Memo: Privacy Policy

• Account: your email address, and your X or Discord handle if you sign in with one.
• Wallet: the address you connect, and the dates it was linked to and unlinked from your account.
• Content you create: Character names, bios, trait descriptions, and anything else you submit.
• Profile: your display name, bio, chosen picture, badges and collection, which are visible to anyone with your profile link if you make the profile public.
• Technical: your IP address, browser and device, and server logs. An IP address counts as personal data under EU law even though it does not carry your name.
• Analytics, only where you have agreed to it: how pages are used, and for Microsoft Clarity a recording of a session including mouse movement, scrolling and clicks.

The GDPR requires a legal basis for every purpose. Ours are these:

If you are in the EU, the EEA or the UK, Google Analytics and Microsoft Clarity do not run at all until you accept them. You are asked once, accepting and declining take the same single click, and declining leaves Memo fully usable.

You can change that choice at any time from the cookie settings link in the footer. Withdrawing is as easy as giving, which is the standard the law sets.

Vercel Speed Insights measures how fast pages load. It sets no cookie, stores nothing on your device and does not identify you, so it runs everywhere.

Memo also keeps anonymous counts of how it is used: how often each Archives entry is opened, how readers reached it, what they search for, and how many visitors accept or decline the cookie question. Each count is a daily total, linked to nobody. The counts set no cookie and store nothing on your device, so they run everywhere.

Cookies that keep you signed in are essential and are not part of that choice, because without them Memo cannot tell it is you.

We do not sell your data and we do not share it with advertisers. We do rely on other companies to run Memo, and they process data on our instructions:

• Supabase: the database and session storage that holds your account.
• Vercel: hosting, the network that serves every page, and Speed Insights.
• Dynamic: sign-in and wallet connection.
• Alchemy: reading the blockchain to confirm what a wallet holds.
• Google Analytics and Microsoft Clarity: usage measurement, only with your consent.
• Mux: video playback. Cloudways and Vercel Blob: images.
• Font Awesome: the icon set Memo is drawn with. It loads from their servers on every page, so they see your IP address. It is not analytics and it does not track you, but it is a third party and you should know it is there.
• Anthropic: Claude, the AI our team uses to build and run Memo. When we look into a bug or a support request that involves your account, it can see your account details.

Some Keshuma Archives pages point to music on Spotify. The card for it shows the cover and the title from our own servers, so opening the page tells Spotify nothing.

If you press play, Spotify's own player loads inside Memo. From that moment Spotify sees your IP address and may set its own cookies, as it does on its own site. Spotify decides what it collects there, so its own privacy policy covers that part, at spotify.com/privacy.

Spotify does not process data for us, which is why it is not in the list above, and we send it nothing about you.

Some of the companies above are based in the United States, so some data reaches servers outside the European Economic Area. Where that happens it is covered by the European Commission's standard contractual clauses or by an adequacy decision, which are the mechanisms EU law provides for sending data abroad.

Once a month we write down totals: how many collectors there are, how many joined, how much was written. Those are plain numbers with nobody attached, so we keep them and can still see how Memo did over a year after the records behind them are gone. Nothing in them can be traced to you, and when a count is small enough that it might point at one person we do not record it at all.

Wherever you live you can ask us for a copy of your data, ask us to correct it, or ask us to delete it. If you are in the EU, the EEA or the UK you also have the right to restrict how we use it, to receive it in a portable form, to object to processing we base on legitimate interests, and to withdraw consent at any time without that affecting what we did before you withdrew it.

Write to hello@finalbosu.com and we will answer within one month.

If you think we have handled your data badly you can complain to a supervisory authority. Ours is the Spanish Agencia Espanola de Proteccion de Datos at www.aepd.es, and you can also complain to the authority where you live.

Memo is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has created an account, write to hello@finalbosu.com and we will remove it.

We update this policy when what we do changes. The version number at the top moves every time. If a change affects what we collect or why, we will say so in Memo rather than quietly swapping the text.