Privacy Policy

Last Updated: November 4, 2026 Effective Date: November 4, 2026

Introduction

Welcome to Memory Row ("Memory Row Labs, Inc.," "we," "our," or "us"). We are a Delaware C-corporation committed to protecting your privacy and being transparent about how we collect, use, and share your personal information.

This Privacy Policy explains how Memory Row collects, uses, discloses, and safeguards your information when you use our mobile applications for iOS and Android (each an "App," and collectively the "Apps") and related services (collectively, the "Service").

Please read this Privacy Policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, do not use the Service.

Table of Contents

  1. Information We Collect
  2. How We Use Your Information
  3. How We Share Your Information
  4. Data Retention
  5. Your Privacy Rights
  6. Children's Privacy
  7. Security
  8. International Data Transfers
  9. Third-Party Services
  10. Changes to This Policy
  11. Contact Us

1. Information We Collect

We collect information in several ways: directly from you, automatically when you use the Service, and from third parties.

1.1 Information You Provide Directly

Account Information

Profile Information

Location Data We may collect location information in the following ways:

Sports and Activity Content

User-Generated Content

Social Connections

Communication Data

Payment Information

1.2 Information Collected Automatically

Device Information

Push Notification Data

Usage Information

Technical and Diagnostic Information

This diagnostic data is collected automatically to help us identify and fix bugs. It does not include the content of your posts, messages, or photos. Crash data is retained for 30 days (7 days after account deletion) and then permanently deleted.

Analytics Data

Content Analysis Data

1.3 Information from Third Parties

OAuth Providers When you sign in using Apple or Google, we receive:

Sports Data Providers We obtain game schedules, scores, and team information from sports data providers like ESPN to populate game information in the App. To show upcoming games and schedules, the App requests this public schedule data from ESPN directly from your device. ESPN receives the request, including your device's IP address, but we do not send ESPN your account details or any information about you.

1.4 If You Use Memory Row Without an Account (Guest Mode)

You can browse public content in the Apps — such as the Discover feed, public profiles, and public posts — without creating an account.

When you browse as a guest:

The rights described in Section 5 apply to personal information associated with an account. If you browsed as a guest and have a privacy question or request, you can still contact us using the details in Section 11.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Providing the Service

2.2 Improving the Service

2.3 Safety and Security

Automated Content Moderation: We use automated systems, including third-party services like Google Cloud Vision, to scan images you upload for potentially harmful content including adult material, violence, and other content that violates our Terms of Service. This scanning helps us maintain a safe environment for all users, particularly minors.

How automated scanning works:

Your rights regarding automated decisions (GDPR Article 22):

2.4 Communications

2.5 Legal Compliance

3. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

3.1 With Other Users

Based on your privacy settings, other users may see:

You can control the visibility of most of this information through your privacy settings.

3.2 With Service Providers

We share information with third-party vendors who help us operate the Service:

| Provider | Purpose | Data Shared | |----------|---------|-------------| | Railway | Cloud hosting (application servers and database) | All data processed through our servers | | Amazon Web Services (AWS) | Photo and image storage (S3) | Photos and images you upload, database backups | | Apple | Push notifications (iOS), payments (iOS) | Device tokens, transaction data | | Google | Push notifications (Android), payments (Android), sign-in | Device tokens, transaction data, OAuth data | | Google Firebase Analytics | Analytics and event tracking (iOS, Android, and server-side) | Usage events, device identifiers, IP address | | Google Cloud Vision | Automated image safety scanning | Images you upload | | Google Maps Platform | Venue mapping and location services (Android) | Venue search queries, approximate location when using map features | | Sentry | Error monitoring and crash reporting (server-side) | Error logs, stack traces, request metadata (IP addresses are not stored) | | Resend | Transactional emails | Email address |

These providers are contractually obligated to protect your information and use it only for the services they provide to us.

3.3 For Legal Reasons

We may disclose your information if required by law or if we believe in good faith that such action is necessary to:

3.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

3.5 With Your Consent

We may share your information with third parties when you give us explicit consent to do so.

3.6 With Linked Parents (Teens Ages 13–17)

If you are a teen user (13–17) and a parent or guardian has approved your account through our parental consent flow — and the email they used matches a Memory Row parent account — your parent's account is linked to yours. Once linked, the parent may view the following from within the Memory Row app:

The parent can also add or remove users from your approved-contacts list and toggle whether your DMs are enabled. The parent cannot read the contents of your messages, view your password, post as you, or impersonate you. A parent may unlink themselves at any time from My Family; unlinking removes their visibility into the items above but does not delete the teen account.

Visibility from the teen's side. Teen accounts can view, from within the Memory Row app on a "Linked Parent" screen in Settings, the identity of the linked parent and the categories of information listed above that the parent can see. This screen is informational; it is presented so the teen always knows what oversight is in effect.

Automatic end of parental oversight at 18. When a linked teen turns 18, the parent-teen link is dissolved automatically by a daily system job. At that point the parent loses all of the visibility described above, any parent-set DM restrictions (approved-contacts list and approved-contacts mode) are cleared, and the user's default-DM-audience setting reverts to the adult default ("everyone"). No action is required from either the parent or the (now-adult) user. The parent is notified that the link has ended.

To request that a parent link be revoked outside of the App before age 18, contact [email protected].

4. Data Retention

We retain your information for as long as your account is active or as needed to provide you the Service.

Active Accounts: Your data is retained while you use the Service.

Deleted Accounts: When you delete your account:

Specific Retention Periods:

| Data Type | Retention While Active | After Account Deletion | |-----------|----------------------|----------------------| | Account credentials (email, password hash) | Until you delete your account | 90 days, then permanently deleted (includes a 30-day window during which you can cancel deletion and recover your account) | | Profile information (name, bio, photos) | Until you delete your account | 90 days (to propagate removal from CDN/caches), then permanently deleted | | Posts, comments, and user content | Until you or we remove it | 90 days in backups, then permanently deleted. Exception: content shared with others remains under their accounts with your name anonymized | | Game logs and sports content | Until you delete it | 90 days, then permanently deleted | | Trading cards and virtual items | Until you delete your account | 90 days (recovery window), then permanently deleted | | Transaction/purchase records | Duration of account + 7 years | 7 years from transaction date (tax and legal requirements), stored in anonymized form | | Device tokens and push notification data | Until revoked by you or your device | 30 days, then permanently deleted | | Crash reports and error logs | 30 days from occurrence | 7 days, then permanently deleted | | Analytics and usage data | Aggregated within 30 days; individual data deleted after 30 days | First-party analytics anonymized upon account deletion; Firebase Analytics data expires per Google's standard retention settings | | Email and support communications | Duration of account + 2 years | 2 years after account deletion (for dispute resolution), then permanently deleted | | Backup and disaster recovery copies | Maintained per backup schedule | Purged from all backup systems within 90 days of deletion |

Teen Accounts (Ages 13-17): When a teen account is deleted, all data categories above follow an accelerated schedule: permanently deleted within 30 days of deletion (instead of the standard periods listed above), except for transaction records which follow the standard 7-year retention for legal/tax purposes.

Messages a teen deletes: When a user under 18 deletes a direct message they sent, it disappears from the conversation for everyone right away. We keep a copy for 90 days so our team can review it if a safety concern is reported, and then permanently delete it. This 90-day safety hold also applies if the teen's account is deleted.

Deletion Confirmation: We will confirm completion of your data deletion within 30 days of your request. You may check the status of a deletion request at [email protected].

To request deletion of your data, see Your Privacy Rights.

5. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information.

5.1 All Users

All users can:

5.2 European Economic Area (EEA) Residents

Under the General Data Protection Regulation (GDPR), you have the right to:

Right to Restriction of Processing (Article 18): You may request that we restrict (pause) processing of your data in the following situations:

When processing is restricted, we will store your data but will not process it further (except with your consent, for legal claims, to protect another person's rights, or for important public interest reasons). We will inform you before lifting any restriction.

Right to Data Portability (Article 20): You have the right to receive the personal data you provided to us in a structured, commonly used, machine-readable format. Specifically:

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (extendable by up to 60 additional days for complex requests, with notice to you).

You also have the right to lodge a complaint with your local data protection authority.

Legal Basis for Processing (GDPR Article 6):

We process your personal data only when we have a valid legal basis. The table below maps each data category to its legal basis:

| Data Category | Legal Basis | Explanation | |---------------|-------------|-------------| | Account information (email, username, password hash, date of birth) | Contract (Art. 6(1)(b)) | Necessary to create and manage your account | | Profile information (name, bio, photo, school, social handles) | Contract (Art. 6(1)(b)) | Necessary to provide profile features you use | | Sports content (game logs, ticket images, seat photos, notes) | Contract (Art. 6(1)(b)) | Core Service functionality you requested | | User-generated content (posts, comments, trading cards) | Contract (Art. 6(1)(b)) | Core Service functionality you requested | | Social connections (followers, following, tagged friends) | Contract (Art. 6(1)(b)) | Necessary to provide social features | | Payment/transaction records | Contract (Art. 6(1)(b)) and Legal obligation (Art. 6(1)(c)) | Necessary for purchases and tax/accounting compliance | | Device information and push notification tokens | Legitimate interests (Art. 6(1)(f)) | Necessary for Service delivery and security; you can disable push notifications | | Crash reports, error logs, and diagnostic data | Legitimate interests (Art. 6(1)(f)) | Necessary to maintain and improve Service stability | | Usage analytics and feature engagement | Legitimate interests (Art. 6(1)(f)) | Helps us improve the Service; data is aggregated within 30 days | | Firebase Analytics data (iOS and Android) | Legitimate interests (Art. 6(1)(f)) | Helps us understand feature usage and improve the Service; data processed by Google under DPA | | Sentry error monitoring data | Legitimate interests (Art. 6(1)(f)) | Necessary to maintain Service stability and fix errors | | Automated image safety scanning | Legitimate interests (Art. 6(1)(f)) | Necessary to protect users (especially minors) from harmful content | | Location data (hometown, venue-level) | Consent (Art. 6(1)(a)) | Collected only when you provide it or enable location services; you can withdraw consent | | Marketing and promotional communications | Consent (Art. 6(1)(a)) | Sent only with your opt-in consent; you may withdraw at any time | | OAuth sign-in data (Apple, Google) | Contract (Art. 6(1)(b)) | Necessary to authenticate your account | | Age verification data | Legal obligation (Art. 6(1)(c)) | Required under COPPA and other child protection laws | | Content moderation records | Legal obligation (Art. 6(1)(c)) and Legitimate interests (Art. 6(1)(f)) | Required under the EU Digital Services Act and to maintain community safety |

Where we rely on legitimate interests, we have conducted balancing tests to ensure our interests do not override your rights and freedoms. You may request a copy of our legitimate interest assessments by contacting [email protected].

Withdrawing consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing that occurred before withdrawal. To withdraw consent, adjust your settings in the App or contact [email protected].

5.3 California Residents

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have specific privacy rights. This section uses terms as defined in the CCPA/CPRA.

Your CCPA/CPRA Rights:

Sale and Sharing of Personal Information: We do not "sell" your personal information as defined by the CCPA (exchanging personal information for monetary consideration). We do not "share" your personal information as defined by the CPRA (making personal information available to third parties for cross-context behavioral advertising).

Because we do not sell or share personal information, no opt-out is required. If you have questions or wish to exercise any California privacy right, you may:

Categories of Personal Information Collected (past 12 months):

| CCPA Category | Examples | Business Purpose | Disclosed To | |---------------|----------|-----------------|--------------| | Identifiers | Name, email, username, device IDs | Account management, Service delivery | Service providers (AWS, email provider) | | Personal information (Cal. Civ. Code 1798.80) | Name, date of birth | Age verification, account management | Service providers | | Commercial information | Purchase/transaction records | Purchase processing, tax compliance | Apple/Google (payment processing) | | Internet or network activity | Usage data, feature interactions, crash logs | Service improvement, bug fixes | Service providers (AWS) | | Geolocation data | City/location you provide, venue-level GPS (with permission) | Game logging, venue tagging | Service providers (AWS) | | Audio, visual, or similar | Photos you upload | Content display, safety scanning | Service providers (AWS, Google Cloud Vision) | | Inferences | Content preferences, usage patterns | Service personalization | Not disclosed to third parties | | Sensitive personal information | Precise geolocation (when enabled), account credentials | Venue tagging, authentication | Service providers |

Verification: To protect your privacy, we will verify your identity before fulfilling CCPA requests. We may ask you to confirm your email address or provide other identifying information.

Authorized Agents: You may designate an authorized agent to make CCPA requests on your behalf. Authorized agents must provide signed written authorization and we may verify your identity directly.

How to Submit a Request: Contact us at [email protected] or use Settings > Manage Data in the App. We will respond within 45 days (extendable by up to 45 additional days with notice).

5.4 Other Jurisdictions

We respect privacy rights under applicable laws. Contact us at [email protected] to exercise any rights you may have.

6. Children's Privacy

Age Requirement: You must be at least 13 years old to use Memory Row.

We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will promptly delete that information.

Users Under 18 (Ages 13-17): We recognize that teen users deserve additional protections. For users under 18, the following safeguards apply:

Default Privacy Settings for Teen Accounts:

Data Protections for Teens:

Parental Consent Flow: When a teen ages 13–17 registers, we collect their parent or guardian's email address and send a consent notification to that address. While the request is pending, the teen cannot use the App — they see a waiting screen until the parent responds. The notification links to a review page where the parent can:

A parent who already has a Memory Row account may also manually link a teen from their My Family screen by entering the teen's username. We verify that the parent's account email matches the parent email the teen entered at registration before establishing the link.

Parental Rights and Oversight: Parents or legal guardians of users ages 13-17 may:

To exercise parental rights, contact us at [email protected] with:

  1. Your name and relationship to the teen
  2. The teen's username or email address
  3. A description of your request

We will verify your identity and relationship before processing any parental request. We will respond within 14 business days.

Teen Data Retention: When a teen account is deleted, all data follows an accelerated deletion schedule of 30 days (faster than the standard retention periods for adult accounts), as detailed in the retention table in Section 4 above. The exceptions are transaction records, which are retained for 7 years as required for tax and legal purposes, and direct messages the teen deleted, which are held for 90 days for safety review (see Section 4).

If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us immediately at [email protected]. We will delete the account and all associated information within 2 business days.

7. Security

We implement appropriate technical and organizational measures to protect your personal information, including:

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

If you discover a security vulnerability, please report it to [email protected]. We will investigate within 7 days, keep you informed of our response, and will not pursue legal action against good-faith security researchers.

7.1 Data Breach Notification

If we discover a breach of your personal information, we will:

Notification (within 30 days of discovery):

For breaches involving sensitive data (passwords, payment information, or government IDs):

Your responsibilities after a breach notification:

8. International Data Transfers

Memory Row Labs, Inc. is incorporated in Delaware and based in San Francisco, California, United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States.

For EEA Residents: When we transfer your data outside the EEA, we use appropriate safeguards such as:

By using the Service, you consent to the transfer of your information to the United States and other countries that may have different data protection laws than your country of residence.

9. Third-Party Services

The Service may contain links to third-party websites or services. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access.

Third-Party Integrations:

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Your continued use of the Service after changes become effective constitutes your acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Memory Row Labs, Inc. 2261 Market Street STE 64901 San Francisco, CA 94114

Email: [email protected]

For privacy-related requests: [email protected]

For legal inquiries: [email protected]

For security vulnerabilities: [email protected]

For support: [email protected]

Summary of Key Points

| Topic | Summary | |-------|---------| | What we collect | Account info, profile, content you create, device info, usage data | | Guest browsing | No account or profile is created; device, usage, and log data are still collected (Section 1.4) | | How we use it | Provide the service, improve features, ensure safety, communicate with you | | Who we share with | Other users (based on your settings), service providers, legal authorities when required | | Your rights | Access, correct, delete your data; control privacy settings; opt out of notifications | | Data retention | While your account is active; certain data retained after deletion for legal purposes | | Security | Encryption, access controls, regular assessments | | Children | Must be 13+ to use; additional protections for teens | | Contact | [email protected] |

This Privacy Policy is effective as of November 4, 2026.