1. Scope and provider
This policy covers the Moment iOS app provided by InfEngine Labs (Suzhou Industrial Park Infinite Engine Software Development Studio), its Home Screen and Lock Screen widgets, and related user support.
2. Data we do not collect
Under Apple's definition of collection (transmitting data off the device so the developer or third parties can access it beyond servicing a request), Moment's App Store privacy label is “Data Not Collected.”
Moment has no account system, developer servers, ads, tracking, remote analytics or crash-reporting SDKs, and no cloud sync. The following is processed on your device, and Moment never sends it to InfEngine Labs or any third party automatically. Content you choose to share or export (section 5), Apple system services (sections 3, 4, and 7), and emails you send to support (section 10) are the exceptions:
- photo and video content;
- system photo identifiers, capture dates, favorite status, dimensions, and location embedded in photos;
- favorites, “see less” feedback, blocks, blocked date ranges, and display history;
- memory capsule text and revisit dates;
- feature usage counts and duration ranges aggregated by calendar day.
3. Photos, videos, and iCloud Photos
Moment reads photos only after you grant the system photo permission; both full and limited access are supported. Memories are selected, grouped, and ranked on your device. The original video is read only when you tap to play it; otherwise Moment uses system-provided previews.
If your photos are stored only in iCloud, iCloud Photos may download originals or previews according to Apple's system policies. That is an Apple system service and does not mean your photos are uploaded to Moment.
If you revoke or narrow photo access, Moment stops using photos it can no longer access and cleans up the related local index and widget snapshots. Blocking a photo or memory in Moment never deletes the original from the Photos app.
4. Data stored on your device
Moment keeps a minimal photo metadata index, your preferences and negative feedback, chosen memory covers, capsules, and local usage statistics in a local database inside its app sandbox, protected by iOS data protection.
Widgets read only the memory snapshot the main app writes to its App Group (titles, dates, and a few thumbnails); they never access the photo library or the database directly. Widget location is off by default. Only after you turn it on does the snapshot include whole-degree coordinate text at roughly 100 km precision, never precise coordinates. Widgets also count snapshot availability states per day, without photos, memory identifiers, or exact times.
On physical devices, Moment can receive Apple MetricKit health summaries, but keeps only counts of diagnostic categories such as crashes and hangs, plus fixed ranges of memory, CPU, and GPU use. It does not keep call stacks, raw system payloads, device identifiers, or precise measurements.
This data stays until you clear it in the app or delete the app. If iCloud Backup is on, iOS may back up app data according to your system settings; Apple controls that process and Moment does not upload anything itself.
5. Sharing, export, and feedback
Share cards are created only when you tap Share. Moment redraws a new JPEG and removes the original photo's EXIF and GPS metadata. Location is hidden by default, and even coarse location must be turned on by you. The card goes only to the iOS share sheet and the app you choose, whose own policies then apply.
In Memories & Privacy you can view and export local usage statistics or send a weekly feedback report. These contain only calendar days, predefined event types, fixed buckets, and counts, plus the survey answers you enter at that moment; apart from anything you type into the suggestion, they never include photos, capsule text, memory identifiers, location, or device identifiers. A written suggestion is collapsed to one line, truncated to 200 characters, and has text that looks like a photo identifier (UUID), a memory identifier, an internal moment:// link, a decimal coordinate, or a run of six or more digits replaced. Ordinary web addresses, email addresses, names, and place descriptions are not detected or removed, so please leave them out. You can review the full report under “Preview what will be sent” before sending. Reports leave the device only through the system share sheet to a channel you choose; Moment never uploads them automatically, and once sent they are handled by that channel and its recipient.
6. Capsule reminders and notifications
Capsule revisit reminders use iOS local notifications, delivered by the system on your device. Moment asks for notification permission only when you set a revisit date for a capsule, and notifications never contain the capsule text. Declining or turning off notifications does not affect saving or viewing capsules.
7. App Store purchases
The Moment Pro lifetime purchase and annual subscription, including purchases, restores, renewals, refunds, and Family Sharing, are handled by the Apple App Store. Moment reads Apple-signed transactions on your device and uses StoreKit's own verification to decide whether Pro is unlocked.
Moment has no server-side validation, receipt upload, subscription attribution, or third-party purchase SDK. Moment verifies Apple-signed transactions on your device and never uploads transaction records or Pro status to a developer server; during purchases, restores, and subscription status sync, StoreKit communicates directly with Apple. InfEngine Labs never receives your payment details or Apple Account password. Local usage statistics count only which paywall entry was shown, the product type chosen (lifetime or annual), and outcomes, never prices, currencies, or transaction identifiers.
8. Third-party components and Apple services
Moment uses the open-source GRDB library to read and write local SQLite; it contains no networking, advertising, or analytics. Moment also uses Apple frameworks including Photos, WidgetKit, User Notifications, StoreKit, MetricKit, and the system share sheet. Apple's handling of iCloud Photos, notifications, the App Store, and iCloud Backup is governed by Apple's privacy policy.
9. Tracking, advertising, and children
Moment does not track you, use the advertising identifier, combine data across apps or websites, sell data, or show ads.
Moment is not directed at children and never asks for a name, birthday, or contact details. Your photos may include children, but Moment never uploads those photos to us automatically. Minors who need to contact us should do so with the help of a parent or guardian as required by local law.
10. Support email
When you email support, we receive your email address, message, and anything you choose to attach. We use it only to reply, investigate the issue, and keep necessary support records, and retain it only as long as needed for those purposes and applicable legal obligations. Please do not send photos, capsule text, passwords, or full payment information.
11. Your choices
In Memories & Privacy you can separately clear the photo index, preferences and blocks, all capsules, and local usage statistics, or pause all memories. You can change photo and notification permissions at any time in iOS Settings. Deleting Moment removes all of its data from this device. Because Moment has no accounts or server copies, there is no account data for us to delete remotely. You may also contact us to access or delete personal information from support conversations, except records the law requires us to keep.
12. Security, changes, and contact
We reduce risk by not collecting data and by processing on device, but no device, backup, or electronic communication can be guaranteed absolutely secure.
If we ever add sync, accounts, remote analytics, or other data processing, we will update this policy, the in-app notice, and the App Store privacy label before the feature ships, and ask for your choice before any processing that needs consent or a system permission. Email privacy questions to support@infenginelabs.com.