← Back to home

Memos Privacy Policy

Version 1.0 · Last updated: November 7, 2026 · Effective: from [DATA DE PUBLICAÇÃO NA GOOGLE PLAY]

This Policy explains which personal data the Memos app for Android (package com.guzerocode.memosapp) processes, for what purposes, with whom it shares it, how long it keeps it and how you exercise your rights. It follows Brazil's Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018) and, for those who live in other countries, applicable data protection laws, such as the European Union's General Data Protection Regulation (GDPR) (section 13). It is part of the Terms of Use. The terms "Developer", "we" and "Memos" have the same meaning as in the Terms.

1. Who is responsible for the data

1.1. The party responsible (controller) for the data processed outside your device, described in section 3, is [NOME COMPLETO], an individual, published on Google Play as [NOME EXIBIDO NA GOOGLE PLAY]. Contact details are in section 14. Where the law of a country requires other identifying information (such as an address and telephone number), it is shown on the Memos page on Google Play.

1.2. Google acts as the controller of payment data and of your Google account, under its own policy. RevenueCat acts on our behalf (as processor) in verifying the purchase.

1.3. The content you record in Memos (section 2) is not sent to us. You decide about, and control, that content.

2. What stays only on your device

2.1. Data you create. It stays in the app's private storage, on your device, and is not sent to the Developer or to anyone else:

2.2. Sensitive data you choose to write. A journal may receive sensitive information (for example, about health, religious belief or intimate life). Memos does not read, analyze or send that content. For this reason, protect your device with a screen lock and keep backups in a safe place.

2.3. Device permissions. Memos asks for each permission at the moment you use the feature and uses it only for the purpose below. You may deny or withdraw any of them in Android's settings; only the related feature stops working.

Android may also list routine technical permissions that do not involve your personal data: vibrating, keeping the device awake during the alert, rescheduling reminders after a restart, checking the network state, showing the number of alerts on the app icon (on some manufacturers' devices) and, on devices running Android 12 or earlier, accessing storage to choose and save photos and files (Memos uses only what you choose). Some libraries used by the app also declare permissions that Memos does not use, such as receiving Google push messages and reading the Google Play install referrer: Memos does not activate those features and does not send or receive data through them.

2.4. What Memos does not access. This version does not ask for or use location, contacts, SMS, call log, calendar, the list of other apps or the advertising identifier. Photo and document files may carry, inside them, information recorded by the camera or by other apps (such as date, device or location). Memos does not read this metadata, but it travels with the file when you export or share it.

2.5. Notifications. A reminder's alert shows the reminder title. Depending on your device's settings, it may appear on the lock screen. Avoid putting sensitive information in the title if other people can see your device.

3. What leaves your device

3.1. Verification, purchase and restoration of the Lifetime plan. Whenever you open the app with internet, it queries Google Play and RevenueCat to find out whether you have the Lifetime plan and to show the price in your country. It also communicates with them when you buy or restore the plan. The data processed is:

• an anonymous identifier generated by the app (Memos does not ask for a name or email for this). When you reinstall the app or clear its data, a new identifier is generated;
• purchase data: product, date, amount, currency, country, purchase code and status (purchased, pending, refunded);
• minimal technical communication data, such as app and system version, device type, language and the IP address used for the connection.

Payment (card or other method) is made within Google Play. We do not receive or store your payment method details.

3.2. When you contact us. If you write to us (support, privacy rights, withdrawal), we process your email and the content of the message, and whatever else you send, such as the Google Play order number.

3.3. Sales statistics. In the Play Console, the Developer sees information about sales (order, product, date, amount, country and status) and aggregated usage and crash data (Android vitals) from those who allowed sharing diagnostics with Google. The RevenueCat dashboard also shows the Developer purchase reports, such as number of sales, revenue and refunds. Memos has no crash reporting or usage analytics tool of its own. Google may also provide data needed for support, refunds and taxes, under its own rules.

3.4. What we never send. Texts, photos, audio, documents, categories and reminders stay on the device. This version also has no account, so there is no Memos name, email or password anywhere outside your device.

4. What we use the data for and the legal basis

The legal bases for those who live in other countries are in section 13.

4.1. In this version we do not process data on the basis of your consent. Android permissions (section 2.3) are your decisions about your device, and their content does not reach us.

4.2. We do not engage in profiling or make automated decisions to evaluate you, we do not use data for advertising and we do not sell it.

5. Who we share it with

5.1. We share only with those necessary for the purchase and for contacting you, and only what is necessary:

5.2. We may also disclose data when required by law, a court order or a competent authority, and to defend rights in proceedings. If Memos comes to be operated by another person or company (Terms of Use, section 16.3), the data covered by this Policy will accompany that transfer, with the same safeguards, and you will be notified.

5.3. We do not sell, rent or share personal data for advertising or for building profiles.

6. International transfer

6.1. The providers in section 5 may process data outside the country where you are. RevenueCat's data is kept on servers in the United States, and Google processes data in several countries. The transfer happens only to the extent necessary for the purchase and with the safeguards the LGPD requires (art. 33), in accordance with these providers' policies and contracts.

6.2. For data of people in the European Economic Area, the United Kingdom and Switzerland, RevenueCat's data processing agreement uses the European Commission's Standard Contractual Clauses, with the UK addendum and the adjustments of Swiss law. You may request more information about these safeguards through the contact in section 14.

6.3. The Developer is in Brazil. If you write to us from another country, your message and its data are processed in Brazil, which has a general data protection law (the LGPD) and a supervisory authority (the ANPD).

7. How long we keep it and how to delete it

7.1. Uninstalling the app permanently erases the app's data on the device. If you want to keep it, export a backup first (a Lifetime feature).

7.2. When you delete everything, the Lifetime plan is not lost: it is tied to your Google account, and you recover it with "Restore purchase" (Terms of Use, section 6.6).

8. Your rights

8.1. Under the LGPD (art. 18), you may request, at any time and free of charge, regarding the data that we process:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data or data processed in violation of the law;
• data portability;
• deletion of data processed with your consent;
• information about the entities with which we share the data;
• information about the possibility of not giving consent and about the consequences;
• revocation of consent, where that is the legal basis;
• objection to processing carried out without consent, if it violates the law.

8.2. How to request. Write to the contact in section 14. For requests about the purchase, provide the Google Play order number (it starts with "GPA."), which is in the receipt email or on the orders page. Because the anonymous identifier changes with each installation, we locate the purchase by this number. We may ask for information to confirm who you are, only what is necessary.

8.3. Response time. We respond in a simple and immediate manner where possible or, at most, within 15 days with a complete declaration (LGPD, art. 19). If the law of your country sets a shorter period, we follow that period.

8.4. Providers. If your request involves data held by RevenueCat, we forward it to them, as they act on our behalf. Data that Google processes as a controller must be requested from Google, through its channels.

8.5. Exceptions. We may keep data that the law requires us to keep (for example, tax records) or that we need for defense in proceedings, and we will say so in our response.

8.6. Your content on the device. To view, edit, delete or export texts, photos, audio and documents, use the app itself. We have no copy and cannot recover what you delete.

8.7. Complaint. If you believe the processing does not comply with the law, you may complain to the Autoridade Nacional de Proteção de Dados (ANPD, Brazil's National Data Protection Authority). If you live outside Brazil, see also section 13: you have the rights under the law of your country and may complain to the data protection authority there.

9. Security

9.1. What we do:

• the content stays in the app's private storage on Android and does not leave the device;
• Google's automatic backup is turned off, so that data does not go to any cloud without your choosing;
• on import, the app checks the file's format and content before saving;
• communication with Google Play and RevenueCat uses a protected connection;
• we collect only the minimum for the purchase, and we do not store payment data.

9.2. What you need to know. This version of Memos has no password or biometrics of its own and does not encrypt the app's database or the backup file. Anyone who uses your unlocked device, or opens your backup file, can see the content. Protect your device with a screen lock and keep backups in a safe place.

9.3. Incidents. If there is a security incident involving data we process that may cause you relevant risk or harm, we will notify you and the ANPD, under the LGPD (art. 48), and also the other competent authorities where the law of another country requires, within the legal deadlines.

10. Children and adolescents

Memos is not directed at children under 13 (or the higher age required by the law of your country) and does not knowingly collect their data. The processing of data of children and adolescents must serve their best interests (LGPD, art. 14). Minors must use the app with the knowledge of a legal guardian. If you are responsible for a minor and believe their data has been processed improperly, contact us and we will delete whatever we hold.

11. Third-party links and services

11.1. Links you put in your notes open outside Memos, in the browser or in another app, and become subject to the policy of the destination site or app.

11.2. When you open a document in another app, use the "Share" menu, save a backup to a folder or send it by email, message or cloud, that content becomes subject to the rules and risks of the destination (Terms of Use, section 4.4).

12. Changes to this Policy

12.1. We may update this Policy. The version in force and its date are at the beginning, at [URL DA POLÍTICA DE PRIVACIDADE] and, when available, inside the app.

12.2. Relevant changes will be notified through the app or the store listing with reasonable advance notice (the goal is at least 15 days), unless immediate legal requirements apply.

12.3. If Memos comes to have login, syncing, cloud, ads, usage analytics tools or any new service that processes personal data, we will update this Policy before the new feature arrives and will make this clear.

13. If you live outside Brazil

13.1. General rule. We process the same data, for the same purposes, in any country (sections 3 to 7). If the law of the country where you live gives you more rights or imposes more duties on us, it applies to the extent applicable. For any request, use the contact in section 14; we respond within the period set by the law of your country.

13.2. European Economic Area, United Kingdom and Switzerland. The GDPR, the UK GDPR and the Swiss data protection act (FADP) apply. The legal bases are:

You have the right of access, rectification, erasure, restriction of processing, portability and objection (in particular to processing based on legitimate interest). We do not make automated decisions about you or process data on the basis of your consent. We respond within 1 month, a period that may be extended by a further 2 months for complex requests, with notice to you. You may complain to the data protection authority of the European Union country where you live or work, or where the infringement occurred; in the United Kingdom, to the Information Commissioner's Office (ICO); in Switzerland, to the Federal Data Protection and Information Commissioner (FDPIC). Transfers outside Europe follow section 6.2.

13.3. United States. We do not sell or share personal data within the meaning of state privacy laws (such as California's), we do not engage in targeted advertising or profiling and we do not process sensitive personal data. In the last 12 months, the only categories processed were: identifiers (the app's anonymous identifier and the IP address), commercial information (purchase records) and, if you wrote to us, contact data and the content of the message. They come from you and your device, serve the purposes in section 4 and go only to the recipients in section 5. You may request access, correction and deletion, and appeal a refusal through the same contact, without any discrimination for exercising these rights. Since there is no tracking, there is nothing to turn off in response to signals such as "Do Not Track" or Global Privacy Control. We do not knowingly collect data from children under 13 (COPPA).

13.4. Canada. The person responsible for the protection of personal information (including for the purposes of Quebec law) is the Developer, through the contact in section 14. You may request access and correction and complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information. Information may be processed outside Canada and Quebec, in accordance with section 6.

13.5. Japan. The purposes of use are in section 4. We entrust the processing of purchase data to RevenueCat, in the United States, which by contract adopts protective measures equivalent to those required by Japan's Act on the Protection of Personal Information (APPI). At your request, we will inform you of that country's data protection system and the measures adopted. Requests for disclosure, correction, suspension of use or deletion can be made through the contact in section 14.

13.6. South Korea. Under the Personal Information Protection Act (PIPA):

You may request access, correction, deletion and suspension of processing, and complain to the Personal Information Protection Commission (PIPC) or the Privacy Infringement Report Center (telephone 118).

13.7. India. Under the Digital Personal Data Protection Act (DPDP), you may request a summary of the data we process, correction, updating and erasure, and nominate a person to exercise these rights in the event of death or incapacity. Complaints must first be made through the contact in section 14, which responds within the legal period; if you are not satisfied, you may appeal to the Data Protection Board of India.

13.8. Other countries. In Latin America (for example, Mexico, Argentina, Chile, Colombia, Peru and Uruguay), you have the rights of access, rectification, cancellation and objection provided by local law. In Turkey (KVKK), Indonesia (PDP Law), Australia, New Zealand and other countries, you have the rights that local law gives. In all cases, you may complain to your country's data protection authority.

14. Contact

• Responsible person (controller): [NOME COMPLETO]
• Email (privacy, data subject rights and support): [E-MAIL DE CONTATO]
• Data protection officer (LGPD): as a small-scale processing agent, the Developer is exempt from appointing a data protection officer (Resolução CD/ANPD No. 2/2022, art. 11). This email is the channel of communication with data subjects and with the ANPD, and also the contact of the person responsible for data protection for the purposes of the laws of other countries (section 13).
• Response time: up to 3 business days for support; up to 15 days for data subject rights requests under the LGPD; in other countries, within the period set by local law (for example, up to 1 month under the GDPR)

Version history