Your moments,
your privacy.
This notice describes the current MomentLoop testing website and Android pilot hosted at renvoriq.tech. It is a limited pilot, not a finished global social service. This notice is provided for transparency; a complete, legally reviewed policy and privacy contact are required before broader public launch.
1. What we collect
- No account: visiting a venue QR increments an aggregate scan count. Editing and downloading your photo occur on your device. No guest photo is uploaded unless you explicitly select private-link sharing.
- Optional account: username, display name, password hash, optional biography, optional profile photo, privacy preference, account activity dates and session identifiers. The password itself is not stored in readable form.
- Shared memories: a temporary re-encoded image, caption, design, location identifier, random link token and hashed deletion key. Image metadata such as camera GPS EXIF is removed during re-encoding.
- Private album: signed-in adults may explicitly save a separate copy of a photo in a private, account-only library. This remains until the user deletes it or closes the account, subject to pilot storage limits and service availability. Private album images are not shared through link URLs.
- Backup recovery codes: five random one-time codes are shown only when created or regenerated. The server holds keyed hashes rather than readable codes. Anyone who gains a code and your username could reset your password.
- Technical security: pseudonymous rate-limit counters, IP-related request information and operational access logs may be processed to protect the service and troubleshoot failures.
Private group moments and invitation links
Group creators must be signed-in adult account holders. They can create a private group moment lasting 14 days. Anyone holding a valid invitation link can view and contribute up to the group's 12-photo limit. Read-only links allow viewing without contributing. Group contributors do not need accounts, and names they enter are unverified. Photos and captions are visible to anyone with a valid link, and recipients can save copies.
Creators can close uploads, revoke and replace invitation or read-only links, remove submissions, or delete the entire group. Guest contributors receive a local deletion key for removing their own photos while they still have a valid link; the photo can still be removed from the My Contributions section even if an invitation is rotated or closed, as long as the original deletion key remains on that device. Clearing browser data may lose that key. Group photos are sanitized and automatically removed after group expiry, but previously downloaded copies cannot be recalled. Story and reel reuse requires a separate, optional affirmative consent from each contributor. Without this permission the creator cannot include that photo in a curated story. Contributors retaining their deletion key can also withdraw story/reel consent without deleting the original group photo, and their photo will stop appearing in group stories on subsequent requests. Previously exported or downloaded videos cannot be recalled. Do not upload photos without consent from everyone pictured. No proactive content moderation, report queue, abuse appeals or verified user identity is implemented in this private pilot.
Collaborative group stories and locally exported reels
Group creators may curate previously contributed group photos into a private vertical story. The creator selects scenes, captions, sequence, duration and visual theme. Only the group creator and people with valid invitation or view-only links can load the story. Unpublishing a story removes the curated sequence, but does not delete the original group photos.
Short photo-to-video reels use up to six curated group photos. Where supported by the browser, the reel is rendered locally and downloaded as a silent WebM video; the exported video is not automatically uploaded to MomentLoop or any social platform. Recipients who save or share their reel are responsible for doing so with permission. Some browsers, including embedded Android WebViews, may not support WebM export.
Public discovery, place feeds and creator following
Public discovery is strictly opt-in. Only signed-in adults who separately enable a public creator profile can submit a new photo or original short video to the public-post queue. The creator confirms permission to publish this specific media and selects a listed venue. Submission does not automatically publish: a pilot moderator must approve it first. Private photos, group memories and temporary private links are never automatically imported into public Discovery.
When a creator profile is enabled, the username and display name may be shown publicly. A profile bio is shown only if the creator separately chooses to make it public; profile photographs remain private in this pilot. Followers, follow counts and approved public posts can be seen by viewers. Disabling a public creator profile hides posts and the creator page from Discovery. Public-post deletion removes the hosted photo/video, although copies previously saved by viewers cannot be recalled.
Nearby uses only the city a viewer selects manually. It does not request GPS, precise location, or continuously expose anyone's whereabouts. Listed places do not imply verified ownership; the demonstration venue is clearly marked as a demo. Suggested venue listings require manual review. Public media may include places and people, so avoid precise home locations, children, private conversations, or content lacking permission from people depicted.
Public short-video files are converted to a silent portrait MP4 for the pilot, with a 20-second and 12-MB upload limit. Posts are reviewed manually before visibility. Signed-in viewers may follow creators/places, like public posts, block users, and submit private reports to moderators. Three distinct unresolved reports temporarily hide a post pending review. This pilot does not have 24-hour safety operations, verified reporting appeals, copyright adjudication or production-scale moderation, and should not be opened to the general public at scale.
2. Who sees your information?
Profile details and photos are accessible only to the signed-in account holder in this pilot. There is no public profile or account search. Venue operators cannot browse your individual profile or privately linked memories through the current merchant dashboard.
Anyone with a private memory URL can view the shared image and caption. Sharing a link with messaging services may make its URL available to those services and recipients. Recipients may save a copy; deleting our server copy cannot remove copies held by others.
3. Your choices and controls
- Creating an account is optional. The QR memory editor works without one.
- Account-linked memory history is off by default. Turn it on under Profile → Privacy if you want your future shared links saved to your private account. You may manually attach a link from this device using its deletion key.
- You may update your username, display name, biography and profile photo. Username changes are limited to once every 30 days.
- You may remove a profile picture, delete individual temporary links or private-album photos, export account details, change your password, sign out, or permanently delete your account and account-owned memories.
- Lost your password? Use an unused one-time recovery code issued at signup (or regenerated later) to set a new password. Recovery immediately signs out all existing sessions. There is no email or SMS fallback if you lose all codes.
- When signed out, anyone retaining the original private memory deletion key can delete that memory. Without the key or account ownership, this self-service delete method is unavailable.
4. Retention
Temporary private-link photos expire after 7 days and an hourly server cleanup removes expired records and stored image files. Separately saved private-album photos do not automatically expire: they remain until individually deleted or removed with the account, but pilot uptime and data durability are not guaranteed. Profile details remain until you delete the account. Account logins expire after 7 days; session records and rate-limit information are periodically cleaned up. Browser or device downloads do not expire with the server link.
Operational logs and system backups may have different retention schedules. This pilot does not yet have an externally published, fully verified retention-and-erasure policy for backups and logs; this is a launch blocker for wider deployment.
5. Security and limitations
Passwords are hashed with Argon2id. Session cookies are Secure, HttpOnly and SameSite; account changes require a security token. Uploaded photos are checked and re-encoded. Profiles are private and not available via a public profile endpoint. No biometric recognition, location tracking through photo EXIF or user image advertising is implemented.
As with any online service, no server can promise absolute security. The current pilot supports only one-time backup codes for password recovery; it does not support verified email addresses, phone-based recovery, two-factor authentication, or an independent third-party security audit. Do not reuse a password or upload sensitive images while evaluating.
6. External providers
The website is hosted on infrastructure controlled by the operator. It loads Google Fonts in some pages, so browsers can contact Google's font servers. Illustrative lifestyle photographs are self-hosted and are not user submissions. The Android test APK uses your device camera and system picker only when requested.
7. Children and age
Accounts are currently restricted to people who confirm that they are 18 or older. The anonymous QR editor is available without registration; users should not upload or share photographs of children without appropriate permission. Robust age assurance and parental consent processes have not yet been implemented.
8. Contact and wider launch
This is a limited private testing deployment. A verified contact address, legal entity details, legal review of applicable data protection requirements and a complete account recovery process must be published before public onboarding at scale. For now, use the self-service profile, memory delete, and export controls. Do not treat this pilot as a fully deployed consumer social network.