solely to send it on our behalf. Resend handles this data under its published privacy policy. resend.com/legal/privacy-policy ↗

Expo (push notifications) Used to deliver push notifications, such as follow up reminders and check in nudges, if you allow notifications. Expo receives your device's push notification token and the text of each notification, which can include a contact's first name, and passes them to Apple's push notification service for delivery. Expo handles this data under its published privacy policy. expo.dev/privacy ↗

No other third-party services receive your personal data. We do not use analytics platforms, advertising networks, or social login providers.

5 Data Retention

Voice recordings on Core are deleted from our servers after transcription completes.
Voice recordings on Pro are kept for 60 days from recording, up to 500 MB. When storage is full, the oldest recordings are removed to make room.
If your plan changes or lapses, stored recordings are removed after a 30 day grace period. We notify you by email when the period starts and again seven days before removal.
Notes, contact profiles and confirmed facts are kept in your account until you delete them.
Imported contact photos are deleted from our servers after you delete the contact, or with the rest of your data when you delete your account. Unlinking a contact from your iPhone keeps its photo until you delete the contact.
Backups. Residual copies of deleted data may persist in encrypted backups for up to 30 days before being purged.
Your account and all associated data are retained until you delete your account. Deletion completes 30 days after the request. During those 30 days you can restore your account by emailing support@memglow.ai.
Session tokens are stored on your device and expire automatically. They are cleared when you sign out.

6 Your Rights and Choices

You have meaningful control over your data in Memglow:

Access

You can view all your notes, contacts, and extracted facts at any time within the app. Nothing is hidden from you.

Deletion

You can delete individual notes or contacts directly in the app. Deleting a contact deletes its notes, facts and recordings. Deleting a note does not remove facts already saved from it. To have a single fact removed, email support@memglow.ai. To delete your account and all of your data, use Settings → Delete Account in the app, or email support@memglow.ai with the subject line "Delete My Account." Deletion completes 30 days after the request.

Portability

In-app data export is coming soon. In the meantime, you may request a copy of your data by emailing support@memglow.ai. We will provide your data in a machine-readable format.

Correction

You can edit a contact's name and delete any note or contact within the app. Saved notes and facts cannot be edited in the app today. To correct a saved fact or note, or any account-level information, contact us at support@memglow.ai.

You can turn off the relationship digest email at any time from Settings within the app, or by using the unsubscribe link included in any digest email you receive.

If you are located in the European Economic Area (EEA), United Kingdom, or California, you may have additional rights under applicable law, including the right to object to processing and to lodge a complaint with a supervisory authority. Contact us to exercise any of these rights.

7 Data Security

We take reasonable technical and organizational measures to protect your data. Specifically:

All data transmitted between the app and our servers is encrypted using HTTPS/TLS.
Database storage uses row-level security: your data is isolated from other users' data at the database layer.
Authentication tokens are stored in your device's iOS Keychain, Apple's secure credential storage system, and are never written to disk in plain text.
Our servers are hosted on Supabase's infrastructure, which maintains SOC 2 Type II compliance.
Voice recordings are deleted from our servers after transcription on Core, and after the retention period your plan includes on Pro, minimizing the window of exposure.

No method of transmission over the Internet or electronic storage is 100% secure. While we use commercially reasonable means to protect your data, we cannot guarantee absolute security.

8 Children's Privacy

Memglow is not directed at or intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us immediately at support@memglow.ai and we will delete the information promptly.

9 Changes to This Policy

We may update this Privacy Policy from time to time. The Effective date at the top shows when the current version was published.

If we make material changes (changes that meaningfully affect how we collect, use, or share your data), we will tell you before they apply to you:

Changes that come with an app update apply to you from the first time you open that version of Memglow, after the app shows you a prominent notice describing them.
Other material changes will be notified by email (to the address associated with your account) and/or by a prominent notice within the app before they take effect.

For non-material changes, we will update the "Effective date" at the top of this policy. We encourage you to review this policy periodically.

Your continued use of Memglow after any changes to this policy constitutes your acceptance of those changes.

10 Contact

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us:

LumaPlot, makers of Memglow

support@memglow.ai

We aim to respond to all privacy-related inquiries within 5 business days.