Skip to content
Get the app
Privacy

Private by design.

momo is a space for exactly two people. This policy explains, in plain words, what we store, what we can't read, and how to leave.

Last updated 22 October 2026

The short version

Your answers, notes, memories, photos and voice notes are end-to-end encrypted. They are locked on your phone before they are sent, and only your two phones hold the key. We can't read them, and neither can anyone who gets into our servers.

No ads. No selling data. No location tracking. No public profiles. You can export, unlink or delete your account from inside the app.

End-to-end encryption

When the two of you connect, the inviting phone creates a key for your relationship. Each phone also creates its own device key pair, and the relationship key is passed between your devices sealed to those device keys. Our servers only ever see sealed envelopes.

Encrypted on your device

  • Answers to daily questions
  • Note text and moods, and every photo and voice note
  • Memory titles, captions, places and photos
  • Milestone, countdown, bucket list and date plan text

How

Content is encrypted with AES-256-GCM. Device keys use P-256, and the relationship key is wrapped for each device with ECDH and HKDF-SHA256. Keys are kept in your phone's secure storage and are never backed up to us. When you move to a new phone, it receives the key the next time your partner opens momo.

What stays readable to the server

A few things have to stay readable for momo to work: display names (used in notifications and invite previews), birthdays, avatar and note colours, bucket list categories, dates and times, file locations, and the answers to the short questions you fill in before pairing.

What we store

  • Account: your email address, or the identity Google provides when you sign in with Google.
  • Profile: display name, birthday if you add it, and appearance choices.
  • Your shared space: the encrypted content above, plus who created each item and when.
  • Device: a push notification token per device, and each device's public encryption key.
  • Crash reports: if the app crashes, a report with device model, OS version and the technical stack trace. Never your content.
  • Optional analytics: only if you switch it on under Privacy in the app, a small set of product events — screens opened, item counts, on/off choices — tied to your account id. Never your content, never your partner's content, and it stays off until you agree.

What we never collect

  • Your location. A place on a memory is a label you type, never GPS.
  • Your contacts, call logs or messages from other apps.
  • Advertising IDs. There are no ads and no ad networks in momo.
  • Tracking across other apps or websites. Analytics inside momo is optional and limited to the events above.

How we use it

Only to run momo for the two of you: signing you in, syncing your shared space between your phones, sending the notifications you asked for, and fixing crashes. We do not sell, rent or share your data for advertising, and we do not use your content to train AI models.

Who helps us run momo

  • Supabase (managed PostgreSQL database) and Cloudflare R2 (file storage): they hold your content, encrypted end-to-end so the server cannot read it. Accounts, pairing and sign-in run on our own API service.
  • Google Firebase: push notifications and crash reports. Notifications carry only your partner's name and a short fixed line.
  • Resend: delivers the six-digit sign-in code to your email address.
  • Mixpanel (EU region): optional product analytics, only after you turn it on. Receives ids, counts and on/off choices — never message, note or answer text.
  • Google Sign-In: if you choose to sign in with Google.
  • Vercel: hosts this website.

Each processes data only on our behalf and under their own security commitments.

Unlinking and deletion

  • Either of you can unlink at any time. Access ends for both of you immediately.
  • Shared content is kept for 30 days so either of you can export a copy, then permanently deleted, files included.
  • Deleting your account unlinks you first, then removes your profile and sign-in identity. See how to delete your account.
  • Crash reports are kept for up to 90 days.

Your rights

You can access, export, correct or delete your data. Most of this you can do in the app. For anything else, including requests under GDPR, UK GDPR or similar laws, email hello@arovi.app and we will answer within 30 days. You can also complain to your local data protection authority.

Security

Beyond end-to-end encryption, our API authorizes every request against your live couple membership, so one couple can never reach another couple's data — the app never gets to name whose data it wants. Traffic is encrypted in transit with TLS, and your sign-in session and device keys are stored encrypted on your phone. If you find a security issue, please tell us at hello@arovi.app.

Children

momo is not meant for anyone under 13, and we don't knowingly collect data from children.

This website

This site uses no cookies, no analytics and no third-party trackers. Fonts are served from our own domain. Our host keeps standard server logs, such as IP address and requested page, for security.

Changes

If we change this policy in a meaningful way, we will update the date above and tell you in the app first.

Contact

Questions about privacy? Email hello@arovi.app. A real person reads it.