Ship on Friday

Memopolis Privacy Policy

Effective date: 6 November 2026

In short: Memopolis builds your city on your phone. Your photos and videos never leave it. To let you connect with friends ("neighbours"), the app gives you a random name and keeps a small amount of numbers on my server, such as how many photos you took each day. No photos, no file names, no places, no email, no password. The app has no ads or trackers; it sends anonymous daily usage counts, with no ID, that you can switch off.

1. Who this policy applies to

This policy covers the Memopolis app for Android and iPhone/iPad (package and bundle ID com.shiponfriday.memopolis), made by Onkar Sarvade (“I”, “me”) under the name Ship on Friday. It explains what the app reads on your phone, what it keeps on your phone, and what it sends to my server for the neighbours feature.

2. What the app reads on your phone, and why

Memopolis asks for your phone’s permission to read your photos and videos (on Android READ_MEDIA_IMAGES and READ_MEDIA_VIDEO; on iPhone and iPad, Photos access; or only the photos you select if you allow limited access). With it, the app reads, on your phone:

  • When each photo or video was taken (or, if that’s missing, its file date), to place it on a day in your city.
  • Its type and where it is saved (for example a screenshot, or a WhatsApp or Telegram folder), to colour each day and to find screenshots and forwards for Demolish.
  • Its file size (Android only), to show how much space screenshots, forwards and videos use.
  • Small copies of a few photos from your biggest days, made on your phone, for the drone tour and, only if you switch it on, your city video.

Your photos and videos never leave your phone, and neither do their file names, places or sizes.

3. What the app stores on your phone

  • Your settings (sound, the city style or landscape you picked) and whether you own Pro.
  • Your neighbour account: your random name and a secret key that proves the account is yours.
  • Your neighbours’ cities (their random names and daily photo counts), so they appear around your city even when you’re offline.
  • If you add the home-screen widget (Android): a picture of your skyline and a line of text, so the widget can show them.
  • Videos and posters you export are kept in the app until you share them or save them to your gallery or Photos. On iPhone and iPad, saving asks for permission to add to Photos; the app only adds the file you chose.

4. Neighbours: what goes to my server

To connect cities, the app uses a small server I run on Amazon Web Services (United States), at shiponfriday.com/memopolis/api. Everything is sent over an encrypted connection (HTTPS).

When you finish setting up the app, it creates a neighbour account with:

  • a random name (like neon-harbor-42) that you can change with the dice button. You never type a real name, and there is no email or password;
  • an account ID and a scrambled copy of your secret key (the key itself stays on your phone).

Only once you have a neighbour or a neighbour request, the app also sends:

  • your city as numbers: for each day, how many photos and videos you took and what kind of day it was (for example mostly screenshots or mostly videos). No photos, file names or places;
  • a few totals worked out from those numbers (your biggest day, your total, photos in the last 30 days, the year you started);
  • the city style or landscape you picked, so neighbours see your city the way you made it.

The server also keeps who your neighbours are and pending requests, and, if you buy Pro, whether you own Pro: on Android the app sends your Google Play purchase token and the server asks Google Play to confirm it; on iPhone and iPad the app sends the purchase record signed by Apple, and the server checks Apple’s signature (and later asks Apple whether it was refunded). That is how unlimited neighbours are unlocked.

Who can see it: anyone who knows your random name can send you a neighbour request. Only people you are connected with (one of you asked, the other accepted) can see your city, your totals and your landscape. Nobody else can.

Visits, likes and gifts. When you visit a neighbour’s city, like it, or leave a gift (a tree, lantern, fountain or statue), the server records who it came from, what it was and when, so the neighbour sees it in their inbox. Only you and that neighbour can see these. Removing a neighbour deletes the visits, likes and gifts between you; deleting your account deletes the ones you left.

Anonymous usage counts. To know whether people come back to the app, it sends a few events at most once a day (for example “the app was opened today”, or “first opened this week”). They carry no account ID, no device details and nothing from your gallery: the server only adds 1 to a counter for that day. You can switch this off in the app’s menu, and nothing is sent while it is off.

I don’t use this information for anything else, and I don’t keep logs of IP addresses or devices.

5. Deleting your data

In the app, open Neighbours → Delete my neighbour account. This removes your name, your numbers, your Pro record and all your neighbour connections from the server straight away, and removes you from your neighbours’ worlds. Your city on your phone stays. The server keeps automatic backups for up to 35 days, after which deleted data is gone from them too.

If you can’t use the app (for example you uninstalled it), message me (section 11) with your neighbour name and I’ll delete it.

6. Sharing outside the app, only when you choose

  • Videos and posters you share go wherever you send them, using your phone’s share menu.
  • City links (“Visit my city” and City of Us invites) contain only how many photos you took on each day and what kind of day it was. This information is placed after the “#” in the link, which browsers do not send to shiponfriday.com. Anyone you send a link to can see your city’s shape and dates.
  • When someone opens a city link, the page at shiponfriday.com/city counts the visit with Umami, a cookieless, privacy-friendly analytics service (page address, referrer, country and device type, without the part of the link after “#”). The Memopolis app itself only sends the anonymous usage counts described in section 4.

7. Demolish

When you use Demolish, Memopolis asks your phone to remove the items you picked: Android moves them to your phone’s bin, and iPhone and iPad move them to Recently Deleted in Photos, where they stay for 30 days. Your phone shows its own confirmation, and nothing is moved unless you confirm.

8. Purchases

Pro is a one-time in-app purchase handled by Google Play on Android, under Google’s own privacy policy, and by the App Store on iPhone and iPad, under Apple’s privacy policy. I receive only what the store shares with developers about an order. The server stores a reference to your purchase (a Google Play purchase token, or Apple’s original transaction ID) and whether the store confirmed it (section 4).

9. Sharing and selling

I don’t sell any data, and I don’t share it with anyone. The numbers in section 4 are shown only to your neighbours. Amazon Web Services hosts the server for me and processes the data only to run it.

10. Children

Memopolis is not directed at children under 13, and I don’t knowingly collect information from them.

11. Changes and contact

If this policy changes, I’ll update it here and change the effective date above.

Questions about privacy, or a deletion request: message me on Instagram, @shiponfriday.