mempit privacy policy

Optional cloud accounts · mempit 2.0 & web

mempit 2.0 adds Sign in with Apple and optional Supabase sync. It is in internal testing and prepared for App Store review; until it is released, App Store 1.0 remains local-only. Cloud accounts can also use mempit web. You can use either client without an account; device and browser guest content is copied only after an explicit choice.

What cloud use sends

Apple handles sign-in. Supabase processes the Apple account identifier, the email Apple supplies (including a private relay address if chosen), session credentials and the content you synchronize. The service also retains an encrypted Apple authorization credential so account deletion can revoke the app’s Apple authorization. The two apps have separate accounts and data stores; using the same Apple Account does not share your content with the other app or Mantinomia.

Cloud content includes saved text and links, original photos and files, filenames, dates, identifiers, change history and conflict copies. Signed-in buckets and their exact items are also mirrored privately; a bucket owner may explicitly invite members. Chosen member names are visible within that bucket. Unfinished drafts, guest buckets and unassigned incoming shares remain in device storage. Selected pipeline input is stored privately. New explicit project orders can authorize development as described in the pipelines section; ordinary bucket items and historical storage-only captures do not. Saved account memories synchronize automatically when the app is open and connected. Copying the original device library requires a separate confirmation.

Providers, access and purpose

Supabase provides authentication, the database and server functions, plus private file storage. The database is configured in Frankfurt, Germany. Access controls restrict users to their own memories and files, and buckets they own or have explicitly joined. Bucket membership does not expose another person’s private Pit, files or pipelines. This is not end-to-end encryption: the service provider and authorized operator can process hosted content to run, secure and support the service.

Ordinary cloud library information is used to provide the account and sync service you request, not for advertising, tracking or AI processing. The legal basis is providing that requested service. Security, abuse prevention and necessary operational logs are handled for the legitimate interest of keeping the service reliable. Providers may process connection and diagnostic information, such as IP addresses, request times and errors. A Frankfurt database does not mean every provider operation takes place in the EEA. See Supabase’s privacy information and Apple’s privacy policy for their processing and international-transfer information.

Retention and deleting content

Deleting a cloud memory removes it from the active collection. mempit retains synchronization history, conflict copies and uploaded attachment bytes until the cloud account is deleted; deleting one memory does not erase those retained copies or immediately free its cloud storage.

To delete the account, open Settings and export → Account (iOS) or Cloud account (web), on iOS choose Delete cloud account…, then Confirm with Apple and complete sign-in. On the web, choose Delete cloud account and complete the requested fresh Apple sign-in; use Check pending deletion if completion is interrupted. Successful deletion removes the hosted account, memories, attachment bytes, retained history, signed-in bucket rows, private pipeline records and destination copies, plus this account’s cache, draft, buckets and assigned share originals on the requesting device. Unassigned shares and the separate device-only library remain. Contributions to another owner’s shared bucket remain with that owner. Apple authorization is revoked. If the app reports deletion pending, keep it installed and use its retry or finish-deletion action. Contact support if completion remains blocked.

The separate device-only library is retained. Signing out preserves an isolated account cache and unsynced work for your next sign-in; uninstalling removes local data but does not delete the cloud account. Other offline devices, exports, shared copies and device backups are not erased remotely. A limited deletion-completion record containing the account identifier and a hashed operation identifier remains to let interrupted clients confirm the outcome. It expires for this purpose after 30 days and is removed during later cleanup.

Backups and your privacy requests

Provider-managed database backups and operational logs may retain information after deletion from the live service until those copies expire. Supabase documents seven days of database backups for its standard Pro plan; this is disaster recovery, not an in-app restore promise. Database backups do not include original attachment bytes. mempit does not currently maintain an independent backup of cloud files; keep a separate export of important material. See Supabase’s backup documentation.

Contact mantinomia@gmail.com to request access, correction, deletion or a portable copy of your cloud data, or to exercise applicable rights to restriction or objection. We may need to verify the account before acting. You may complain to Datatilsynet. Content stored only on your device cannot be accessed by the developer.

Feedback sent to the developer

In the iPhone and iPad app, Settings → Feedback sends the title and message you write, with the app version and build, through oohaa.dev. No sign-in is needed, and your network address is used briefly to limit spam.

The web Settings feedback link opens the shared oohaa form. It sends only the title, message, optional contact details and disclosed app metadata you choose to submit. Feedback is delivered to the developer’s private mempit project feedback bucket for review, with a delivery copy retained by oohaa. These feedback messages do not automatically authorize development. Saved memories and files are not attached automatically.

These messages belong to a separate support process. Deleting a sender’s mempit account does not retract submitted feedback; contact the developer to request its removal. See the website privacy information for providers, retention and contact rights.

Browser storage and web hosting

mempit web is hosted on Vercel. Guest memories, original files, unfinished drafts and buckets are stored in this browser’s IndexedDB. Signed-in content uses a separate cache for each Supabase account. The same Apple account reaches the same private cloud records and original files as the iOS beta. Guest copying requires an explicit action.

The browser stores its sign-in session and refresh token in local storage and uses PKCE for Apple sign-in. Signing out retains isolated account content and queued originals for signing back into the same account. Clearing site data can remove these copies and unsynced work.

Vercel serves the static app and forwards authenticated file-verification, Apple credential-registration and account-deletion requests to the existing Supabase service. Original file bytes travel directly between the browser and Supabase. The forwarding service has no administrative database credential. Hosting providers may process request metadata, such as IP addresses, for delivery and operational logs.

The offline service-worker cache contains the static application shell and assets only. It does not cache account content, sign-in requests or deletion requests. There is no advertising or analytics SDK. Ordinary memories and buckets are not AI inputs; explicit owner project orders are described below. Browser exports are unencrypted ZIP files.

Who is responsible

mempit is provided by Ola Oldernes Hårstad. For privacy questions, contact mantinomia@gmail.com. This website is operated by Ola Oldernes Hårstad.

Device-only storage

mempit saves text, links, photos, and files you choose to capture, together with information needed to display and manage them, such as filenames, dates, and identifiers. Saved memories, attachment copies, and unfinished drafts are kept in the app’s storage on your device.

Device-only mode sends no memories to the app’s cloud service. Neither mode uses advertising, tracking SDKs or analytics SDKs. Ordinary memories are not processed by AI. The owner can separately authorize a selected project task through a pipeline.

Personal buckets and imports

Buckets are optional categories you create. A bucket item keeps the selected text, supplied source URL and metadata, note, capture date, memory reference and stable identifiers. Editing or deleting the separate normal memory does not rewrite the bucket item.

Guest buckets stay in that device library. When you are signed in, your personal buckets and their items are stored locally and mirrored privately through Supabase so they can appear on devices signed in to the same mempit account. They remain separate from normal memory sync records and ZIP exports.

When you choose mempit in another app’s share sheet, its text and URL are saved in local storage shared by mempit and its Share Extension. The Share Extension does not list accounts or destinations and makes no network request. The share remains unassigned until you explicitly choose a personal bucket or available pipeline in mempit. Import also creates a normal memory in the library you selected. The Save to mempit shortcut (Shortcuts, Siri) stores its text in the same local inbox in the same way, without a network request.

Successful account deletion removes signed-in bucket rows from Supabase and the account cache, draft, buckets, and assigned share originals on the requesting device. Guest buckets and unassigned shares remain. Content-free local import receipts can remain to prevent duplicate imports or reassignment to another library. A cleanup failure is reported and may leave isolated local copies.

Invited bucket members

Signed-in bucket owners can issue a one-use invitation link that expires after 24 hours. The link opens mempit.app, or can be pasted into the app. The service stores its hash. A recipient explicitly joins and supplies a member name, visible to that bucket’s members. Names are chosen labels, not verified identities. Members can read the bucket’s text, links, notes and supplied metadata, and add items. Membership does not expose the owner’s private Pit, files or pipelines.

Owners can remove members or stop sharing; members can leave. Access ends on the service, while cached content is removed from the shared view on the next successful refresh. Copies already saved cannot be recalled. Contributions remain with the bucket owner after a member leaves or deletes their account. Deleting an owner’s account removes their owned bucket, memberships and invitations. Bucket file sharing is not implemented. Report a concern in the app’s Bucket sharing screen opens an email to support; nothing is sent unless you send that email.

Developer-provisioned pipelines

Pipelines are private destinations configured by the developers. You cannot create, connect, retarget, or configure one. The web client offers project pipelines solely to the previously verified owner. Project feedback remains separate from executable orders. The iPhone and iPad app shows the same pipelines to that owner only. Guest libraries and other signed-in accounts receive no pipelines and no developer export actions.

If you explicitly choose a pipeline, mempit sends the exact selected text, supplied source URL and metadata, separate note, timestamp, optional memory reference and stable item identifier to Supabase. One transaction keeps a private MemPit delivery record and an exact private copy in that project’s destination table. Moving the item out withdraws that destination copy on the next successful sync; the account service retains its private delivery record until account deletion. Private executor recovery copies follow the separate removal process below.

In updated order clients, submitting a new owner pipeline order or explicitly promoting reviewed feedback authorizes development in that configured project. The connected executor may send the selected task text, note and source metadata to remote AI providers used by the developer (currently OpenAI through Codex). Promoted feedback can include optional contact details submitted with that feedback. The executor may perform development, checks and review, then publish code or builds through connected Git and release services. This is a separate requested use of selected input; it does not scan ordinary memories, buckets or unrelated account content. Older storage-only captures and offline queues do not become executable without a new explicit authorization.

Availability depends on the project’s connected and verified executor. The mempit web executor is connected; native delivery is being qualified separately. Storage, successful checks, publication and verified delivery have distinct status. A failed or blocked order is not reported delivered. Task records and recovery evidence are retained privately to finish or reconcile authorized work. Withdrawing an unfinished order blocks new dispatch and publication once the executor observes it. Already-running provider or test requests may continue; withdrawal does not confirm instant cancellation or recall a completed publication or copies already processed by a provider.

Account deletion removes the account’s owned delivery and order records, private review data and destination copies from the live account service. Independently submitted support feedback follows the separate removal process described above. Private local executor and recovery copies are managed separately by the developer; deleting live account records does not erase copies already received or independently published code or builds. Contact the developer to request removal of those private support or recovery copies. Provider-managed backups and operational logs may retain information until they expire under the retention practices described in the cloud section above.

Photos, files, and the clipboard

mempit uses the system photo and file pickers to access the items you select. It reads clipboard content when you choose Clipboard or use Paste. It does not continuously monitor your clipboard.

A photo or file provider may download a selected item from its own cloud service. That provider’s privacy practices apply to the transfer.

Sharing, exports, and links

When you share content or save an export, you choose its destination through the system interface. The recipient or service handles that copy under its own practices. Exports contain saved memories and original attachments, but exclude unfinished drafts, buckets, and incoming shares.

Exports are ordinary ZIP files without encryption or password protection. Save them somewhere you trust. Web links open using your device’s normal link handler; the destination website may process information about your visit.

Backups and device services

Your operating system may include mempit’s app data in device or cloud backups, depending on your settings. Device-only memories and guest buckets have no app-operated backup or synchronization service. Signed-in buckets use the optional Supabase mirror described above. Apple may process diagnostics or analytics under your Apple and device settings and Apple’s privacy policy.

Keeping and deleting memories

In device-only mode, saved content remains until you delete it or remove the app. Deleting a local memory removes it from the collection, and mempit attempts to remove associated files when they are no longer used by another saved memory. Temporary or unused local copies may remain if cleanup is interrupted.

Deleting the app removes its local data. Copies you shared or exported, and existing device backups, are managed separately. Keep a separate copy of important memories: the developer cannot recover your collection from your device.

Support and this website

If you email support, we use your email address and the information you send to respond. Include only what is needed to explain the issue. Correspondence is handled through Gmail (Google) and kept as needed to resolve the request, meet legal obligations, or establish, exercise, or defend legal claims.

This website uses no advertising or analytics. An essential cookie keeps the owner signed in to the private feedback inbox. If you submit website feedback, the message and optional contact details are stored separately from your app data. Vercel processes connection information to deliver and secure the pages. The website privacy information explains the legal basis, retention, international transfers, and your rights.

You can contact mantinomia@gmail.com to ask about or request access, correction, or deletion of support correspondence, or to exercise other applicable privacy rights. You may also complain to Datatilsynet, Norway’s data-protection authority. We cannot access, edit, or delete memories stored only on your device.

Changes to this policy

This policy covers mempit 1.0 and 2.0 for iPhone and iPad, internal test builds and mempit web. If its data practices change, we will update this page and provide any required notice or choices.