Moments: Privacy Policy

Last updated: October 31, 2026

Moments is a small, quiet app for keeping one good moment a day. Your moments are private. This page explains, plainly, what we store and why.

Moments is made and run by The Grateful Team, a one-person independent studio based in the United Arab Emirates, which is the data controller for the information described below. Contact: momentsapp.hello@gmail.com. "The Grateful Team" is a trading name. If you need the registered legal details behind it for a data-protection request or a legal one, email us and we will give them to you.

What we collect

• Your moments: the words you write, the date you wrote them and the feeling you picked, if you picked one, backed up to your account so you still have them if you lose or change your phone. The one optional photo you attach to a moment is backed up to your account as well, on every account. This does not depend on a paid plan. It is sealed on your phone and uploaded in the background right after you save the moment, and only while you are signed in; if your phone is offline, or you are not signed in yet, it is tried again later. The sample pictures that ship inside the app are not uploaded. Backed-up photos are stored in Firebase Storage (see "Where your data lives"). Your device's own backup system may include them too, under your control. See "How long we keep it" for how long backed-up photos are kept.
• People you name: if you write somebody's name in "Who was with you?", that name is kept with the moment and backed up to your account along with it. It is a label you chose, not a contact: Moments never opens your address book, never looks the name up anywhere, and never contacts the person. See "People you name in a moment".
• Your account: Sign in with Google or Apple, or with an email address and a password. If you sign in with Google or Apple, the first word of the name on that account is filled in as your "Your name" setting, but only if you have not already set or cleared that name yourself on this phone. On a new phone, or after reinstalling, it is filled in again from your Google or Apple account until you change it. It is never taken from your email address, nothing is filled in when you sign in with email and a password, and you can change or remove it any time in Settings → Your name. We also copy it onto your sign-in account if that account has no name yet. The email address (or Apple/Google account) you sign in with, and a random account identifier (a Firebase user ID) that connects your backed-up moments to your account, so they can be restored when you sign in again.
• Your plan: whether you've bought a plan, and whether it's still running. When you buy, the App Store or Google Play hands the app a receipt, and RevenueCat, a subscription service working for us, checks that receipt and tells us whether your plan is paid, cancelled, or still being retried by the store. What it holds: your account identifier, the receipt, which plan you bought and when it runs out, and the phone type and country the store reports. It is never sent your moments, your photos, your name or your email address, and we never give it an advertising identifier, so it cannot be used to follow you anywhere.
• Your settings: your daily reminder time, and the schedule your phone builds from it, stay on your device and are never sent to us.
• A print you give someone: if you make a print of a moment and give it to somebody, a scrambled copy of that picture sits on our servers for 7 days so their link works. The key that opens it never reaches our servers, and we don't see who you send the link to. If the person who opens it has Moments and keeps it, we do record that their account kept it. See "Giving a print to someone".
• Sharing straight to someone's Moments: when you and another Moments user are connected, we record that your two accounts are connected, who you shared with and when, and who kept a moment you gave. The first person to keep a link you gave is connected with you automatically. Anyone who keeps a moment from that same link after them (for example, because the link was passed on) is not: we record that they kept it and asked to connect, and you choose whether to connect. The other person sees you by the name in Settings → Your name (the one you typed, or the first word filled in from your Google or Apple sign-in), so we keep that name as it is in Settings. If you block somebody, we keep their account identifier on a block list for your account so the refusal holds; they are not told. See "Sharing straight to someone's Moments".
• Crash diagnostics: if Moments crashes, or hits an error it can recover from, a report is sent to Firebase Crashlytics and to Sentry so we can fix it. It says what went wrong, and carries your device model and OS version, a random installation identifier, and a short record of what the app was doing just before. The app is set so a report does not include a screenshot, the words on screen, or your account identifier. An account identifier that appears in an error is replaced before the report is sent. These reports never include your moments, and we use them only to fix problems. Like any internet service, both also process your IP address to deliver and secure the service, which can show roughly where a report came from, such as the country, never a precise location.
• A way to reach your phone: to send the notifications described under "Notifications", we keep a delivery address for each phone you are signed in on. It is a code your phone's maker issues so that a message can reach that phone (a push token). It is not your phone number, and it carries nothing you wrote. The app deletes it when you sign out of that phone. If the phone is offline at that moment, it stays until you sign in on that phone again with the same account, or delete your account. If you leave the optional "New features" notification on, that phone has a second delivery address for it. That one is kept in a separate list, under a code for the phone rather than your account, and it is deleted when you switch that notification off, or when we find the phone no longer accepts notifications. Our record of the times the app asked us to send that notification pairs the phone's code with your account identifier, so the two can be linked (see "How long we keep it").
• How the app is doing overall: a short list of plain facts about your account, sent from our own servers to a company called PostHog, who count them up for us: that an account was created, that a first moment was kept, that a moment was kept on a particular day, that a third and a seventh moment were kept, that a plan changed, that a first payment was made, that cloud backup became possible for the account, that you opened the plan screen (at most once a day, and not once you have paid), and that an account was deleted. That is the whole list, and it cannot grow without us changing this page first. Each one says that something happened and when. We also work out, on our servers, how many moments you have kept so far (as a plain number such as 3), how long after you signed up each of your moments was kept, how long it was since the one before, how long it took from signing up to a first payment, and which plan that payment was for. We send these only until you make a first payment, and we keep a small note on our servers, in your account and out of your reach, of which number we last reported so that none is reported twice. A count can also carry whether your phone is an iPhone or an Android phone, taken from the delivery address described above, and whether you are one of our own testers. It never carries a word you wrote, a photo, how much you wrote, which day a moment was for, a name, or a feeling you picked. Nothing is sent from your phone, and nothing extra is kept on it: these are worked out from what is already in your account, and there is no tracking software in the app at all. PostHog never sees who you are: your account is named there by a scrambled code, made with a key only our servers hold. It is not the account identifier described above, and not your name. Their servers are in the European Union. A count can also say which plan you're on and roughly how far through your free moments you are, and whether a moment you kept had a photo with it, never the photo itself. We don't share any of it with anyone else, and if you delete your account the counts there are deleted too. If you would rather we didn't count your account at all, email us and we'll stop. See "Your rights".
• Anything you send us: if you tell us something's not right, or suggest something you'd like, we keep what you wrote, the email address you asked us to reply to if you gave one, and any picture you chose to attach. You can send us a message whether or not you have an account, and you don't have to give an address; if you give neither, we hold nothing that connects the message to you. A problem report always carries technical details, listed in full on the screen before you send: which version of Moments you have, your phone model and its software version, your language, whether you were online, which plan you're on, how many moments you've kept, and which screens you visited before it went wrong. That means the names of the screens, never a word of what you wrote on them. A picture comes from your own photo library, so you have seen it and you can black anything out before it is sent; please don't send us a picture that shows someone else's details. None of it is collected in the background: nothing is sent unless you write to us and press send.

Sometimes we try two versions of something. We might show one group of people one wording of a screen and another group a different one, so we can tell which one works better. Which version you get is decided on our servers and kept with your settings, the same way your plan is. It's a setting, not a label about you: it doesn't identify you, a great many accounts share the same one, and your phone never sends it anywhere. Nothing you wrote is ever any part of this.

Why we're allowed to hold it

Your account and your moments: because you asked us to keep them. That is the service you signed up for, and on a paid plan it is the agreement between us.

Counting how the app is doing, names of other people you write down, crash reports, and keeping the app working and secure: because we have a legitimate interest in doing so, and we have satisfied ourselves it doesn't override anybody's rights. We hold the least we can. "People you name in a moment" sets out exactly what that means.

You can object to anything we do on that second basis. See "Your rights".

What we don't do

• We don't read, analyze, or run analytics on the content of your moments. The one exception is a report: if somebody you shared a moment with reports it to us and chooses to include it, we read what they send us.
• We don't sell your data, and we don't share it with anyone for advertising or any purpose of their own. A few companies handle data on our behalf, on our instructions and for nothing of their own: Google Firebase, which stores your account and your backed-up moments and delivers notifications; RevenueCat, which checks with the App Store or Google Play whether a plan has been paid for and is still running; Firebase Crashlytics and Sentry, for crash reports; and PostHog, for the counts described above. Each of them is bound by its standard data processing terms to use your data only for the job it does for us, and to protect it at least as carefully as this page promises. Apart from Firebase, which holds your backup, none of them is ever sent the words you write or your photos.
• We don't show ads or track you across other apps or websites.
• There is no feed and no followers. Another Moments user can look up the name in Settings → Your name (the one you typed, or the first word filled in from your Google or Apple sign-in), and only if they already have your account's identifier: because they have a link you shared (including one passed on to them), you kept a moment they gave you, or you are connected. Anyone with your identifier can also check whether you are connected to them, and since when. Nobody can browse a list of names, or see who else you share with or are connected to. We don't read your moments or analyse them, and we don't show them to anyone. The only way anything you wrote reaches another person is if you send it to them yourself. See "Giving a print to someone" and "Sharing straight to someone's Moments" below.
• We don't record your screen, and nothing we use is capable of it. The counts described above are the only measurement we do, and none of them can see a word you wrote.

Where your data lives

Moments are stored on your device first, and backed up to Google Firebase servers in Google's Middle East region (me-central1): the words and dates in Firebase Firestore, and backed-up photos in Firebase Storage. Security rules stop any other Moments account from reading them. Another Moments account can do only a few things that touch yours: send you a request to connect (only by naming a link you gave) and take it back, record that they kept a moment you gave them and take that back, check whether you are connected to them, put a shared moment in your mailbox if you are connected, and look up the name you chose. Each is explained under "Sharing straight to someone's Moments". A print you have given sits in Firebase Storage too, scrambled, until it expires. Because Firebase is part of Google's global infrastructure, some supporting processing (such as authentication and crash reporting) may take place on Google systems in other regions, under Google's standard data-protection commitments. Crash and error reports are also held by Sentry, on servers in the European Union. RevenueCat, which confirms whether a plan is paid, keeps its records in the United States, under its own standard data-protection safeguards for that transfer. When we email you about your own account or your own data, we write from our Gmail address, so Google carries that email.

How your moments are protected, and who could open them

Before a moment is backed up, your phone encrypts its words, the feeling you picked and the names of the people with you, using AES-256. Photos are encrypted the same way before they are backed up. What reaches our servers is scrambled.

Some things are not scrambled, because the service needs them to work: the date of each moment, when it was saved and changed, whether it has a photo and whether that photo is backed up, and how the photo is framed on the card. On your phone itself, the app keeps your moments in its own private storage, protected by your phone's own security (such as its passcode); Moments does not encrypt them a second time there.

The key that unscrambles your moments is kept with your account (and in your phone's own keychain, which on iPhone is synced through iCloud Keychain). That is what lets you sign in on a new phone and get everything back without a recovery code to keep. It also means this is not end-to-end encryption: the people who run Moments are able to use that key to open your moments, and so, in principle, is Google, which runs our servers. We don't read your moments. We would only open an account's moments if its owner asks us to, for example to help with a problem, or if the law requires it.

A print you give someone is different: its key lives only in the link you send, never on our servers, so we cannot open a print.

The counts described above are held for us by PostHog, on servers in the European Union. They are used only for us, only for what this page describes, and PostHog may not use them for anything of their own.

Giving a print to someone

Moments can turn one of your moments into a picture, a print, that you can give to someone who was there with you. You don't have to use this, and nothing is given to anyone unless you choose to give it.

Here is what happens when you do. Your phone draws the print and then scrambles it, so that the file cannot be read without a key. Only the scrambled file goes to our servers. The key stays in the link you send. It sits in the part of a web address that browsers never send on to a server, so it never reaches us and we cannot open the print.

The person you give it to needs no account to open the link. On that web page the print is blurred; they see it clearly once they keep it in the Moments app. We don't ask for their name, their number or their address, and we don't see who you send the link to. You share it yourself, from your own phone. If the person who opens it has Moments and keeps it, we record that their account kept it, so we can tell you (see "Sharing straight to someone's Moments"). If you named somebody on that moment, their name is printed on the picture, and it goes with the print to whoever you give it to.

If somebody gives you a moment you'd rather not have, you have options right there on it. You can remove it, or report it to us and choose to send us the moment itself so we can look into it. When the app knows who sent it, you can also stop sharing with that person, or block them so nothing more from them reaches you (see "Sharing straight to someone's Moments" below). A report is kept with your account, like anything else you send us (see "How long we keep it").

A print stops working 7 days after you make it. Nobody can open it after that, and the app deletes it from our servers the next time you open Moments. You can also stop a moment's links sooner: press and hold the moment and choose Stop shared links. The scrambled copies on our servers are deleted then. Anyone who already kept it keeps their copy.

Sharing straight to someone's Moments

When the first person to keep a moment you gave by link keeps it, your two accounts become connected. Anyone who keeps it from that same link after them (for example, because the link was passed on) shows in your People list as having kept your moment, and you are connected only if you tap Connect. The same goes the other way round when you keep someone else's moment. From then on you can share a moment straight into their Moments, and they into yours, without a link. Here is what we hold to make that work.

• That you are connected: your account identifier sits next to theirs, and theirs next to yours.
• Who you shared with, and who kept what you gave: when you share straight to somebody, we record their account identifier and when. When somebody keeps a moment you gave them, we record that their account kept it, so we can send you the notification that says so. You are never shown who did not keep something.
• The name you chose: the name in Settings → Your name (the one you typed, or the first word filled in from your Google or Apple sign-in) is kept as it is in Settings, not scrambled, so the other person can see who a moment or a request came from. It appears on the notification they get and in their People list. Any signed-in Moments user who already has your account's identifier (because they have a link you shared, including one passed on to them, you kept a moment they gave you, or you are connected) can look it up; nobody can browse a list of names. Leave it empty and nothing is shown.
• The moment itself: when you share straight to somebody, the moment waits on our servers, in the same protected form as your backed-up moments, until their phone collects it, and then it is deleted from there. We don't read it, unless the person you shared it with reports it to us and chooses to include it. Once it is on their phone it is theirs: deleting your account, or your own copy, does not take it back.
• People you've blocked: if you refuse somebody for good, we keep their account identifier on a block list for your account, so they cannot share with you or connect with you again. Nothing else is kept about them, and they are not told.
• Leaving: choose "Stop sharing with each other" in the app and they can no longer put anything in your Moments; the database refuses it, not just the app.
• Deleting your account: your side of all this goes with it, including your connections, your block list, the name you chose, and anything waiting in your mailbox. We also take you off other people's lists of connections, and remove any request to connect between the two of you. What else sits in the other person's account belongs to them, so it is not deleted with yours, and it can still carry your account identifier: their list of connections, only if a moment from you was still waiting for them to collect (so they can still open it); the moments from you that they kept; their record of moments they shared with you; their record that you kept a moment they gave you, including whether you were the first to keep a link they gave; the conversation on a moment you shared, while it still holds someone else's comments, with your account identifier; their block list if they blocked you; their note that they took you off their "Recently shared with" list; and any report they sent us about a moment of yours. A moment you already sent still reaches them, even if their phone had not collected it before you deleted your account.

People you name in a moment

Moments lets you write down who was with you. That name is part of your record of your own day, so it is kept the way the rest of the moment is: scrambled, on your account, and read by the app on your own phones. We don't read it, and nobody else is shown it unless you hand them the moment yourself.

If you are reading this because somebody has written your name into their Moments, here is the whole of what that means. We hold the name they typed and nothing else. No address, no number, no profile, no account, and no record anywhere connecting that name to you as a person. We didn't take it from a contact list. Moments cannot read one. We have never contacted you and we have no way to.

We keep it because a record of a day without the people in it isn't much of a record. That is our legitimate interest in holding it, and it is balanced by holding as little as it is possible to hold: one short label, written by somebody who was actually there.

It goes when the moment goes. If they delete that moment, or delete their account, the name is deleted with it. The one exception is a copy of that moment they gave to somebody else, which stays with that person. If you'd rather it weren't there, the person who wrote it can take it out, and that is by far the quickest route. You can also write to momentsapp.hello@gmail.com and we will help as far as we honestly can. Be aware of what we won't do: a name sits scrambled inside somebody's own moment, so there is no way to find it from your name alone without opening other people's moments. We will not go looking through other people's moments to try, because that would mean reading them.

Payments

Purchases are billed entirely through the Apple App Store or Google Play. We never see or store your payment details. RevenueCat, which confirms your plan for us, receives the store's receipt and never your card.

Notifications

If you allow it, Moments reminds you in the evening, at the time you chose. Early on there is also a short message during the day. None of them is ever an advert.

Your phone works out when to show your reminders, and shows them itself. Those never come from our servers.

Three kinds of notification do come from our servers. None of them ever carries your words, a photo, or anything from a moment itself.

• Somebody shared a moment with you. It carries the name they chose and nothing else.
• Somebody kept a moment you gave them. It carries the name they chose. If they were the first person to keep that link, and it is the first moment they have kept from you, it also says you can now share straight to them.
• New features. An occasional note when Moments gains something new. It has its own switch in Settings, on unless you turn it off.

To send these we keep a delivery address for each phone you are signed in on (see "What we collect"). We are never told whether a notification appeared on your screen, or whether you tapped it. We do learn when a phone has stopped accepting them, so we can stop sending to it.

You can turn the reminders off any time in Moments Settings. That one switch turns off both of them. The New features notification has its own switch there. To stop every notification, including the ones about shared moments, turn Moments notifications off in your phone's own settings.

If you have no plan, or your plan ends

Words, photos and dates are kept together as one moment, and these dates apply to all of them.

• The first 7 moments you save are free. Once you have used them, and you don't have a plan, we keep your moments for 30 days. We tell you straight away, by email and by a notification on your phone, and we remind you 7 days and 1 day before the date. In that time you can export your moments for free, or start a plan. After that date, your moments can be deleted from our servers. This also applies if you never paid for a full month.
• If you paid for at least one month, we keep everything for 12 months after your plan ends. The end date is the one the App Store or Google Play gives us, not the day you cancel. We remind you 90 days, 30 days and 7 days before the date.
• Starting a plan again stops the clock. Your moments are kept for as long as the plan runs.
• A one-time purchase has no deletion date for as long as your account is open.
• We never move a date earlier. If we have already given you a later date, we keep to it.
• Exporting your moments is always free. In this version, the export is offered on the notice that follows your 7 free moments.

How long we keep it

A name you wrote into a moment is kept for exactly as long as that moment is. Delete the moment and it goes with it. Delete your account and every one of them goes.

Words, photos and dates are kept together as one moment. How long we keep your moments when you have no plan is set out under "If you have no plan, or your plan ends" above.

When you delete your account, your moments (the words, photos and dates) are deleted too, and deletion is complete within 30 days.

The record of which plan you're on is kept for as long as your account exists. Our own copy goes when your account does. RevenueCat keeps its own record of your plan (your account identifier, the store receipt, which plan you bought and your country) after that. Email us and we'll have it deleted (see "Your rights").

Your connections, your block list, the name you chose, and your phones' delivery addresses for shared moments go when your account does. Most of what sits in other people's accounts stays with them (see "Sharing straight to someone's Moments"). The app also deletes a phone's delivery address when you sign out of that phone, as explained under "What we collect". The separate New features address is not deleted with your account. It goes when you switch that notification off, or when we find the phone no longer accepts notifications. Until then, our record of the times the app asked us to send that notification can link it to your account identifier. A moment waiting in somebody's mailbox is deleted from our servers as soon as their phone collects it.

Prints you have given stop working 7 days after you make them, and the app deletes them from our servers. We cannot read one while it is there.

Anything you send us is kept while we answer you and fix what you reported, and no longer than two years. It is deleted when you delete your account.

Some records our servers keep outlive a deleted account. They hold your account identifier, but nothing you wrote and no photo: a record of each deletion you asked for, with the day of the moment it was for; the day of each moment whose photo was backed up; a note if a paid plan of yours ended; and the times the app asked us to send the New features notification after an update, with a code for the phone that asked. They can also hold a bookmark of where the free-moment reminder sweep had reached and a bookmark of where the lapsed-plan reminder sweep had reached, which can name an account until the sweep moves on. They are there so that deleting, backing up and plans work reliably. The record that a deletion was done is marked to last 1,095 days. Nothing in this code deletes it when that date passes, and there is no set date for deleting these records automatically yet. Records that a deletion was done are also kept, with your account identifier scrambled, so a deleted moment can never come back and so we can show the deletion happened. The technical records our servers write as they work can also hold your account identifier, for example when a request to delete something goes wrong. Google, which runs our servers, deletes those automatically after 30 days.

The app does not set how long Firebase Crashlytics or Sentry keep a crash or error report. That is their own setting. Deleting your account does not delete a report that was already sent.

The counts about how the app is doing are kept for 12 months and then deleted. When you delete your account, the counts belonging to it are deleted too, and that is complete within 30 days.

Deleting your data

In the app, Settings → Delete account permanently deletes your account and every moment you've kept (the words, the dates and any backed-up photos) from our servers and from the app on your device, along with your connections, your block list, the name you chose and your phones' delivery addresses for shared moments. This cannot be undone. Deleting your account does not cancel a subscription from the App Store or Google Play. You cancel that with the store. If you no longer have the app installed, you can request deletion without reinstalling it. See Delete your account.

A few things are not deleted with your account: RevenueCat's own record of your plan (email us and we'll have it deleted), crash and error reports (deleting your account does not delete one already sent, and the app does not set how long they are kept), our servers' technical records (they expire after 30 days), the separate New features delivery address, most of what sits in other people's accounts (see "Sharing straight to someone's Moments"), and some records our servers keep to run the service (see "How long we keep it").

Deleting your account also stops the print links you have given from working, because the copies behind them are deleted with it. If one of those copies cannot be found at that moment, its link still stops working 7 days after you made it. A moment somebody has already kept into their own Moments stays with them. It lives in their account now, not yours.

You don't have to delete your account to remove a photo. In the app, Settings → Remove a moment takes the whole moment away, its words and its photo, from your phone and from our servers. Your other moments are left exactly as they are.

Your rights

Wherever you live, you can ask us to access, correct, or delete the personal data we hold about you, object to or restrict how it's used, and withdraw any consent you've given. Email momentsapp.hello@gmail.com from your sign-in address and we'll respond within 30 days. If you want RevenueCat's record of your plan deleted, say so in that email. If you'd rather we didn't count your account at all, say so in that email and we'll stop, for your account only. It takes effect on our side, and there's nothing for you to change on your phone. That includes anything you sent us through the app: tell us the address you asked us to reply to and we'll find it and delete it. If you sent us a message without an account and without an address, we hold nothing that links it to you and can't find it from your name or address alone. Tell us roughly when you sent it and what it said, and we'll find it and delete it. If you believe we've handled your data unlawfully, you also have the right to complain to the data-protection authority where you live (in the UAE, the UAE Data Office). If somebody has written your name into their Moments and you don't use Moments yourself, you have these rights too. "People you name in a moment" explains how to use them and what we can honestly do.

Children

Moments is not directed at children under 13, and we don't knowingly collect data from them. Somebody using Moments may write a child's name into their own moment, usually their own child. When that happens we hold the name and nothing else: no contact details, no profile, and no way for us to reach that child. It is deleted with the moment.

Governing law

This policy and your use of Moments are governed by the laws of the United Arab Emirates.

Contact

Questions about your privacy: momentsapp.hello@gmail.com