Privacy Policy

Last updated: April 18, 2026 (version 2026-04-18)

1. What MemoryBank Is

MemoryBank is a service operated by ACK LABS LLC, doing business as MyMemoryBank, the entity responsible for the data described in this policy. MemoryBank is a family investment dashboard that displays real-time brokerage data for children's accounts. Parents sign in at mymemorybank.appto manage their family's portfolio view. Kids access their personalized dashboard on any device — phone, tablet, or a wall-mounted display — without needing a login of their own.

2. Information We Collect

  • Account information — your name and email address, provided at sign-up via Clerk (email/password or Google social login).
  • Brokerage data — portfolio balances, masked account numbers, holdings, and daily change data fetched from your connected institutions (via Plaid) using OAuth tokens you authorize. We fetch this data on your behalf and display it to you; we do not analyze, sell, or share it.
  • Children's profiles — first name, emoji avatar, color preference, and (optionally) birth year you enter for each child. Birth year is used solely to personalize the reading level of AI-generated stock stories — we never collect a full date of birth, address, school, or any other personal information about your children. All child-profile fields are entered by the parent account holder through their authenticated dashboard; children do not enter this information themselves.
  • Kid-surface personalization— on the kids' dashboard, children may adjust their own avatar emoji and accent color, track progress toward savings goals the parent created, and add publicly-traded ticker symbols (e.g. AAPL, VOO) to a watchlist. These inputs are constrained to non-personal values (a single emoji, a hex color, an integer amount, a validated ticker symbol) and are not used for any purpose other than displaying the personalized dashboard.
  • Penny conversations— if you use Penny, our AI support and learning assistant, we store the text of your messages and Penny's replies so we can show conversation history, improve answers, and detect issues. Messages are sent to our AI provider (Anthropic) for processing. See section 7 for full details, including which surfaces require a paid subscription before any kid-side chat is possible.
  • OAuth tokens — Plaid and Google Photos access and refresh tokens, stored AES-256 encrypted at rest in our database. Raw tokens are never logged or accessible outside the encrypted store.
  • Google Photos data — if you connect Google Photos, we store your Google account email (to display which account is linked) and a Picker session ID (to remember which photos you selected). See section 6 for full details.
  • Device tokens— when you pair a kid's device using a 6-digit code, a random device token is generated and stored as a SHA-256 hash in our database. The raw token is stored only in the device's browser localStorage and is never logged server-side.
  • Usage data — standard server logs (IP address, timestamp, endpoint) for security and debugging. Logs are retained for 30 days.

3. How We Use Your Information

  • To display your family's investment portfolio on authorized devices.
  • To refresh brokerage data automatically so your dashboard stays current.
  • To display family photos as a screensaver on connected displays.
  • To maintain your account and children's profiles across sessions.
  • To power Penny, our AI support and learning assistant, and to improve its answers over time.
  • To process subscription payments via Stripe.
  • To send transactional emails (account changes, billing receipts).

We do not sell your data, share it with advertisers, or use it for any purpose beyond operating the MemoryBank service.

4. Brokerage Access

MemoryBank connects to your financial institutions via Plaid using read-only access. We never have the ability to place trades, move funds, or make changes to your brokerage accounts. You can revoke access at any time from the Connections page or directly from your Plaid-managed account settings at the institution.

MemoryBank is a display tool, not a financial advisor. Nothing displayed on the dashboard constitutes investment advice.

5. Data Storage & Security

  • Data is stored in a PostgreSQL database hosted on Railway (US region), encrypted at rest at the volume level.
  • OAuth tokens are additionally AES-256 encrypted at the application layer before being written to the database.
  • All traffic between your browser and our servers uses HTTPS/TLS.
  • Authentication is handled by Clerk, a SOC 2 compliant identity provider.
  • Device tokens are stored only as SHA-256 hashes — the raw token exists only on the paired device.
  • No credentials or secrets are ever committed to source control.

6. Google Photos Integration

If you choose to connect Google Photos, MemoryBank uses the Google Photos Picker API so you can select specific photos to display as a screensaver on your family's dashboard devices. This connection is optional and entirely parent-initiated.

  • Scope requested: photospicker.mediaitems.readonly— access only to the photos you explicitly select via Google's own Picker interface. We do not access your broader Google Photos library.
  • What we store: your Google account email (to display which account is linked), encrypted OAuth tokens, and a Picker session ID. No photo bytes, album names, or library metadata are stored in our database.
  • Caching: photo display URLs are cached in server memory for up to 45 minutes to serve the screensaver without re-fetching on every frame. This cache is purged immediately on disconnect.
  • No secondary use:photos are displayed only on your family's own authorized devices. We perform no facial recognition, AI/ML training, content analysis, or sharing of your photos.
  • Disconnect:clicking Disconnect on the Connections page revokes your token at Google's servers (via oauth2.googleapis.com/revoke), deletes all stored credentials, and purges the photo cache immediately.

MemoryBank's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Penny — AI Support & Learning Assistant

Penny is MemoryBank's built-in chat assistant. She helps parents with account and billing questions and helps kids understand the basics of investing in age-appropriate language. Penny is read-only — she cannot move money, place trades, or change account settings — and she explicitly does not give investment recommendations.

  • AI processor:Penny is powered by Anthropic's Claude models. The text of your messages and any Penny replies are sent to Anthropic for processing as a service provider, governed by Anthropic's Commercial Terms and Privacy Policy. Anthropic does not train its public models on your data.
  • Surfaces: Penny is available in two places. On the parent dashboard at mymemorybank.app/dashboard, Penny answers questions from the authenticated account holder and is available on all plans, including the free tier. On the kids' dashboard at mymemorybank.app/kids, Penny is restricted to age-appropriate learning conversations and requires an active paid subscription before any kid-side chat is possible.
  • What we store:the text of each message, the surface it was sent from (parent or kid), the active kid's id when applicable, model usage metadata (tokens, latency, model name), and any thumbs-up/down feedback. We do not store payment, authentication, or brokerage data in conversation history.
  • Safety: every Penny reply is filtered before display. Internal vendor names, source-code terms, anything resembling full account numbers, and language that could be construed as investment advice are blocked, and the conversation is escalated to human review when needed.
  • Deletion: when you delete a kid profile or your entire MemoryBank account, all associated Penny conversations are deleted as part of the same cascade (see section 10).

8. Children's Privacy & COPPA

MemoryBank is designed for use by parents and legal guardians managing their children's investment accounts. We have built the product so that, in the ordinary course of use, we do not collect personal information directly from children. Specifically:

  • All identifying child-profile data (first name, optional birth year, brokerage account assignments, photos selected from the parent's Google Photos library) is entered by the parent account holder through their Clerk-authenticated parent dashboard. Children do not enter this information themselves.
  • On the kids' dashboard, children may only adjust constrained, non-personal inputs: a single emoji avatar, a hex accent color, the dollar amount of progress toward a goal their parent created, and validated stock-ticker symbols on a watchlist. These inputs are not personal information under 16 CFR 312.2.
  • Persistent identifiers we use on the kids' surface (device tokens, IP addresses in server logs) are used solely for internal operations — authentication, security, and debugging — as permitted by 16 CFR 312.5(c)(7). We do not use them for advertising, profiling, or any external purpose.
  • We do not allow communication between children outside a single family, public profiles, or any social features.

Verifiable parental consent for features that do collect data from a child.Penny conversations on the kids' surface (section 7) are the one feature where free-text input could originate from a child. We restrict this feature to families with an active paid subscription. The paid subscription is processed by Stripe and requires the parent to complete a credit-card transaction that generates a receipt to the cardholder's email and a recognisable charge on the cardholder's statement. This satisfies the verifiable parental consent standard under the credit-card method described in 16 CFR 312.5(b)(2)(ii). Cancelling the subscription disables further kid-surface Penny chat.

At account creation, before any child profile can be added, we additionally ask the account holder to affirm that they are the child's parent or legal guardian. We record the timestamp, IP address, and version of this Privacy Policy at the moment of that affirmation.

As the parent or guardian you may at any time review the information we hold about your child, request that we correct or delete it, or refuse to permit further collection or use of that information by contacting us at the address in section 13. Deleting a child profile removes that child's profile fields, personalization settings, Penny conversation history, and account assignments from our database.

9. Payments

Subscription billing is processed by Stripe. MemoryBank does not store credit card numbers or full payment details. Stripe's privacy policy governs the handling of your payment information.

10. Data Retention

Your data is retained as long as your account is active. You may delete your account and all associated data by contacting us. Upon deletion, all personal data, OAuth tokens, child profiles, and device tokens are permanently removed within 30 days. Brokerage and Google Photos tokens are immediately cleared when you disconnect the respective service from the Connections page.

11. Your Rights

You may request access to, correction of, deletion of, or a copy of your personal data at any time. To exercise any of these rights — including a request for a machine-readable export of your account data under GDPR Article 20 or the California Consumer Privacy Act — email us at the address in section 13. Requests are handled manually and we will respond within 30 days. California residents have additional rights under the CCPA; contacting us at the same address exercises those rights.

12. Changes to This Policy

We may update this policy as the service evolves. Material changes will be communicated via the email address on your account at least 14 days before taking effect. Continued use of MemoryBank after changes constitutes acceptance of the updated policy. The current version is always available at mymemorybank.app/privacy.

13. Contact

Questions about this privacy policy or your data? Reach ACK LABS LLC (d/b/a MyMemoryBank) at privacy@mymemorybank.app