Privacy Policy

What leaves your phone

Only when you press Send: the pictures and clips you chose (resized), your recording, the name you give, and the day each picture was taken, when your phone knows it (see When pictures were taken below). Until then a memory stays on your phone, including one you "save for later". When you add your voice to someone else's memory, it's sent as soon as you stop recording (with the name you give). Spooly never reads the rest of your photo library; your phone's photo picker hands it only what you tap.

Your ownership

Each memory you make has a private key that lets you remove voices or delete it. On iPhone, the app keeps it in your iCloud Keychain, end-to-end encrypted by Apple, so it follows you to a new phone. On Android, it's kept in Google's Block Store, end-to-end encrypted, so it comes back on a new phone or a reinstall; that needs a Google account and a screen lock on the phone, and without them the key stays on that phone only.

Who can see it

Only the people in a memory can see its pictures, hear and read everything said on it, and add their own voices and pictures. Whoever made it is in. Its link lets people in for three days from the first time someone opens it; after that, anyone new asks the person who made it, who lets them in or not. Everyone in a memory can see who else is in it. The person who made it can stop the link sooner, say yes to each new person themselves (Ask me before anyone joins), or remove anyone, and the memory comes off that person's phone or browser.

Links are long and random, and aren't listed or indexed anywhere, but anyone a link is forwarded to in its first three days can get in. The person who made a memory can remove any voice or picture from it, or delete the whole memory. Anyone who added a voice or pictures can remove them again from the phone or browser they added them from (Remove my voice, Remove my pictures). Either way the files and words are removed from our server. The person who made a memory can also close it to new voices, or reset its link so the old one stops working.

How Spooly knows who's in

There are no accounts. To remember that you're in a memory, Spooly uses a private id: on the web page, a cookie named spooly that only spooly.io can read, kept for 400 days from your last visit; in the apps, an id the app keeps on your phone. We keep only a one-way scrambled code of it, which can't be turned back into the id, with the name you give when you add something or ask to join. It's used only to know who's in a memory, and to keep out anyone its maker removed or blocked.

Nobody at Spooly looks

No person at Spooly looks at a memory, its pictures, voices or words, unless someone reports it, our check for known child sexual abuse images flags it, or someone in it asks us for help with it. Computers do the work, as described below. Every time we do look, it's logged.

Reports, blocks and links that spread

Anyone in a memory can report a picture, a voice or the whole memory. Reports come to us, never to the people in the memory, and we act on them: we may remove what was reported, or the whole memory.

So a memory's maker can block someone, we keep two one-way scrambled codes with each voice or picture someone adds: one of a private id their phone or browser keeps for Spooly, and one of their internet address (that one for 30 days). None of these codes can be turned back into the id or the address. If lots of people come in through a memory's link at once, it stops letting anyone new in, and its maker is told.

If something illegal is reported, we may keep a private copy for the authorities, for as long as the law asks (up to a year), and report it to them. It's never shown to anyone, and never kept in our nightly backup.

Where it's kept

On Cloudflare (our storage and database), which we run. The files aren't publicly listed; only the people in a memory reach them, through links that stop working within an hour. They aren't end-to-end encrypted, so our service can read them. Every night we copy them to a private backup on a computer we own, so a memory can't be lost; something its maker deleted stays in that backup for up to 30 days, then it's gone there too.

Who else processes it

To keep known child sexual abuse images off Spooly, each picture (and still frames from each video clip) is checked when it's added with Microsoft's PhotoDNA, which compares a fingerprint of the picture with those of images already known to be child sexual abuse material. Microsoft doesn't keep the pictures. A picture that matches is never shown, and we report it to the National Center for Missing & Exploited Children, as US law requires, with the internet address it was sent from: the one time we keep an address itself rather than a one-way code.

To turn voices into words, each recording is sent to OpenAI's transcription service (if that fails, to a speech-recognition model, Deepgram's Nova-3, running on Cloudflare's own computers, which keeps nothing). To weave several voices into one piece, the words, speakers' names, and small copies of the pictures are sent to Anthropic's Claude (for memories made before September 25, 2026, the pictures themselves, by a short-lived private link). So the weave knows what happens in a video clip, each clip is sent once to Google's Gemini, which watches and listens to it and writes short notes for the weave (never naming anyone); the copy sent to Google is deleted as soon as the notes are back, and the notes are never shown on the memory. If our transcription couldn't handle a recording, it isn't transcribed (it still plays; it's just left out of the woven piece).

If you allow notifications, Apple's push service (on iPhone) or Google's Firebase Cloud Messaging (on Android) carries alerts like "someone added their voice", "everyone's together", "someone asked to join" and "you're in" to your phone.

Under their API terms, OpenAI, Anthropic and Google don't use this data to train their models; they may keep it for a limited time to prevent abuse.

Where pictures were taken

On iPhone, if a photo or clip says where it was taken, the app reads that on your phone before sending it, and the file itself goes without it. Your phone asks Apple's map service for the place's name. We keep the exact spot on our server, and the people in the memory see only the name: a park, venue or neighborhood and the town, never a street address. Turn off "Location" in the photo picker's options to send none.

The Android app and the web page send no location: each picture and clip goes without it.

When pictures were taken

The Spooly apps send the day each picture and clip was taken, when your phone knows it (from the picture itself, or your phone's photo library), including pictures you add to someone else's memory. We keep the days on our server. The people in a memory see only the month and year it's from, which is where it sits on their timeline in the app. Whoever made a memory can set its date themselves (for scans of old prints, which are dated the day they were scanned), and everyone in it sees that date. The web page sends no dates.

What we count

To know whether Spooly works, we keep daily totals only: how many memories were sent, links opened, recordings started and sent, weaves made, what was listened to (and whether all the way through), videos saved, notifications opened, people who came into a memory or asked to, and how long things took. The totals have no names, words, links or anything that identifies a memory or a person. To stop abuse, each request is limited per internet address; the address is kept only as a one-way scrambled code, for at most a day (and longer only as described under Reports, blocks and links that spread).

What we don't do

No accounts, no ads, no tracking across apps or sites, no third-party analytics, and nothing sold or shared beyond what's described here.

Questions

Send a message and a person will answer.