Privacy Policy

Last updated: October 23, 2026

This Privacy Policy explains how MomentPack, operated by Niko Ng in Vietnam (“MomentPack,” “we,” “us,” or “our”), handles information when you use the MomentPack mobile app and this website, including the page where a Pack is opened.

MomentPack uses anonymous sign-in. We never ask for your email address, and you do not create a profile to collect moments, publish a Pack, or open one. A recipient does not need the app or an account. They open the link.

Information we process

Depending on how you use MomentPack, we may process:

an anonymous Firebase Authentication identifier for the person who publishes a Pack. That identifier is how the app reaches the Packs they have sent. A recipient opening a Pack on this website is also signed in anonymously, so the page can remember their reactions and reply for that Pack;
the Pack you choose to publish: up to ten photos, the Pack title, the sender name, an optional message, the cover, and each card’s title, note, date, place name, set name, and clues. The place on a card is text you chose to include. We reject a photo that still carries camera metadata such as EXIF, GPS, XMP, or IPTC. A face, a sign, or writing can still appear in the picture itself;
share links and what happens to them. Each published Pack gets a random link. We store only a hash of that link. We record when someone other than the sender first tears the Pack open, and the sender can see that time. A chat app loading the link preview, and the sender opening their own link, do not count as that open;
reactions and replies from people who open the Pack, when the sender has left responses on. A recipient can leave one reaction on a card and one reply for the Pack. The sender sees reaction counts and the reply. They do not receive the recipient’s name, account, or device. The identifier we store for a recipient is specific to that one Pack, so we do not use it to follow the same person across Packs. Clearing this site’s data, or opening the link in another browser, starts a new session. Counts are sessions, not a list of people;
a small amount of storage in the recipient’s browser. We keep the anonymous sign-in there, in IndexedDB or local storage, so a reload stays the same session and their reactions and reply come back. If the browser will not store it, the sign-in stays in memory for that visit only. We also store a flag that this browser has opened a Pack before, so a later visit can offer to skip the opening animation, and a flag for the sample Pack so its ceremony is not replayed as new;
a push registration from the app, if you allow notifications: a token for that installation, whether the device is iPhone or Android, and your choice to hear about a Pack being opened or receiving its first reply. The notification itself says only that your Pack was opened or that someone replied. It does not include the Pack title, the reply, a photo, or the share link.

The app keeps your collection on your device. Publishing a Pack sends us the photos and words you approved for that Pack. We do not receive your camera roll.

We do not ask for or collect your email address. This website has no sign-up form, no newsletter, and no waitlist.

Our servers also write short-lived technical logs when a Pack is requested, which we use to diagnose errors. We do not sell your information. This website does not use advertising or third-party analytics, and we do not send Pack photos, card text, replies, or share links to an analytics service.

How we use information

We use this information to store the Packs you publish, show them to the person you sent the link to, keep that person’s reactions and reply on a reload, tell you when a Pack is first opened and when it receives its first reply, prevent abuse, diagnose errors, and respond to support requests and reports.

Share links and who can open a Pack

A Pack is reachable through a share link containing a long random token. The link is hard to guess. Anyone who has it can open the Pack and see the cards, including the photos. Treat a share link the way you would treat the Pack itself, and only send it to the people it is meant for.

Share links do not expire on their own. When a Pack is turned off or deleted, its link stops opening it. Turning a link off does not retrieve a Pack someone has already opened, or a photo they have already saved. Photos live in a private bucket. The opening page is given a fresh address for each photo that lasts about a minute. During that minute, someone who already received the address can still load the photo.

A published Pack stays as it was sent. Changing it means publishing a new Pack. A recipient can replace their reply from the same browser session. There is no separate delete for a reply, and the sender may already have read it.

Link previews

When a share link is pasted into a chat or social app, that app may ask us for a preview. The preview can include the Pack title, the sender name, a short excerpt of the Pack message, the cover, and how many cards are inside. It does not include card photos, card notes, or the fact that someone opened the Pack. Fetching a preview does not sign the recipient in and does not record an open.

Those apps can keep a copy of a preview they already fetched. After a link is turned off, the next fetch from us is a generic MomentPack image, but we cannot erase a preview a chat app has already stored.

Service providers

We use Google Firebase for anonymous authentication, Cloud Firestore for Pack records, replies, and notification data, and Firebase Cloud Messaging to deliver push notifications. Pack photos are stored in a private Cloudflare R2 bucket. This website is hosted on Vercel. These providers process information under their own policies and may process information outside your country of residence.

Storage, retention, and your choices

Published Packs are stored so they can be opened from a share link and remain in the sender’s collection in the app. Photos uploaded for a Pack that is never published are removed after about a day. Notification records expire after 30 days. We remove a push token when the push service tells us it is no longer valid. We retain other information only for as long as needed to operate, secure, and improve the service, comply with legal obligations, or resolve disputes.

You can turn notifications off in the app or in your device settings. You can clear this website’s site data in your browser; that drops the anonymous session, and a later visit starts a new one. Contact us if you want a share link turned off or a Pack deleted and need our help, and include the link so we can find it.

Because MomentPack uses anonymous sign-in, the sender’s anonymous identifier is what ties them to their Packs. We may not be able to identify an account after you lose access to the device that created it, and we cannot look a Pack up from a name or an email address alone.

Security

We use reasonable technical and organizational measures designed to protect information. Pack content is served over an authenticated, non-cacheable connection, and photos are not given a permanent public address. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Children’s privacy

MomentPack is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, please contact us.

Changes to this policy

We may update this policy as the app or our data practices change. We will post the revised policy here and update the “Last updated” date.

Contact

For privacy questions or requests, email contact@auloristudio.com.