Privacy Policy
Last updated: 11 October 2026
This policy explains what personal data Remimo ("we", "us") processes when you use remimo.me, app.remimo.me, l.remimo.me and our video cards (the "Service"), why we process it, and what rights you have. We are the data controller. You can reach us at privacy@remimo.me.
1. Data we process
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Videos you upload, plus an optional title, description and location | To store the video, convert it for streaming, and play it for people who have the card | Contract (Art. 6(1)(b)) |
| Protection settings: the method, a hashed PIN, password or answer, the question text, and an encrypted recovery code | To limit who can watch a protected video | Contract |
| Email addresses on a video's allow-list (encrypted), plus a one-way hash for matching | To send single-use unlock links (see our Email Policy) | Our legitimate interest, and the owner's, in giving chosen people access (Art. 6(1)(f)) |
Unlock tokens and an unlock cookie (remimo_unlocks) | To remember on your device that you unlocked a video | Strictly necessary for the Service |
| Technical logs: IP address, user agent, request times, errors | Security, preventing abuse, and fixing problems | Legitimate interest |
| Messages you send us | To answer you | Legitimate interest / contract |
We don't ask for your name, we don't require you to create an account, and we don't use advertising or cross-site tracking cookies. Your language and theme choices are kept only in your browser's local storage.
2. Email
The only email the Service sends is the one-time unlock link described in our Email Policy. We never use allow-listed addresses for marketing, and we never sell or share them. You can ask us to block your address from future emails at any time (see opt-out).
3. Processors and where data is stored
- Amazon Web Services EMEA SARL provides hosting, storage (S3, DynamoDB), video conversion (MediaConvert), content delivery (CloudFront), key management (KMS), and email delivery (SES). Our primary region is eu-central-1 (Frankfurt, Germany). Videos are delivered through CloudFront's global edge network.
- Google provides location suggestions (Google Maps Places) when an owner types a location for a video. Only the text typed into that field is sent to Google. Google Workspace also handles our support mailbox.
- Google Fonts serves the typefaces on this website.
When data is transferred outside the EEA, it's covered by the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
4. Security
- All traffic is encrypted with HTTPS. Video and upload URLs are signed and expire after a short time.
- PINs, passwords and secret answers are stored only as salted hashes. Allow-listed email addresses and recovery codes are encrypted with AWS KMS.
- Unlock links are random, single-use, and expire after 15 minutes.
5. How long we keep data
- Videos and their details are kept while the card is active, or until the owner or card issuer asks us to delete them.
- Unlock tokens are deleted automatically after they expire. The unlock cookie expires when access to the video expires.
- Technical logs are kept for up to 90 days.
- Addresses on our email suppression list are kept for as long as is needed to honour the opt-out.
6. Your rights
Under the GDPR, you can ask for access to your data, and you can ask us to correct it, delete it, restrict its use, or give it to you in a portable format. You can also object to processing based on legitimate interest. Write to privacy@remimo.me. We'll reply within 30 days. You also have the right to complain to your local data protection authority.
7. Children
The Service isn't aimed at children under 16. Owners mustn't upload videos of other people without permission they're legally entitled to give.
8. Changes
If we change this policy, we'll update the date at the top of this page. We'll make significant changes clearly visible on remimo.me.