Memories SaaS Privacy Policy

Effective October 14, 2026 · Version 1.0

This policy is a commitment by the operator of the official Memories SaaS service. It covers the website, Web client and hosted accounts at memories.ivjn.us. Contact us about privacy at info@ivjn.cn. If you connect to another operator's Center, consult that operator's policy for its handling of hosted data. Local vaults, encrypted device synchronization and our hosted service have different privacy boundaries.

Our commitments

We do not sell or rent personal information or vault content, or use it for advertising profiles or targeted advertising.
We do not use your memories, cards, files or credentials to train or fine-tune AI models, or provide that data to model providers for training.
We process data to deliver the services you request, protect security, handle support requests and meet legal obligations. We will explain unrelated new purposes in advance and obtain separate consent where required by law.
Staff access is limited to support you request, necessary troubleshooting or security investigations, and legally required processing. Access must be limited to the people, scope and duration needed for that purpose.
We do not make your content public to other users. Sharing and third-party access that you authorize operate within the permissions you grant.

Information we process

Information	Purpose
Email or username, verification status and account identifiers	Registration, mailbox verification, login and account administration; username registration does not require email
Salted password hashes, verification challenges, access tokens and permissions	Authentication, abuse prevention and access control; login passwords are not persisted in plaintext
Memories, cards, files, credentials, titles, tags, revisions and related metadata	Storage, retrieval, editing, downloads and authorized access at your request
Actions, timestamps, account or resource identifiers, grants and revocations	Security auditing, diagnostics and service maintenance
Connection information such as IP addresses, request times, paths, browser information and error status	Network delivery, security and diagnostics; infrastructure providers may also process this information
Information you choose to include in support correspondence	Responding to questions, verifying identity and handling privacy requests

Upload only information you are entitled to process. Never include a password, verification code or access token in support or privacy correspondence.

Protection and hosted-service limits

The website and API use HTTPS. Login passwords use salted Argon2id hashes. Hosted vault content is encrypted at rest on the server; separate vaults and permission checks isolate accounts. Account metadata, audit records and service configuration are protected by filesystem permissions; not every server file uses the same content encryption.

Our operator holds the server-side decryption capability. The official SaaS is not end-to-end encrypted against its operator. A private flag or account isolation does not prevent access by an authorized service administrator or a compromised server. Our purpose restrictions, access controls and security maintenance protect hosted data; no system can guarantee that breaches never occur.

The current Web client keeps passwords, login tokens and retrieved content in page memory rather than persistent browser storage. Account sessions last at most one hour. Backgrounding, disconnecting or five minutes of inactivity clears the page session. This mechanism does not protect against browser extensions, compromised devices, browser password managers or copies you download.

Infrastructure and third parties

Cloudflare provides website delivery, HTTPS proxying, routing and protection. It may process connection metadata, and the proxy can process request and response content in transit. Server and backup infrastructure hosts and restores the service. Tencent enterprise mail sends verification emails and processes recipient addresses, message content including verification codes, and delivery records. We do not include vault content in registration emails.

These are infrastructure uses needed to operate the service, not uses of your content for advertising or model training. If you authorize another client, AI tool or third party to access content, review its privacy policy separately. You may revoke access, but revocation cannot recall copies already received.

Network, mail and hosting infrastructure may process data outside your region. The service currently offers no user-selectable data residency guarantee. Where applicable law requires cross-border notices, consent or safeguards, we will meet those requirements.

Browser storage

The website and Web client use local storage for language preferences. The current application embeds no advertising or third-party behavioral analytics scripts and does not use cookies to store application login sessions. Infrastructure providers may use necessary mechanisms for security or request processing. Clearing browser site data resets preferences; it does not delete your server-side account or content.

Retention, deletion and account closure

We limit retention to service delivery, security auditing, recovery and applicable legal requirements. Content and revision history currently have no uniform automatic expiry. We have not committed to a fixed automatic purge period for audit records or backups. Information no longer needed should be deleted or anonymized; we will explain the scope and timing of a particular request after verification.

Deleting an item in the interface does not immediately erase its revision history, audit records or backups. Disabling an account does not erase its vault. There is currently no self-service complete-erasure or account-closure feature. Contact us to request removal of history, account closure or handling of personal information in backups. We will verify identity, explain available measures and expected timing, and report the outcome. If legal requirements or technical limitations prevent immediate deletion, we will explain the reason and retained scope and restrict use. Confirmed deletion or access restrictions must be reapplied when restoring backups.

Your rights and contact

Within product capabilities and applicable law, you may request access, correction, a copy, deletion, account closure, or restriction of or objection to processing. You may withdraw consent to optional processing based on consent without affecting earlier lawful processing. The current interface supports content editing and file downloads; contact us for full account exports, account-detail changes or closure.

Email info@ivjn.cn with the subject "Memories privacy request", your account identifier and your request. We will ask only for reasonably necessary identity checks, never your password, verification code or access token. We will respond within applicable legal deadlines and explain any request we cannot fulfill. You may also complain to the relevant data protection authority.

Incidents and updates

For security incidents affecting personal information, we will investigate, contain and remediate the issue, and notify affected users and authorities as required by applicable law. The service is in development; its safeguards are not an independent security audit or certification.

This page identifies its version and effective date. Material changes to data purposes, sharing or user rights will be announced before taking effect through a prominent website notice or an applicable account contact channel. We will obtain renewed consent where required. Publication or continued use alone does not constitute separate consent to new optional processing purposes.