Privacy Policy

Operator: Hu Youzhe
Location: Japan
Contact: [email protected]

This policy describes how the Moment Log iOS app (the “app”) handles information. “We” means the operator identified above.

Moment Log helps you record everyday life and journeys. Journal content is primarily stored on your device. Maps, optional sign-in, purchases, analytics, advertising, iCloud backups and email feedback also involve the corresponding service providers. Creating a journal does not, by itself, give us a copy on an operator-run server.

1. Records, photos and location

Titles, journal text, comments, dates, places, coordinates, photos, Live Photos and journey information that you create or import are stored locally by the app. Comments form part of your private records; they are not posts in a public community.

When you select photos or grant photo access, the app reads the photos, Live Photo motion and audio components, and available metadata such as capture times and locations needed to import and organize them. Smart organization uses the date range you select and the photos you allow the app to access. Importing may create copies inside the app; deleting an original from your system photo library does not necessarily delete an imported copy.

New photo reminders are on by default. Within your photo access permission, the app checks dates, locations and small thumbnails on this device to find photos to organize. Discovery does not download iCloud originals, and saving requires your confirmation. You can turn reminders off in Settings. Candidates, scan progress, ignored date boundaries and identifiers of saved or explicitly deselected photos stay on this device to avoid reminding you about the same photos after you delete a record. Deleting the local account clears this state.

If you allow notifications, the app may notify you after checking photos when the system permits background execution. It also schedules periodic invitations to organize memories on this device. New photo and periodic reminders have separate settings. Execution and delivery depend on the system; there is no server push or continuously running background monitor. Notification permission and photo access are separate.

When you use the current-location feature and allow location access, the app obtains your location to display it or suggest places. The current version does not continuously record your movements in the background. Turning off location access does not remove locations already present in imported photos or places you added manually.

Image analysis and system-model-assisted filtering in the current smart organization feature use on-device capabilities. The app does not send photos or journal text to an external AI service. Looking up place names may still send coordinates or searches to a mapping service, as described in section 4.

2. Optional sign-in and profile

You can use the app as a guest. If you choose Apple or Google sign-in, that provider processes the sign-in request. The app receives and locally stores the account identifier and any name, email address or profile image the provider makes available with your authorization. Apple may supply a private relay address. Displaying a Google profile image may request the image from Google's servers. We do not receive your Apple or Google password.

The app also stores a local profile identifier, your chosen nickname and avatar, preferences and recent place searches. Signing in does not automatically upload journals or synchronize them between devices.

3. iCloud backups

If you meet the membership and Apple sign-in conditions shown in the app and iCloud is available on your device, you can choose to create a backup. It is saved in the app's container in the device's current iCloud account. It includes records, photos, Live Photos, journeys and information needed to associate the backup with its owner, including the Apple sign-in identifier. Apple stores and processes this backup through iCloud; we do not receive it on an operator-run server.

Backups are manual, not live synchronization. After a new backup succeeds, the app replaces the previous backup. Restoring replaces the corresponding local records and media. Deleting an individual local record does not update an existing cloud snapshot. You can use the cloud-backup deletion option or update cloud content through a later backup.

4. Maps and place searches

The app uses Apple Maps/MapKit and Google Maps to display maps, and Apple place search and system geocoding to look up places. Depending on the feature and provider, these services may process search text, queried coordinates, map areas, IP addresses and device or app information needed to provide the service.

Showing your own photo or journal markers on a map does not mean that the app uploads entire journals or photo files to the map provider. Choosing Apple Maps does not disable unrelated Firebase analytics or Google sign-in functionality.

See Apple Maps & Privacy and the Google Privacy Policy.

5. Usage analytics

The app uses Google's Firebase Analytics to understand feature usage and evaluate improvements. Current app-defined events cover entering main sections, changing map modes, saving records, updating record photos, completing smart organization, saving journeys, playing journeys, opening the membership page, opening the feedback option, showing, previewing, dismissing and saving discovered photos, and changing reminder preferences.

These events include counts and states: for example, photo counts, text length, whether a record has a location or is new, journey stop counts and the category of the selected organization date range—not the actual start or end dates. We do not include journal titles or text, comments, photo files, photo identifiers or paths, place names, precise coordinates, email addresses or feedback text in these events. We have not set an Analytics user ID corresponding to your sign-in account.

The Firebase SDK also processes app-instance identifiers, device and system information, app versions, sessions and engagement duration, and may automatically record lifecycle and store-purchase events. Google derives a general geographic area from IP information. Identifiers distinguish app instances, so analytics should not be understood as entirely anonymous.

Usage analytics starts after you actively agree to the Terms of Use and confirm that you have read this policy on first use. We do not collect app-defined or Firebase automatic events before that confirmation, and do not send a backlog of earlier actions afterward. There is no separate analytics choice or on/off setting in the app. Deleting the local account clears your terms confirmation and stops collection until you agree again. Local deletion does not automatically delete previously uploaded analytics. Section 9 explains your rights and how to contact us. See Privacy and Security in Firebase.

5.1 Advertising and privacy choices

The free version may show Google AdMob ads in the home journal list, during smart import, and before the first save of a new journey. An active Moment Log+ membership removes ads. We use non-personalized ad requests. The current version does not initiate an App Tracking Transparency (ATT) permission request or enable IDFA-based tracking.

To deliver and measure ads, prevent abuse, diagnose problems and improve services, the Google Mobile Ads SDK may process IP addresses and the approximate area derived from them, device and app information or identifiers, crash and performance information, and ad impressions, clicks and video views. This includes information processed by Google and parties involved in its advertising services. Non-personalized ads do not mean that no information is processed, no consent is needed, or all information is anonymous.

We do not send private photos or Live Photos, journal titles or text, comments, tags, capture dates, journey routes, precise locations, or photo identifiers or paths in ad requests. We do not use this content to target ads.

Advertising choices are managed through Google's User Messaging Platform (UMP), separately from usage analytics and notification or photo permissions. We present required messages based on applicable regional requirements and check whether ad requests are allowed using your choices and the current consent status. When required, you can review or change choices under “Settings → Terms & Privacy → Ad privacy options.” Agreeing to these terms does not replace any separate consent required for ads. Basic recording and saving remain available when ad requests are not allowed.

To control the interval between full-screen ads and avoid showing another ad for the same operation, the app keeps display times and the ad-handling state of an import or save on your device. We do not use these states as ad-request parameters. Ads can be closed according to their own rules; closing an ad or an ad-loading failure does not itself discard your selections or editing draft. Check the app's result to confirm that saving or importing completed. The usual draft-recovery rules apply when the app goes into the background or an operation is interrupted.

See the Google Privacy Policy and Google's explanation of advertising. Retention and rights concerning information processed by third parties also depend on their policies and applicable law. Deleting local records does not automatically delete advertising information already transmitted.

6. Purchases and membership

Apple's App Store processes payments for Moment Log+. We do not receive full payment credentials such as your card number.

The app uses RevenueCat to validate purchases, restore purchases and determine membership access. This involves a RevenueCat-assigned app user identifier, product and transaction information, purchase receipts, subscription periods, entitlement status, and device, app and service-connection information. The app does not set your Apple/Google sign-in name or email as RevenueCat attributes, or send it journal or photo content.

Purchase information is handled separately from local journals. Deleting a local account neither deletes transaction information held by Apple or RevenueCat nor cancels App Store subscriptions. See RevenueCat's Privacy Policy and Apple's Privacy Policy.

7. Sharing, feedback and app lock

When you share or export, selected text, images or journey content is passed to the app, recipient or system photo library you choose. Check places, people and other personal information before sharing. The recipient's subsequent handling depends on that service and your choices.

Feedback opens a draft in your email app; you decide what to include and whether to send it. If you send it, we receive your sender address, message and any attachments you add, so we can respond and address the issue. The app does not automatically attach journals or photos.

App lock uses system Face ID, Touch ID or device-passcode authentication. It receives the authentication result, not facial data, fingerprint templates or your passcode. App lock controls access; it does not mean the app separately encrypts every record.

8. Retention, other disclosures and security

Local records generally remain until you delete the relevant content, delete local information or remove app data. Copies you export or preserve in device-level backups must be managed separately.

iCloud backups remain until replaced or deleted; actual synchronization and deletion also depend on Apple's service. The current Google Analytics project retains event data for 2 months and user data for 14 months, with the user-data retention period reset when new user activity occurs. Aggregate reports are not necessarily subject to these periods and may remain longer.

Purchase information is retained as needed to verify access, restore purchases, handle refunds and meet applicable financial or legal obligations. Apple's and RevenueCat's processing is also subject to their applicable policies. Feedback email is retained only as needed to address the issue, follow up or resolve disputes, except where legal retention is required.

In addition to the providers described above and recipients you choose, we may disclose information we actually hold where required by applicable law, or where necessary and proportionate to address security incidents, fraud or legal claims.

Providers may process information outside your country or region, including at facilities in the United States. iCloud arrangements also depend on your account region. We cannot promise that all data stays on your device or in one country. Processing requiring additional notices, consent or safeguards under applicable law must meet those requirements; this policy does not replace necessary authorization.

We use app sandboxing, system permissions and providers' security mechanisms, and limit the use of and access to information we hold. No storage or transmission method can guarantee absolute security.

9. Your choices and rights

We save your terms confirmation on your device and do not ask again on ordinary restarts or sign-out. You can read both documents under Settings → Terms & Privacy. Deleting the local account clears this confirmation and stops analytics until you agree again.

You can adjust photo, location and biometric permissions in system settings; edit or delete records and profile information; clear place-search history; and choose whether to use sign-in, backups, sharing and feedback. Withdrawing permission affects the relevant feature but does not automatically delete imported content or information previously processed by providers.

The in-app local-account deletion flow clears associated local records, journeys, profile information and place-search history, and lets you choose whether to delete iCloud backups too. Signing out only ends the current sign-in session; it does not delete journals. Apple/Google authorizations can be managed separately in the corresponding account settings.

Contact the email above to request information about, correction, deletion or a copy of personal information we hold, or to exercise applicable rights to restrict or object to processing or withdraw consent. We respond within the period required by law and may need reasonable identity verification. We cannot remotely read or restore information stored only on your device. If an analytics identifier cannot be associated with you, we will explain identification and processing limits rather than ask you to send an entire journal. You may also complain to the relevant data-protection authority.

10. Minors

The app is intended for a general audience, not specifically for children. If you are below the age at which you can independently consent to relevant data processing or enter a contract where you live, use the app with a parent or guardian's guidance and obtain their consent where required. A parent or guardian who believes we have improperly handled a minor's information can contact us.

11. Changes and contact

We will update this policy and its date when information practices change. We will provide appropriate notice of material changes and seek separate consent where required by law. Contact the operator above with privacy questions. You may also request the operator's address and other legally disclosable particulars through that email; we will respond promptly as required by law.