Memorify (ዲጂታል መጽሔት) — Privacy Policy

Effective: 2026-05-12 Last updated: 2026-05-12

This Privacy Policy explains how the Memorify (ዲጂታል መጽሔት) application (“Application” / “Memorify”), operated by Dagmawi Abebe (“Service Provider”, “we”, “us”), collects, uses, and protects information when you create an account and use the Application.

By creating an account or otherwise using Memorify you agree to the practices described in this Privacy Policy and in our Terms of Use and Child Safety Standards.

1. Information we collect

1.1 Information you provide to create your account

When you sign up we ask you to provide:

• Phone number (used as your primary credential and verified via OTP)
• Email address (used for account recovery and communications)
• Full name
• Password (stored only as a one-way hash on our servers — we cannot read it)
• Optional profile photo (uploaded from gallery or camera)

If you choose Continue with Google, we additionally receive the Google ID token issued by Google Sign-In, which contains your Google account email, display name, and a unique account identifier. We do not receive your Google password.

1.2 Information you provide while using Memorify

• Institute affiliation — which schools/universities you join, the department and class you select, and your join request status.
• Yearbook / institute profile data — your “last word”, profession, and any custom fields the institute admin enables (e.g. quote, ambition).
• Photos you upload — your profile picture (per institute) and, if you are a batch admin, event photos you contribute to your institute’s events.
• Favorites — the users and event photos you mark as favorites.
• Payment information — when an institute requires a membership fee we hand you off to a third-party payment provider (Chapa / Telebirr). Memorify itself does not store your card number, mobile-money PIN, or banking credentials. We only retain the transaction reference and payment status returned by the provider.
• Reports you submit — bug reports and safety reports, including any description, category, severity, and (for safety reports) the id and type of the reported content.

1.3 Information automatically collected

• Device push token (FCM / APNs) — to deliver push notifications.
• App version and platform (android / ios) — sent with auth requests so we can ship targeted bug fixes.
• Server-side technical logs — request timestamps, IP address, HTTP status codes for security auditing and abuse prevention.

1.4 Information we do not collect

• We do not collect precise location (no GPS, no Wi-Fi/SSID, no cell-tower geolocation).
• We do not read your contacts, SMS, or call logs.
• We do not use AI to profile, score, or moderate users.

2. How we use information

We use the information above to:

• Authenticate you and keep your account secure.
• Show you the institutes you belong to, your classmates, and your yearbook content.
• Allow batch admins to manage their institute’s events, photos, and member list.
• Process membership payments through our payment partners.
• Send transactional and safety-related push notifications (e.g. join requests, payment receipts, abuse-report acknowledgements).
• Investigate reports of abuse, content that violates our Child Safety Standards, and other Terms violations.
• Comply with applicable law.

We do not sell your personal information. We do not use your data for behavioral advertising.

3. Sharing with third parties

We share data only with the following processors, and only the minimum needed for them to provide their service:

We may disclose information without your additional consent only when:

• Required by law, subpoena, or other legal process.
• Necessary to investigate or prevent fraud, abuse of minors, or threats to safety.
• A government authority makes a lawful request and we are legally required to comply.

4. Children’s privacy and child safety

Memorify is not directed to children under 13. We ask all users to confirm they are 13 or older during account creation.

If we become aware that a user is under 13 we will:

1. Disable the account.
2. Delete personal data associated with it.
3. Notify the user (or guardian, where reachable) of the action.

Memorify also publishes dedicated Child Safety Standards covering our prohibition of Child Sexual Abuse and Exploitation (CSAE), in-app reporting paths, designated child-safety contact, and moderation practices.

If you are a parent or guardian and believe your child has provided personal information to Memorify, please contact dagos.mobile.apps@gmail.com and we will take action within a reasonable time.

5. How long we keep your data

• Account data is kept for as long as your account exists.
• Authentication tokens are short-lived and rotated automatically.
• Payment records are kept for at least 7 years to meet tax and regulatory recordkeeping obligations.
• Bug and safety reports are retained for at least 12 months for moderation, auditing, and law-enforcement cooperation.
• Push tokens are deleted as soon as you sign out of the device or uninstall the app.

When you request account deletion (see Your rights below) we delete your profile data within 30 days. Aggregated or anonymized data and records we are legally required to keep (e.g. fraud-prevention logs, tax records) may be retained longer.

6. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data — most of which you can edit yourself in Profile → Edit.
• Delete your account and the personal data associated with it.
• Export your data in a portable format.
• Object to / restrict certain processing.
• Withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing already performed.

To exercise any of these rights, email dagos.mobile.apps@gmail.com with the email or phone number associated with your account. We will respond within 30 days.

You can also stop all future collection by uninstalling Memorify and revoking any platform permissions (e.g. notifications, camera, gallery) from your operating system settings.

7. Security

We protect your information with:

• TLS 1.2+ for all client–server communication.
• One-way password hashing (we never store plaintext passwords).
• Bearer-token authentication with short-lived access tokens and rotating refresh tokens.
• Role-based access control on the server (a batch admin of one institute cannot read another institute’s data).
• Physical, electronic, and procedural safeguards on our hosting infrastructure.

No method of internet transmission or electronic storage is 100% secure, but we use industry-standard measures to protect your data. If we discover a breach affecting your data we will notify you within 72 hours where legally required.

8. International data transfers

Memorify’s servers are hosted in regions outside Ethiopia. By using the app you consent to the transfer of your information to these regions, where data-protection laws may differ from those in your country.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through an in-app notice and/or a push notification. Continued use of Memorify after a change indicates your acceptance of the revised Privacy Policy.

The “Effective” date at the top of this document reflects the date of the most recent update.

10. Contact

For privacy questions, data-access / deletion requests, or any other concern about how Memorify handles your information:

Email: dagos.mobile.apps@gmail.com Subject line: “Privacy request”

For child-safety concerns specifically (in addition to the in-app reporting flow described in our Child Safety Standards):

Email: dagos.mobile.apps@gmail.com Subject line: “CSAE report”