Privacy Policy
Effective Date: May 1, 2026
1. Introduction
Memorycard LLC ("Memorycard," "we," "us," or "our") operates the Memorycard application and website (collectively, the "Service"), a social videogame tracking platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service.
By using the Service, you consent to the data practices described in this Privacy Policy. If you do not agree, please do not use the Service.
2. Information We Collect
2.1 Information You Provide Directly
- Account Information: When you create an account, we collect your email address and password. Passwords are hashed using bcrypt and stored exclusively within our authentication provider (Supabase Auth). They are never stored in our application database. Your password is also checked against a known breached-password database during registration.
- Age Verification: During onboarding, we collect your birth month and year solely to determine your age bracket. We do not store your date of birth. Only a permanent, immutable age bracket designation ("minor" or "adult") is retained.
- Profile Information: You provide a username, display name, and optionally a bio (up to 160 characters), pronouns (up to 20 characters), and a profile picture (up to 5 MB; JPEG, PNG, WebP, or GIF). Profile pictures are stored in a dedicated storage bucket.
- User Content: We store the content you create on the Service, including library entries, thoughts (reviews), ratings, lists, list items, comments, hearts, favorite games, play sessions, and feedback messages.
2.2 Information from Third-Party Authentication
If you sign in through Apple, Google, or Discord, we receive limited information from those providers:
- Apple: Email address and, on first sign-in only, your first and last name (used to pre-fill your display name during onboarding, then discarded from temporary storage).
- Google: Email address and name (used to pre-fill your display name during onboarding).
- Discord: Email address and display name (via the
identifyandemailscopes).
We do not import or store profile photos, friend lists, gaming activity, or any other data from these providers. Only your email address is permanently stored (within our authentication system).
2.3 Information Collected Automatically
- Screen Views: We record which screens you visit within the app, associated with a pseudonymous user identifier (your Supabase UUID) and your username. Session replay and autocapture are disabled.
- Error Data: When errors occur, we collect stack traces, component information, and error messages, associated with your pseudonymous user identifier and username. We do not collect personally identifiable information in error reports. Our error tracking is configured with PII collection disabled, and API keys are scrubbed from logged data.
- Search Rate Limiting: For unauthenticated search requests, we generate a one-way SHA-256 hash of your IP address with a salt for rate-limiting purposes. The raw IP address is never stored. These hashes are automatically purged every hour.
2.4 Local Device Storage
On mobile devices, authentication tokens are stored in your device's secure enclave (iOS Keychain / Android Keystore) using encrypted storage. The app also stores the following preferences locally on your device using MMKV (a key-value storage library):
- Theme preference, haptic feedback setting, seed color, onboarding completion state, display preferences for library cards, and a temporary cache of query data.
On the web, authentication session data and query cache are stored in your browser's localStorage. We do not use tracking cookies.
2.5 Information We Do NOT Collect
We want to be clear about what we do not collect:
- Date of birth (only age bracket is stored)
- IP addresses (only one-way hashes for rate limiting, purged hourly)
- Device fingerprints, user-agent strings, or device IDs
- Location data
- Push notification tokens (push notifications are not implemented)
- Payment or financial information (payments are not implemented)
3. How We Use Your Information
We use the information we collect for the following purposes:
- Provide and operate the Service: To create and manage your account, display your content, enable social features, and deliver the core functionality of the platform.
- Age compliance: To enforce age restrictions, including automatic account deletion for users under 13 and enforced privacy settings for minors.
- Content moderation: To screen user-generated content for prohibited terms and flag content for manual review.
- Improve the Service: To understand which screens and features are used (via pseudonymous analytics) and to identify and fix bugs (via error monitoring).
- Communicate with you: To send email verification codes and password reset emails via our authentication provider. All other notifications are delivered in-app only.
- Ensure safety and security: To enforce rate limits, detect abuse, and protect the integrity of the Service.
- Enforce our Terms: To enforce our Terms of Service, including content standards and prohibited conduct.
- Comply with legal obligations: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
4. Third-Party Service Providers
We use the following third-party services. Each provider has access to your information only as described below:
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Authentication, database, file storage, real-time features | All user data (primary infrastructure provider) |
| PostHog | Product analytics | Pseudonymous UUID, username, screen paths only. Session replay and autocapture are disabled. |
| Sentry | Error monitoring and crash reporting | Pseudonymous UUID, username, stack traces, error messages. PII collection is disabled. |
| Vercel | Web application hosting | Standard web server request logs |
| IGDB / Twitch | Game catalog data (server-to-server only) | No user data is sent to IGDB or Twitch |
| Apple, Google, Discord | Third-party authentication | Authentication tokens during sign-in flow |
| Expo Updates | Over-the-air app updates | App bundle manifest requests (no user data) |
We do not use any advertising networks, email marketing services, or additional analytics providers beyond those listed above. We may update our service providers from time to time and will update this Privacy Policy accordingly.
5. Data Sharing and Disclosure
We do not sell your personal information.
We may share your information in the following limited circumstances:
- Public content: If your profile is set to public, your profile information, thoughts, library, lists, favorites, and activity are visible to all users. If your profile is private, this content is visible only to your approved followers.
- Service providers: With the third-party vendors listed in Section 4, solely to operate the Service.
- Legal requirements: When required by law, subpoena, court order, or other legal process, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
- Business transfers: In connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred as a business asset.
6. Data Retention and Deletion
6.1 While Your Account Is Active
We retain your personal information for as long as your account is active. Thought (review) deletions use a soft-delete mechanism. Deleted thoughts are marked with a timestamp and hidden from view, but the underlying data is retained.
6.2 Account Deletion
When you delete your account, all of your data is permanently and irreversibly hard-deleted via cascading foreign key deletion. This includes your profile, library entries, thoughts, ratings, drafts, lists, comments, hearts, follows, blocks, favorites, play sessions, notifications, activities, feedback, and reports. There is no grace period or recovery option.
6.3 Automated Cleanup
- Search rate-limit hashes: Automatically purged every hour.
- Reports, moderation queue entries, and notifications: Currently retained indefinitely while associated accounts are active and deleted via cascade when accounts are deleted.
6.4 Aggregated Data
Aggregated or de-identified data that can no longer be used to identify you may be retained indefinitely for analytics and product improvement purposes.
7. Data Export
You may download a copy of your personal data at any time through the account settings. The export includes a ZIP file containing CSV files with your profile information, library entries, thoughts, favorite games, followers, following, and lists.
8. Data Security
We implement the following security measures to protect your personal information:
- Password security: Passwords are hashed with bcrypt and checked against known breached-password databases. Passwords are stored exclusively in our authentication provider, not in the application database.
- Email verification: Required before account activation, via 6-digit one-time code.
- Encrypted token storage: Authentication tokens are stored in device-native secure enclaves (iOS Keychain / Android Keystore) with chunking for large tokens.
- Row-level security: All database tables enforce row-level security policies, ensuring users can only access data they are authorized to view.
- Rate limiting: Search requests are limited to 10 per 10 seconds. Comments are limited to 5 per target per 24 hours.
- Token replay prevention: Apple Sign-In uses nonce binding to prevent token replay attacks.
- Data scrubbing: API keys are automatically removed from error tracking breadcrumbs.
- CORS restrictions: API access is restricted to authorized domains (memorycard.gg, www.memorycard.gg).
- Encryption in transit: All data is transmitted over HTTPS/TLS.
No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.
9. Your Rights and Choices
Depending on your jurisdiction, you may have certain rights regarding your personal information:
- Access and portability: You may download a copy of your data at any time through the account settings (see Section 7).
- Correction: You may update your profile information, including your username, display name, bio, pronouns, and profile picture, at any time through the Service.
- Deletion: You may permanently delete your account and all associated data at any time through the account settings.
- Privacy controls: You may set your profile to private (followers-only), hide your library from non-followers, and hide your profile from search results.
- Opt-out of analytics: PostHog analytics are pseudonymous (UUID-based, no PII). You may opt out of tracking by adjusting your device or browser settings.
To exercise additional rights not available through the Service, please contact us using the information in Section 14.
10. Children's Privacy
The Service is not directed to children under the age of 13, and we take COPPA compliance seriously.
- During onboarding, all users must provide their birth month and year.
- If a user is determined to be under 13, their account is immediately and automatically deleted before any content can be created.
- Users identified as minors (ages 13 to 17) are assigned a permanent "minor" age bracket. Their profiles are forced to private and cannot be made public. This age bracket cannot be changed after it is set.
- We do not store the user's date of birth. Only the derived age bracket is retained.
If you are a parent or guardian and believe your child under 13 has created an account, please contact us immediately at contact@memorycard.gg and we will delete the account.
11. California Privacy Rights
Memorycard LLC does not currently meet the thresholds that make the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), applicable to the Service. As such, the specific rights and obligations provided under the CCPA/CPRA do not formally apply at this time.
However, we respect the privacy of all our users, including California residents, and are committed to transparency. Regardless of CCPA applicability, we do not sell personal information, and we provide all users with the ability to access their data (via the in-app data export feature), correct their information (via profile settings), and permanently delete their account and all associated data (via account settings). For additional requests, please contact us using the information in Section 14.
12. International Users
The Service is operated from the United States. If you access the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Service, you consent to the transfer of your information to the United States.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on the Service and updating the effective date. Your continued use of the Service after such changes constitutes your acceptance of the revised Privacy Policy. We encourage you to review this policy periodically.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: