MemoryScroll Privacy Policy
1. Introduction
The short version — please read this.
1. Our moderation team can see every video, photo, post and message that is uploaded to our servers. That includes everything you post to the Capture Circle and everything you send to a friend or in a chat, even when you sent it to one person only. We can view it at any time, whether or not anyone has reported it, for one purpose: to keep MemoryScroll a safe platform. Do not post or send anything you would not want our moderation team to be able to see.
2. Videos and photos you do not post or send stay on your device. They are never uploaded, and no one else — not us, not our moderators, not your friends — can view them.
The rest of this Policy explains the detail.
This Privacy Policy explains how information is handled when you use the MemoryScroll application for iPhone (the "App") and the MemoryScroll website at camerascroll.fit (the "Site", and together with the App, the "Service"). The Service is provided by Celeste Van Dokkum, an individual residing in Connecticut, United States ("we", "us", or "our").
The App was formerly named CameraScroll. That earlier name persists in the website address, which refers to this same Service. If you used the App under its old name, the album it created in your photo library is renamed from "CameraScroll Saved" to "MemoryScroll Saved" the first time you open this version; the photographs in it are untouched.
The App is currently distributed as a beta test through Apple TestFlight and is offered only in the United States. Beta software changes frequently; if a change alters how information is handled, this Policy will be updated before that build is released.
This Policy forms part of, and should be read together with, the Terms of Use. Terms defined in one document carry the same meaning in the other.
2. The distinction that explains everything else
The App has two halves, and almost every question about privacy is answered by knowing which half something belongs to.
Your own feed is private to your device. Scrolling your camera roll, analysing it, filtering it and choosing music all happen on your iPhone. Browsing uploads nothing. We never receive your photo library, and no employee, process or moderator can reach it.
The Capture Circle is online. When you choose to publish a post, send a clip, or write a message, that content is transmitted to our servers so the people you selected can receive it. From that point it is no longer private to you: the people you chose can watch it, and our moderation team can view it too, as described in section 9. Anything you do not post or send stays on your device, and no one else can view it.
Section 3 covers the private half. Sections 4 through 8 cover the online half.
3. Information that stays on your device
The following is written to the App's own storage area on your iPhone, is never transmitted to us, and is erased if you delete the App.
| What | What it is |
|---|---|
| Your photo library | Every photo, video and Live Photo the feed plays. The App reads them to display them and never copies or uploads them |
| Photograph analysis | Results from Apple's on-device Vision framework: subject labels, a category, a quality score, a flag for screenshots and receipts, an estimate of whether an item came from a camera or was imported, and a count of how many faces are in the image |
| Viewing history | Which items the feed has already shown, so it does not repeat them |
| Hidden items and days | What you asked never to see again |
| Preferences | Filters, years, categories, album, how your Liked feed is ordered, music on or off, whether documents and screen recordings are hidden, your home state, and whether the introductory tour is still waiting to be shown |
| Your date of birth | Entered when you create an account, checked against the 13+ rule on the device, and then discarded. It is never sent to us and we do not store it |
| Your agreement to these documents | The version accepted and the time, recorded on the device. The fact that you accepted is also recorded on your account, so a second device does not ask again |
| Diagnostics | A short log of the most recent library scan: counts, timings and errors, never photograph content, overwritten at each launch |
On face detection. The App records only a count of faces. It does not identify anyone, does not determine whose face has been detected, does not create or store a faceprint or facial template, and does not group items by person.
On photo locations. Coordinates saved inside a photograph by your camera are read on the device to show a place name, to show a full address when you open an item's details, and to work out whether an item was taken away from your home state. They are never uploaded to us. The one place a coordinate leaves your iPhone is the lookup that turns it into a name or an address, which iOS makes with Apple's geocoding service; that is described in section 11(a). Section 5.2 explains how coordinates are removed from anything you post.
On camera and lens details. Opening an item's details shows when and where it was taken. If you then ask for the camera and lens, the App reads them from the original file on your iPhone, downloading it from your own iCloud account first if that is where it is kept, and shows them to you. They are not stored and are not sent to us.
4. Your account
An account is required for the online half. Creating one gives us:
| Data | Why | Kept |
|---|---|---|
| Username | Identifies the account and lets people find you | Until deletion |
| Display name | Shown to everyone who can see you | Until deletion |
| Password, stored only as a salted PBKDF2-SHA256 hash | Signing in | Until deletion |
| A SHA-256 hash of your phone number, if you give one | Lets friends who already have your number find you, by comparing hashes. Optional — leave it blank and no hash is stored | Until deletion |
| Apple user identifier, if you use Sign in with Apple | Recognising you next time | Until deletion |
| Session tokens, stored only as SHA-256 hashes | Keeping you signed in for up to 90 days | Until expiry or sign-out |
| Profile picture, if you set one | Shown to people who can see you | Until deletion |
| Account created date, last seen date, photo count | Running the Service and filling your profile | Until deletion |
| "Hide me from discovery" setting | Controls whether your name appears in search | Until deletion |
Giving a telephone number is optional, and we never receive the number itself. If you choose to give one it is converted to a SHA-256 hash on your iPhone and only that hash is transmitted, so we hold a scrambled value and not the number. A hash is not encryption. Telephone numbers come from a small set of possible values, so a person who obtained the hashes could work out the numbers behind them by trying every possibility. We therefore treat the stored hash as personal information, use it only to match you with friends who already have your number, and never use it to call, message or identify you. If you leave the field blank, nothing is stored and nobody can find you from their address book.
We do not collect an email address. There is no email field anywhere in the App. With Sign in with Apple we request only your name, never your email address.
5. What you publish or send
5.1 The content itself
| Data | Kept |
|---|---|
| A still image, and a compressed video for anything that moves | Until you delete the post, or your account |
| Your caption | Same |
| The audience — all your friends, or the specific people you sent it to | Same |
| The date you posted | Same |
| The day the item was taken (the date only, never the time), shown with the post so friends see when it happened | Same |
| A date stamp drawn into the picture, only if you added one | Same |
5.2 Metadata is removed before anything is uploaded
The App does not upload your original file. It rebuilds the image or video from its pixels into a new file, which carries none of the original's metadata. GPS coordinates and the camera make and model are not present in what reaches us, and neither is the time of day it was taken. The one thing about when it was taken that the App sends is the day, as a separate field, so that your friends see when a video happened rather than when you sent it. Our servers additionally ignore any location field, so that an older version of the App could not send one even in error.
5.3 Social connections
Who you follow and who follows you, friend requests, likes with the time they were made, and accounts you have blocked. Earlier versions of the App also let you make named circles of friends; any that exist are kept, with their members, until you delete your account. Kept until you change them or delete your account.
5.4 Messages
Message text, posts and clips sent in a conversation, any few words you send along with a clip, who has hearted a message, read status, which earlier message or post a reply answers (a reference to it, not a copy), and replies that point at a post.
Messages are not end-to-end encrypted. They are stored on our servers so that they reach you across devices, which means they are technically readable by us, and our moderation team can read any message on our servers to keep the platform safe (section 9). Do not use MemoryScroll for anything you need to be confidential. Messages are kept until you delete your account.
6. Contact matching, if you switch it on
Contact matching is off by default. If you turn it on:
- the App reads telephone numbers from your contacts on the device;
- each number is converted to a SHA-256 hash (see section 4 for what a hash does and does not protect);
- only those hashes are transmitted, compared against the hashes of numbers other people gave at sign-up, and used to return matches;
- the hashes you send are not stored — they are compared and discarded;
- names, email addresses, photographs and everything else in your address book are never read and never sent.
It is never used for advertising or marketing. You can turn it off at any time in Profile, then Settings.
7. Reports and moderation records
When someone reports a post we record: the post and its author, who reported it, the reason chosen, up to 600 characters of anything the reporter wrote, the first 200 characters of the caption, when it was posted and when it was reported, and afterwards the decision taken, the reason for it, and the time.
A reported post may be taken out of view while it is reviewed. Reviewing a report can include looking at the reported account's other posts. Where the law requires us to keep material - for example, apparent child sexual abuse material, which must be reported to the National Center for Missing & Exploited Children (NCMEC) and preserved - we keep the post and its media out of everyone's sight, the poster's included, unaltered, for one year, and then delete it. That applies even if the account that posted it is deleted.
Copyright. A post reported for copyright is hidden from everyone except the person who posted it until a moderator has looked at it. If we take it down after a copyright notice, it is disabled for everyone, the poster included, and kept for 90 days in case the poster sends a counter-notice, and then deleted. We record a copyright strike against the account and tell the poster in the App; a strike is removed if the post is restored, and an account that keeps infringing can be suspended. A copyright notice or counter-notice sent by email contains the sender's name, address, telephone number, email address and signature. We keep it, and the strike record, only for as long as we need it to deal with repeat infringers - usually no more than about three years - and the law requires us to pass a counter-notice on to the person who sent the notice, contact details included.
How accurate a person's reports are. For every report we record whether a moderator upheld it or dismissed it. A person whose reports are mostly dismissed no longer hides a post by reporting it, and one who keeps sending reports that plainly have no basis can have the account suspended. That record is kept with the report, for as long as the report is kept.
Reporting a message or a clip in a chat. When you report a message, we record who reported it, who sent it, which message it was, the reason you chose, up to 600 characters of anything you wrote, and the time. The report is also emailed to our moderators with the text of the message (or a note that it was a clip) and the five messages before it in that conversation - who sent each, what it said, and when - so that a moderator can see what it was answering. A reported message is not hidden from the other person, and they are not told it was reported. The conversation is not otherwise read unless one of the reasons in section 9 applies.
An account can also be reported, separately from any post. In that case we record the account reported, who reported it, the reason chosen, and up to 600 characters of the explanation the reporter wrote. Whatever you type into that box is sent to us and read by a person, so do not put anything in it that you do not want us to have.
That record is emailed to our moderators and stored on our own server in a table that no signed-in route can read. There is no screen anywhere in the App that displays reports to anyone, including us. Reported content is reviewed through a signed link that expires and a moderator sign-in, as described in section 9.
Moderation records are kept for as long as we need them as the record of a safety decision - usually about two years from the decision - and are not deleted when the reported account is deleted. The emails that carry reports are kept no longer than that.
8. Technical records
- IP addresses and request logs. The Service runs on Cloudflare, which processes IP addresses in order to serve requests. Request logging ("observability") is enabled on our Worker. These logs record the time, the route and the outcome of requests. They are not used to build a profile of you. Cloudflare's retention for this data is its own; we do not extend it.
- Limits. To stop abuse, the server keeps a short record of how many uploads and how many follow or unfollow changes an account has made recently. It is deleted after 24 hours.
- No analytics, no advertising, no tracking. The App contains no analytics software, no crash-reporting library, no advertising identifier, no attribution software and no third-party software development kits of any kind. It does not present an App Tracking Transparency prompt because it performs no tracking as Apple defines it.
- Apple's own reporting. Because the App is distributed through TestFlight, Apple gives the developer aggregate installation statistics and crash diagnostics, where you have agreed to share them in iOS Settings. That is Apple's collection, under Apple's privacy policy. The App sends nothing to it.
9. When a person can see your content
Our moderation team can view any video, photo, post, caption or message that is uploaded to our servers — including everything you send privately to a friend, in a chat or as a reply to a video — at any time, whether or not it has been reported. We do this to keep MemoryScroll a safe platform, and for no other purpose. The people you choose to send something to can watch it, and so can our moderation team. Nobody else can.
Beyond that general safety review, we access what is stored on our servers (posts, messages and profiles) for these specific reasons:
- investigating a report about specific content or an account; when a message is reported, the moderator who reviews it can also read the few messages that came before it, to understand the context;
- responding to a support request you have made;
- enforcing the Terms of Use;
- protecting someone's safety where there is a credible risk of harm;
- complying with the law, a valid legal request, or a legal obligation such as reporting child sexual abuse material; or
- investigating a security incident or a serious fault.
Requests to preserve. If a law-enforcement agency asks us in writing to preserve what we hold about an account while it obtains legal process, we keep a copy of that account's data for 90 days, renewable once for another 90, even if the account is deleted in the meantime, and delete the copy when the period ends unless we have been served with legal process. We disclose that copy only in answer to valid legal process.
Reported content is reviewed through a link that is cryptographically signed, expires after 30 days, and works for one post and one action. Every decision is written to the moderation record with its time and reason.
We cannot see your own private feed, and neither can anyone else. Any video or photo you do not post or send stays on your device. It is not uploaded, so there is nothing for us, our moderators or your friends to look at.
10. Who else processes your data
| Provider | Role | What it holds |
|---|---|---|
| Cloudflare — Workers and Durable Objects | Runs the entire backend and stores all online data | Accounts, posts and their media, messages, the social graph, moderation records, request logs and IP addresses |
| Resend | Delivers moderation email to our moderators | The contents of those emails and the recipient address |
| Apple | App Store and TestFlight distribution; on-device frameworks; Sign in with Apple; the Apple Push Notification service, which delivers notifications | Apple's own App Store and Apple ID data. For notifications: the address Apple gives your phone and the short sentence being delivered, such as "Ava sent you a message" - never the message itself. The on-device frameworks send us nothing |
They act as our service providers and are not permitted to use your data for their own purposes.
11. Communications with Apple from your device
Three features cause your iPhone to contact Apple directly. These are between you and Apple, under Apple's terms and privacy policy, and we receive nothing from them.
- Place names and addresses. Where a photograph contains coordinates and a place name is shown beneath it, or you open the item's details and an address is shown, iOS sends those coordinates to Apple's geocoding service to be turned into words. This happens for your private feed; it is not part of posting, and the coordinates are not sent to us.
- Apple Music favourites. If you enable music, the App asks Apple Music which songs in your library you have marked as loved, sending the identifiers of songs in your own library to Apple under your own credentials. Nothing about your photographs is sent.
- iCloud Photos. If your library is in iCloud, iOS may retrieve an original file from your own iCloud account so the App can display, export, publish or read the camera details of it.
12. Permissions
| Permission | Purpose | Required |
|---|---|---|
| Photo Library | To read and display the photos, videos and Live Photos on your device, and to publish one when you choose. If you choose Limited access, the App sees only the items you picked, and you can add more from Settings inside the App | Yes |
| Photo Library (add) | To mark favourites and save into the "MemoryScroll Saved" album | Only for those actions |
| Contacts | To find friends by matching hashed telephone numbers | No — off by default |
| Notifications | To tell you when something happens in the Capture Circle: a friend request, a message, a clip sent to you, a like | No — asked once, and you can turn them off in iOS Settings |
| Apple Music and Media Library | To read your music library on the device and choose background music | No — only if you enable music |
The App does not use the camera, the microphone, Location Services, Bluetooth, your calendar, or health and fitness data. You may withdraw any permission in iOS Settings, under Privacy & Security.
13. Safety measures
- A check before upload. Apple's on-device Sensitive Content Analysis examines an item before it is uploaded, and an item it flags is refused and never leaves your iPhone. The analysis runs entirely on your device and reports one bit back to the app; the item itself is not sent anywhere to be judged.
- A check on what you receive. The same analysis runs on your own iPhone on photos and videos sent to you. Anything it flags is hidden and not shown.
- What these checks are not. Both depend on Sensitive Content Warning being switched on in iOS Settings, under Privacy & Security. It is off by default for adult accounts, and anyone can switch it off. It detects nudity and sexually explicit imagery, and on newer versions of iOS graphic violence — it cannot detect copyright infringement, a person's age, harassment, or most of what our rules prohibit. They are a safeguard, not moderation. Moderation is reporting, human review, and blocking.
- An automatic language filter refuses slurs in captions, replies, messages and the words sent along with a clip. It will not catch everything either.
- Reporting. Hold any post, clip or message to report it, choose a reason, and add details if you want to. A reported post disappears from your feed immediately; every report is sent to us. Reports about child safety and about intimate images shared without consent are handled first.
- Suspension. An account that breaks the rules can be suspended. A suspended account cannot sign in, and its posts and messages are hidden from everyone.
- Blocking. Blocking ends the connection both ways and hides each of you from the other across posts, messages, search, suggestions and contact matching.
- Notices. We can send a short notice to every account's notifications in the App - for example about a security problem. A notice is a message from MemoryScroll to you; it is not advertising.
- Your own controls. "Hide me from discovery", deleting posts, and deleting your account.
14. Retention and deletion
| What | How long |
|---|---|
| Account and profile | Until you delete the account |
| Posts and their media | Until you delete the post or the account. Deletion removes the stored image and video immediately |
| Media uploaded but never attached to a post | Removed automatically after about 24 hours |
| Messages | Until you delete your account |
| Likes, hearts, follows, blocks | Until you change them, or account deletion |
| The address Apple gives your phone for notifications | Until you sign out or delete your account, or Apple says it no longer works |
| Hashes you send for contact matching | Not stored |
| Your date of birth | Not stored |
| Reports of posts, messages and accounts, and moderation decisions, including the emails that carry them | As long as needed as the record of a safety decision - usually about two years from the decision |
| Copyright notices, counter-notices and strikes | As long as needed to deal with repeat infringers - usually no more than about three years |
| A post taken down for copyright | 90 days, then deleted |
| Notices from the moderation team, shown in the App | Until you delete the account |
| A post held for review | Until a moderator decides |
| A post held as evidence the law requires us to keep | One year, then deleted |
| Posts of an account suspended for breaking the rules | Hidden from everyone; deleted one year after the suspension unless it is lifted |
| Counts of your recent uploads and friend changes, used for limits | 24 hours |
| Session tokens | Up to 90 days |
| Server request logs | Cloudflare's own retention |
Deleting your account. Profile, then Settings, then Delete account. One confirmation, and it cannot be undone. Deleted immediately: your posts and the image and video stored for each, clips you sent, your messages in both directions, your circles (from earlier versions) and your membership of other people's, your likes and hearts, your notification address, follows, followers and blocks, your profile picture, display name, username, phone hash, password hash, sessions, and the Sign in with Apple link if you had one.
Your own photo library is untouched, because nothing there was ever ours. What can remain: moderation records as described in section 7, posts held for review or as evidence until their hold ends, as described there, copies briefly present in server logs, and anything other people saved or screenshotted, which is beyond our reach.
15. Children
The Service is for people 13 and over and is not directed to children under 13.
At sign-up you enter your date of birth, and the App will not continue if it works out to under 13. That date is checked on your device and is never sent to us, so we do not hold it. This is a gate, not verification: someone can enter a false date. If we learn that an account belongs to someone under 13 we delete the account and its content. If you are a parent or guardian and believe your child under 13 has an account, write to memoryscrollsupport@gmail.com and we will remove it promptly. If you are the parent or guardian of a user under 18 and want a post taken down or the account deleted, write to the same address.
People aged 13 to 17. Teenagers may use the Service, with a parent or guardian's agreement as the Terms of Use describe. For them, as for everyone: we show no advertising; we do not sell personal information or share it for advertising; we do not profile anyone; we do not collect precise location (the App does not use Location Services, and coordinates in photographs are never uploaded); our notifications are only ever about something another person did involving you - a message, a friend request, a like - and never reminders, streaks or promotions; and we collect nothing we do not need to run the Service. Nobody can message you unless you are connected as friends, and friendship needs both people to accept. A profile can be hidden from search with "hide me from discovery", and anyone can be blocked or reported. A parent or guardian can ask us to delete a teenager's account or any of their posts at the address below.
16. Security
- Traffic between the App and our servers uses HTTPS.
- Passwords are stored only as salted PBKDF2-SHA256 hashes.
- Session tokens are stored on the server only as SHA-256 hashes, and on your iPhone in the iOS Keychain.
- Telephone numbers are hashed on your device and never transmitted in readable form. They are treated as personal information all the same, as section 4 explains.
- Every request for a post or a piece of media checks that the person asking is permitted to see it.
- Sign-up, sign-in and uploads are rate-limited: a few sign-ups a minute from one address, a limited number of sign-in attempts a minute for an account or an address, and a limit on how many videos or photos an account can post within a few minutes (with a larger daily cap). Following and unfollowing is limited too: the App holds quick repeats together, and our servers cap the number of real changes an account can make in an hour. The counts for sign-in and sign-up are kept by Cloudflare's rate limiter for about a minute; we do not store your IP address.
- Moderation links are signed and expire. Opening one also requires a moderator username and password held only as secrets on the Worker, so a link that is forwarded or found in a mailbox shows nothing on its own.
What we do not claim. There is no end-to-end encryption. We add no encryption at rest beyond what Cloudflare provides. The App implements no cryptography of its own beyond the hashing described above, using only facilities provided by Apple's operating system. No system is perfectly secure.
If a breach affects your data we will notify you and any regulator as required by law.
17. Your privacy rights
The Service is offered only in the United States.
California, Connecticut, and other states with comparable laws. We do not sell personal information, do not share it for cross-context behavioural advertising, and do not use it for targeted advertising or profiling. You may request access to, correction of, or deletion of the personal information we hold. Deletion is available in the App at any time; for anything else write to memoryscrollsupport@gmail.com and we will respond within 45 days. We do not discriminate against anyone for exercising a privacy right. If we decline a request you may appeal by replying to our answer, or by writing to the same address with the word "Appeal" in the subject; we will answer in writing within 60 days, and if the appeal is refused you may contact your state's attorney general (in Connecticut, the Office of the Attorney General).
The categories we collect are: identifiers (username, display name, hashed telephone number, and an Apple user identifier if you use Sign in with Apple), user content (posts, captions, messages), and internet activity in the form of server request logs. We collect them for the purposes in sections 4 through 8 and disclose them only to the providers in section 10.
We do not knowingly process the sensitive personal information of any user.
18. The website
camerascroll.fit serves static pages. It sets no cookies, runs no analytics, loads no third-party scripts or fonts, and has no forms or sign-in. Its host may keep ordinary server logs.
19. Changes to this Policy
If this Policy changes in a way that matters we will update the effective date and version above and publish the revised Policy on the Site before the change takes effect. Because the App is in beta, changes may be frequent; each one will be described in the TestFlight release notes.
20. Contact
memoryscrollsupport@gmail.com
Celeste Van Dokkum, an individual Connecticut, United States