Your notes stay on your device: on your phone, or in your browser. A Memlow account never holds your notes. The ads in the Android app come from Google, which uses some information about your device to show them. The web version has no ads.
Memlow is a free notes app for Android and for the web at app.memlow.com. Your notes work without the internet (ads, Google Drive and accounts need it). This policy explains what happens to your information when you use Memlow and memlow.com.
Your notes
Notes, photos, voice notes, tags and reminders are stored only on your device: inside the app on your phone, or in your browser's storage when you use Memlow on the web. They are not sent to us. We (the publisher) have no server that stores notes and never receive them, whether or not you have a Memlow account.
Backups
If you turn on Google Drive backup, an encrypted copy of your notes is stored in a hidden app folder in your own Google Drive (the "appDataFolder"). Only Memlow can open that folder, and only your backup password can unlock the copy: the encryption happens on your device before anything is uploaded.
To connect to Drive, Google shares your account's email address with Memlow. It is used only to show which account backs up, and it stays on your device. Memlow asks Google only for access to its own app folder in your Drive; it cannot see your other files.
Backup files you save yourself (for example to your phone's storage) are encrypted too when you give them a password.
Memlow's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Memlow on the web
The web version runs in your browser. It has no ads, and it never sends your notes to us. If you are signed in to a Memlow account, the app asks our server whose account it is, only to show your name and photo in Settings; when you are signed out it sends nothing at all.
- Where notes are kept: in your browser's own storage on your device. They stay there until you delete them, clear your browser's data for app.memlow.com, or choose Settings → Backup and data → Erase Memlow from this browser. We can't see them.
- Google Drive (optional): if you link Google Drive, Memlow makes backups of your notes, photos and recordings, encrypted in your browser with a key that only your backup password opens, and keeps them in Memlow's hidden app folder in your own Drive (the "appDataFolder"). They are the same backups the Android app makes, so the app and the website can open each other's backups with that password. Google stores only encrypted files and we receive nothing. Memlow asks Google for access to that app folder and for your email address (to show which account is linked); it cannot see your other files. Google's sign-in gives your browser a short-lived access token, which Memlow keeps in memory only and never stores or sends to us.
- Locked notes: hidden behind your PIN, as in the Android app: their cards and search show only the title, and opening them asks for the PIN. The PIN itself is never stored, only a one-way check of it. In backups, locked notes are protected by the backup's encryption like every other note.
- Voice typing: uses your browser's speech recognition. Some browsers (Chrome, for example) send the audio to their provider to turn it into text, under that provider's privacy policy. Voice notes you record stay in your note.
- Notifications: if you allow them, your browser shows reminders on your device.
- Backup files and exports you save are files on your device; backups are encrypted when you give them a password.
- The online notepad on our notepad page keeps the one note you type there in your browser's storage, until you clear it or move it into Memlow.
Memlow accounts
You can make a Memlow account on memlow.com. It holds your sign-in details, never your notes. We keep:
- Your name and email address, and when you confirmed the email.
- Your password, only as a one-way hash (Argon2id). We can't see or recover it.
- If you sign in with Google: your Google account ID, its email address and, if you choose it, a copy of your Google profile photo. When you choose "Continue with Google", Google shows you what it shares; we ask only for your basic profile and email address.
- A profile photo if you add one. We shrink it to 256 × 256 pixels and remove any hidden details (such as location) from the file. Only you are shown it.
- Your sign-ins: for each signed-in device, the kind of device and browser (for example "Chrome on Windows"), when it was last active, and, if our host provides it, the country. Sign-ins end after 30 days without use, or when you sign out.
- An account log of security events, such as sign-ins, password changes and Google being linked, so you can check them on your account page. Next to each event we keep a scrambled code made from your internet address and the day (a salted hash), never the address itself.
- Your language, when you choose one.
We use this only to let you sign in, keep your account safe, and send the emails below. To stop people guessing passwords, we count failed tries for a short time using scrambled codes of the email and internet address. We don't sell or share account data, and no ads use it.
On your account page you can change your details, see and end your sign-ins, download your data (a file with everything above), and delete your account.
Blog comments
If you comment on a blog post, we keep your name, your comment, and your email address if you give one. Your email address is never shown, and we use it only if we need to contact you about your comment. Every comment waits for the site owner to approve it. To stop spam we keep a scrambled code made from your internet address and the month (a salted hash), never the address itself. Ask us at support@memlow.com to remove a comment.
Visit counts
The pages of memlow.com (not the notes app) count visits so we know which pages help people. For each day we add one to the count of the page you opened and, if you came from another site, of that site's name (for example "google.com"). That's all: no cookie, no ID, no internet address and nothing that could tell your visits apart from anyone else's. If your browser sends Do Not Track or Global Privacy Control, nothing is counted.
Cookies
memlow.com uses a few small cookies only to keep you signed in and remember your language. There are no advertising or tracking cookies. Every cookie, and what it does
Emails we send
If you have an account, we email you the codes to confirm your address and to reset your password, and a short notice when something important changes (such as your password, Google being linked or unlinked, or your account being deleted). We send them from our own mailbox at our hosting provider. We don't send newsletters or marketing.
Ads
Memlow is free because it shows ads: a banner at the bottom of some screens and, now and then, a full-screen ad when you close a note. The ads come from Google AdMob. To show ads, limit how often you see them, measure them and prevent fraud, Google's Mobile Ads SDK in the app collects and shares with Google: your phone's advertising ID and app set ID, your approximate location (from your internet address), how you interact with ads, and information about your device and app performance (such as crashes of the ads code).
Ads never see your notes: no note text, photo, voice note or tag is part of any ad request, and ads are limited to content suitable for general audiences.
Where the law requires it (for example in the European Economic Area, the UK and some US states), Memlow asks for your consent with Google's consent form before personalised ads are shown. You can change your choice at any time under Settings → Ad privacy choices. You can reset or delete the advertising ID, or opt out of personalised ads, in your phone's settings (Settings → Privacy → Ads, or Google → Ads).
How Google uses this information: How Google uses information from sites or apps that use its services, and the Google Privacy Policy.
Apart from the ads, the Android app has no analytics, no crash reporting and no AI, and it sends us nothing about you.
Permissions on Android
- Microphone: only while you record a voice note or use voice typing. Voice typing uses your phone's own speech service; when your language isn't available offline, that service may send the audio to its provider (such as Google) to turn it into text, under that provider's privacy policy.
- Notifications and alarms: only for reminders you set.
- Internet: for backups to your own Google Drive, and to show ads.
- Photos: chosen through Android's photo picker; Memlow sees only the photos you pick.
- Advertising ID: used by Google's Mobile Ads SDK for ads, as described above.
Locked notes
Notes and folders you lock need your PIN (or fingerprint) to open. The PIN is stored on your phone as a protected hash and never leaves it.
Deleting your data
Uninstalling Memlow deletes everything it stored on your phone. Backups in your Drive can be deleted from Memlow's Google Drive backup settings ("Delete Drive backups"), or by removing Memlow's data in your Google Drive settings.
On the web, Settings → Backup and data → Erase Memlow from this browser deletes everything Memlow stored in that browser, and Settings → Storage and Google Drive → Delete Drive backups removes every Memlow backup from your Drive (the Android app's too). Step by step
To delete your Memlow account, sign in and open Account → Account → Delete account. It removes your account, your sign-ins, your photo and your account log straight away. We keep only a line in our own records that an account with that number was deleted, with no name or email. If you can't sign in, email support@memlow.com from the address on the account.
Children
Memlow is not directed at children under 13, and you need to be at least 13 to make a Memlow account. The ads data above goes to Google.
This website
memlow.com has no ads and no advertising or tracking cookies. Its pages come from memlow.com and the web app from app.memlow.com, and nowhere else. Notes kept at memlow.com before the web app moved to app.memlow.com (October 2026) are moved once by your browser itself, from one address to the other on your device; they never pass through our servers. If you link Google Drive or choose "Continue with Google", your browser also talks to Google (accounts.google.com and Google's Drive servers). Blog posts may show a YouTube video; it loads from YouTube's privacy-enhanced address (youtube-nocookie.com) and only when the post is shown. Like any web server, our hosting provider keeps standard access logs (such as the IP address, browser and page requested) for security and troubleshooting; we don't use them to identify you. If you email us, we use your message and address only to reply.
Changes
If this policy changes, the new version will be published here with a new effective date.
Contact
Questions about this policy, or a request about your data: support@memlow.com. See also our terms and cookies pages.