Privacy & security

• Account: your email address and your password. The password is stored only as a one-way hash by our authentication provider; nobody, including us, can read it.
• Profile (optional): a username and a profile picture, if you choose to add them. The picture is cropped and resized on your device before upload, and the original file is never sent.
• Your content: matchups, stage preferences, notes and quick notes, with the dates they were created and last edited.
• Technical logs: like any website, our hosting providers keep short-lived server logs (such as IP addresses and request times) to run and protect the service.

We only use the cookies needed to keep you signed in. There are no advertising or analytics cookies, so there is no cookie banner. The app also keeps a copy of recently opened pages on your device so it works offline; signing out or deleting your account clears it.

• Other users: only notes you share. Access rules are enforced by the database itself, which only returns rows that belong to the signed-in account.
• Shared notes: when you tap “Share” on a note, anyone who has its link, signed in or not, can read that note (stages, quick notes and notes). They can also save a bookmark to it or duplicate it into their own account; a duplicate is their own copy and is not affected if you later edit, stop sharing or delete yours. A shared note shows your username and profile picture as its author (or “Anonymous player” if you haven't set them); your email address is never shown. Shared notes are never listed publicly or shown to search engines, and profiles can't be browsed. Profile pictures are stored as public files: anyone who has a picture's exact address can view it. Tap “Stop sharing” at any time to make the link stop working.
• Mael 'azuure' DE ALMEIDA-LAGIERE: as the person running the service, the maintainer has technical access to the database. It is only used when needed to keep the service running, answer a request from you, or comply with the law.
• Service providers: Supabase (database and sign-in) and Vercel (website hosting) process data on our behalf and under their own security and privacy commitments.

Your account and notes are stored in a database hosted in the European Union.

• All traffic is encrypted with HTTPS.
• Passwords are hashed and never visible to the app or its maintainer.
• Per-account access rules are enforced inside the database, not just in the interface.
• No administrator key is ever sent to your browser.

Smash Memo is a small independent project and has not been professionally audited. Please don't use it to store sensitive personal information.

Your data is kept until you delete it. Deleting a matchup removes it immediately. Deleting your account (from the Account page) immediately and permanently removes your account and all of your notes. Copies in our providers' short-term system logs expire on their own.

Depending on where you live (including under the EU GDPR), you can ask to access, correct, export or erase your data, or object to how it is processed. You can erase everything yourself from the Account page. For anything else, contact dealmeida.mael.64@gmail.com.

If you are in the EU, you also have the right to lodge a complaint with your data protection authority.

Smash Memo is an independent fan-made tool. It is not affiliated with, endorsed or sponsored by Nintendo, HAL Laboratory, Sora Ltd. or Aether Studios. Super Smash Bros. Ultimate, Super Smash Bros. Melee and Rivals of Aether II, and their logos, are trademarks of their respective owners and are only used to identify which game a note is about.

If this page changes in a meaningful way, the date at the top will be updated.