patent pending
Mementom privacy policy
Mementom does not know who you are, and that is by design. It does not ask you for a name, email address, phone number, or identity profile to create or use a key ring.
Effective: August 26, 2026
Plain-language summary
Mementom does not ask you to identify yourself. It uses random IDs and key-ring records to operate the service without learning who those records belong to. A connected company may send the details you need to review for one action, and Mementom stores those details with that request.
The important image rule
When you create or use a memkey, your browser turns the original image into a cryptographically derived numeric key specific to that image. Mementom stores and checks that derived numeric key with your phrase. The original image stays on your device and is not uploaded or kept as part of your Mementom key.
A connected company can receive an opaque relationship, request context it supplied, and a signed result for its own scoped challenge. It cannot see the protected Mementom window or receive the key image, phrase, readable key-ring password, or proof details.
When you share a key, Mementom offers a secure way to transfer the image portion of that key. The sender’s browser encrypts the image before upload. Mementom holds only that encrypted copy between sharing and pickup, for no more than ten minutes, then deletes it after accepted pickup or timeout. It never becomes the stored image for the memkey.
This policy covers the Mementom website, key-ring service, protected authorization window, partner API, My key ring view, and temporary shared-key pickup.
Mementom does not know who you are, and that is by design. It does not ask you for a name, email address, phone number, or identity profile to create or use a key ring. Mementom still keeps the random service records needed to operate and protect the service.
A site or app that uses Mementom remains responsible for its own data practices. Mementom does not control information you give directly to that company outside the protected Mementom window. The company may include action details in a Mementom request so you can review exactly what you are authorizing. Mementom stores those details with that request, but they come from the company rather than your key ring. For example, if nCent uses Mementom for anonymous continuity, Mementom governs the private proof exchange while nCent’s own privacy policy governs information collected by nCent.
You select the original image again inside the protected Mementom window. Your browser derives its numeric key again, and Mementom checks that derived key together with the phrase. The original image is not uploaded or retrieved from Mementom because Mementom does not keep it as part of the key.
There is no central record held by “the internet.” AWS and intermediate network providers process connection details while delivering traffic to Mementom. Mementom’s current AWS setup does not enable load-balancer access logs, VPC flow logs, WAF request logs, CloudFront, or third-party request analytics.
For ordinary successful use, Mementom does not store your raw IP address. After a failed initial login, Mementom turns the IP address into a one-way keyed code and stores only that code, failure count, and failure times for up to 24 hours to slow repeated attacks. The raw address is not written to Mementom storage or application logs. If a company challenge explicitly uses a network rule, Mementom may store the rule result, confidence, time, and a one-way network code—not the raw IP address.
Mementom uses strictly necessary, secure session cookies so a browser can remain connected to My key ring and so recent key proof can be recognized for a limited time. Protected session cookies are HTTP-only and are restricted by same-site and secure transport controls where HTTPS is used.
The current Mementom site does not use third-party advertising cookies. Browser-local state may be used to complete an active flow, protect a popup return, or present an explicitly requested download; it is not a substitute for server authorization.
Mementom discloses only that company’s opaque relationship, the request identifiers and context needed to match its own request, and the scoped result it is authorized to retrieve. Mementom does not disclose your original key images, private phrases, readable key-ring password, another company’s relationship, or the contents of the protected Mementom window.
Mementom uses service providers, including cloud hosting and database infrastructure, to run and secure the service. Those providers process operational data on Mementom’s behalf according to their service agreements and applicable law.
Mementom may preserve or disclose records when reasonably necessary to comply with law, respond to valid legal process, protect the service or its users, investigate abuse, or address a security incident. Data minimization limits what Mementom has available to disclose.
Ordinary key creation and use do not upload the original image. Sharing is different only because Mementom provides a short-lived delivery path for the image portion of the key. The key remains an ordinary key on your ring with the limits you selected:
Mementom keeps active key-ring records until they are replaced, removed, expired by a limit, or otherwise no longer needed to provide the service. Public My key ring sessions currently last up to 30 minutes; reusable recent-proof entries last up to 15 minutes without sliding; individual management and challenge ceremonies use shorter expirations.
Temporary shared-key ciphertext lasts no more than ten minutes and is deleted after successful pickup or expiration. Security, activity, relationship, and transaction records are retained only for the time reasonably needed to operate the product, preserve an accurate user-visible history, meet contractual or legal requirements, and investigate security events. Retention periods may differ by record type because those purposes differ.
Mementom separates the public site, participating company, and protected authorization origin. It uses encrypted transport, protected session cookies, short-lived and one-use request material, scoped partner credentials, replay controls, encryption for protected stored values, and audit records. No security system can guarantee absolute protection, but the service is designed to reduce both the amount and usefulness of exposed information.
Mementom is not directed to children under 13, and Mementom does not knowingly ask children under 13 to create a key ring. A participating company is responsible for the age requirements and consent rules that apply to its own service.
Mementom will update this page when its product or data practices materially change. The effective date at the top identifies the current version. Material changes should be reflected here before or when the new processing begins.
For privacy questions or requests, email partners@mementom.app. Do not email a key image, private phrase, key-ring password, pickup secret, or session token.