Privacy Policy

Effective 1 September 2026Last updated 1 September 2026

Your memories are personal. We take that seriously. This policy explains what data we collect, why we collect it, and what rights you have over it. We’ve tried to write it in plain language — no legal fog.

Got questions? Reach out at legal@rimembo.com anytime.

Who we are

Rimembo is a personal memory and storytelling app that helps you capture what matters — moments, habits, stories, the details that slip away — by recording your voice or writing them down.

The data controller responsible for your personal data is HonestButton Lda, a company registered in Portugal, with its registered office at Rua Rio Zêzere n.º 34, 2865-550 Fernão Ferro, Portugal. We’re responsible for handling your data in line with the GDPR and Portuguese data protection law.

What data we collect

We only collect what we actually need to run the service.

Information you give us

Account details — your email address and password (or, if you use Apple or Google sign-in, an identifier from them). We don’t ask for your real name or a profile photo.
Your handle — the username you’re given, and any handle you choose later.
Memory content — your voice recordings, and any text you write in the app.
Content our AI creates from yours — the transcript of what you said, the story written from it, its title, summary, and topic category.
Predictions and challenges — the questions you ask, any extra context you provide, the estimates produced, and the challenges you create and mark as kept or missed.
Support messages — anything you send us when you need help.

Payment information

If you subscribe, your payment is processed by Apple or Google through their app stores. We never see or store your card details. We receive only a confirmation of your subscription status through our subscription provider (RevenueCat) — whether you’re subscribed, on which plan, and when it renews or ends.

Data we collect automatically

Device and app info — device type, operating system, app version, and app-generated identifiers.
Usage data — which screens you open and which features you use, so we can understand what’s working. (See Analytics below.)
Diagnostics — crash reports and error logs used to fix problems.
Technical logs — including your IP address, recorded by our infrastructure providers when your app talks to our servers.

What we don’t collect

We want to be specific, because vague privacy policies hide things:

We don’t collect your GPS location. The app never asks for location permission.
We don’t access your photos, contacts, calendar, or microphone outside of a recording you deliberately start.
We don’t track you across other apps or websites, and we don’t use advertising identifiers.

Data from third parties

If you sign in with Google or Apple, we receive an account identifier and your email address. Apple lets you hide your real address and use a private relay instead — that works with Rimembo, and if you choose it, the relay address is all we ever see.

Why we collect it, and our legal basis

If you’re in the EEA, the GDPR requires us to have a legal basis for each use. Here’s ours, plainly:

What we do	Why	Legal basis
Store your memories, recordings, and stories	It’s the service you signed up for	Contract
Transcribe your recording and write your story with AI	It’s the core feature, and it happens for every memory	Contract
Generate a prediction from your saved memories, when you ask	You asked for it	Contract
Manage your account, handle, and subscription	To run your account	Contract
Send service messages — security alerts, billing notices, changes to this policy	To keep you informed and meet our obligations	Contract / Legal obligation
Send reminder notifications to record a memory	Only if you turn them on	Consent
Send marketing or product-news emails	Only if you opt in	Consent
Analytics on how the app is used	To improve the product	Legitimate interests
Crash and error diagnostics	To fix what’s broken	Legitimate interests
Prevent abuse, fraud, and enforce usage limits	To keep Rimembo working for everyone	Legitimate interests
Keep records the law requires	Tax and accounting	Legal obligation

Where we rely on consent, you can withdraw it at any time — in the app’s settings for notifications, via the unsubscribe link in any marketing email, or by writing to legal@rimembo.com. Withdrawing consent doesn’t affect what happened before.

Where we rely on legitimate interests, we’ve weighed our interest against your privacy, and you can object at any time (see Your rights).

AI features and your content

This is the part most people care about, so here it is in full.

What gets sent. When you save a memory, its audio recording — or the text you typed — is sent to our AI provider, Google (Gemini), to be transcribed and rewritten as a story. When you ask for a prediction, the app selects the memories most relevant to your question and sends those, along with your question, to the same provider.

Under what terms. This processing happens under Google’s business terms for their AI platform, which prohibit using your content to train their models. Your content is processed to return a result and is not retained for their own purposes.

Where. This processing takes place on Google infrastructure, which may be located outside the EEA (see International data transfers).

Our firm commitments:

We do not use your memory content to train AI models — not ours, not anyone else’s.
We do not use your memories for advertising, and we do not sell them.
No human at Rimembo reads your memories as a routine matter. We may access specific content only if you ask us to for support, if we’re legally required to, or if we must investigate a serious safety or security issue — and we’ll tell you where we can.

AI processing is not optional, because it is the service: without it there’s no transcript and no story. If you’d rather your voice not be processed by an AI provider, Rimembo isn’t the right app for you, and we’d rather say that clearly than bury it.

Sensitive information in your memories

This one deserves saying out loud. Because Rimembo holds whatever you choose to tell it, your memories may contain information that data protection law treats as especially sensitive — about your health, your religious or philosophical beliefs, your political views, your sex life or sexual orientation, your ethnic origin, or trade union membership. A memory about an illness, a funeral, a coming out, or a difficult diagnosis is exactly that kind of information.

We don’t ask for it, we don’t look for it, and we don’t sort your memories by it. But we can’t prevent it either, because that would mean reading your memories to decide what you’re allowed to keep.

Under the GDPR, we rely on your explicit consent (Article 9(2)(a)) to process this kind of information: by choosing to save a memory containing it, you are asking us to store and process it so the app can work. You can withdraw that consent at any time by deleting the memory, or your whole account. We use it for nothing beyond delivering the service to you — never for advertising, profiling you commercially, or training AI models.

Voice recordings

Your recordings deserve their own section, because a voice is more personal than most data.

Recordings are stored in your private area of our cloud storage. Access is restricted to your account by security rules.
They are never public, and never listed anywhere another user can reach.
We don’t analyse your voice to identify you, infer your emotions, or build a voiceprint. We use it for one purpose: turning what you said into text.
Because of that, your recordings are not “biometric data” under the GDPR: a voice only becomes biometric data when it’s processed to identify someone uniquely, and we never do that. If that ever changes, we’ll tell you first and ask for your consent.
Other people in your recordings: a memory may capture someone else’s voice or details. Under the GDPR that makes them a data subject too. We process that content only to deliver your memory, and if someone contacts us about a recording that includes them, we’ll act on it. Please get people’s permission before recording them.

Analytics

We use Google Analytics for Firebase to understand how the app is used — which screens are opened, which features are used, whether a signup or subscription completed.

The website is separate, and asks first. rimembo.com counts page views with a cookieless counter that stores nothing on your device, and additionally with Google Analytics — but only for visitors who accept when asked. Advertising features are switched off on that property. The cookie policy sets out both in full.

Analytics never receives the content of your memories, your recordings, your predictions, or your questions. It sees that things happened, never what they contained. Events are linked to your account identifier — an anonymous string, not your email.

Predictions, and what the law calls profiling

When you ask for a prediction, we analyse your saved memories automatically to produce an estimate about your life. Under the GDPR that counts as profiling — automated processing used to evaluate or predict personal aspects of someone — so we’d rather name it than let you discover it.

Three things about it: it only ever happens when you ask for it, never in the background; it produces a reflective estimate, not a decision about you, so nothing legal or similarly significant follows from it; and no human at Rimembo reviews the result.

We do not profile you for advertising, credit, insurance, employment, pricing, or any assessment of you as a person. If you never use predictions, this processing never happens. Deleting a prediction removes it and the analysis behind it.

We do not sell your data. Full stop.

We work with a small number of providers, each bound by a data processing agreement and each getting only what they need:

Provider	What they handle	Where
Google Firebase / Google Cloud	Accounts, database, file storage, hosting	United States
Google (Gemini AI)	Transcription, story writing, predictions	United States
Apple / Google Play	Sign-in and payment processing	Global
RevenueCat	Subscription status	United States
OneSignal	Push notifications, and service and marketing email	United States
Cloudflare	Hosting rimembo.com, its DNS, and a cookieless page-view count	United States / global edge
Google Analytics	Website visit statistics — only if you accept cookies on rimembo.com	United States

We may also disclose data if required by law, court order, or to protect the safety of our users or the platform. If Rimembo is ever sold or merged, we’ll tell you before your data moves to a new owner, and this policy will continue to apply until you’re told otherwise.

Sharing between users: Rimembo doesn’t have in-app sharing between accounts. If you create a sharing card and send it, you’re sharing it yourself, outside Rimembo — and once someone has it, we can’t take it back.

International data transfers

We’re based in Portugal, but our infrastructure and AI providers process data in the United States. Your memories, recordings, and account data are therefore transferred outside the EEA.

Where that happens, we rely on safeguards approved under the GDPR: the EU-US Data Privacy Framework where the provider is certified, and the European Commission’s Standard Contractual Clauses where it isn’t, together with the provider’s technical protections. You can ask us for details of the safeguards used for any provider at legal@rimembo.com.

How long we keep your data

While your account exists, we keep your memories for as long as you keep them — that’s the point of the app.

When you delete a memory, it is removed, along with its recording and the story built from it.

When you delete your account, everything you own is deleted: memories, recordings, predictions, challenges, your handle, and your account record. This is permanent and cannot be undone — there’s no recovery window and no archive to restore from.

Timings, honestly:

Live data: deleted immediately when the deletion runs.
Encrypted backups: copies may persist in our infrastructure provider’s encrypted backups for up to 30 days before ageing out automatically. They are never used to restore an account you deleted.
Records the law requires: payment and tax records are kept as long as Portuguese law requires (currently 10 years), separately from your memories.

Anonymised, aggregated statistics that can’t identify you may be kept indefinitely.

Other things we hold, and for how long:

Technical logs, including IP addresses — kept short-term by our infrastructure providers for security and troubleshooting, then deleted automatically.
Analytics events — retained in aggregate; they carry no memory content and aren’t tied to your email.
Support emails — kept while we deal with your request and for a reasonable period afterwards.

Accounts nobody uses. Privacy law says we shouldn’t keep personal data longer than we need it, and an account no one has opened in years is exactly that. If an account goes unused for a very long time, we may close it and delete its content — but we’ll email you at least 30 days beforehand, and simply opening the app is enough to keep it. Accounts with an active paid subscription are never closed this way.

Your rights

Under the GDPR you have the right to:

Access — get a copy of what we hold about you.
Correction — have anything wrong or incomplete fixed.
Deletion — have your data erased (“right to be forgotten”).
Restriction — limit how we process it in certain situations.
Portability — receive your data in a machine-readable format, or have it sent to another provider.
Objection — object to processing based on legitimate interests, and to direct marketing at any time.
Withdraw consent — where we rely on consent, take it back at any time.
Not be subject to automated decision-making — we don’t make decisions with legal or similarly significant effects about you automatically. Predictions are not decisions about you; they’re reflective estimates you asked for.

How to exercise them: delete memories or your whole account directly in the app, or email legal@rimembo.com. We’ll respond within one month, as the GDPR requires (extendable by two further months for complex requests, in which case we’ll tell you).

Complaints: you can complain to your local data protection authority. In Portugal that’s the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt. We’d appreciate the chance to put things right first.

How we keep your data safe

Encryption in transit (TLS) and at rest, across all storage.
Access controls enforced at the database and storage layer, so one account’s memories can’t be reached by another.
No permanent public links to your recordings.
Optional app lock — you can require a PIN to reopen Rimembo.
Access by our own team is limited to what’s necessary to operate the service.

No system is completely foolproof. If a breach affects your personal data and is likely to put your rights at risk, we’ll notify the CNPD within 72 hours and tell you without undue delay.

Your side of it: use a strong, unique password, keep your login details private, and turn on the app lock if you share your device.

Children’s privacy

Rimembo isn’t designed for children under 13, and we don’t knowingly collect data from them. In some EU countries the minimum age for consenting on your own is higher (up to 16); below that age, a parent or guardian must consent.

If we learn that a child below the applicable age has signed up without that consent, we’ll delete the account promptly. If you think this has happened, tell us at legal@rimembo.com.

Cookies and tracking

Rimembo is a mobile app and doesn’t use cookies. We don’t operate a web version of the app.

Our website (www.rimembo.com) sets no cookies at all. It stores one thing, and only if you ask for it: your light/dark choice, kept in your browser and never sent to us. See our Cookie Policy for the detail.

The app uses local storage on your device to remember your settings and keep you signed in. That data stays on your device and is removed when you delete the app.

Updates to this policy

We’ll update this policy when our practices change or the law requires it. If anything significant changes, we’ll tell you by email or in the app at least 30 days before it takes effect, and update the date at the top.

Get in touch

Questions, requests, or concerns — we’re here.

Email: legal@rimembo.com

Website: www.rimembo.com