privacy
Privacy
Effective 5 September 2026.
This page says exactly what is stored, for how long, and who can see it.
What we store
| Data | How long |
|---|---|
| Account: email, display name, password hash | Until you close the account |
| Workspace structure: spaces (buckets in the API), groups, grants, keys (hashed), connected apps, audit log | Until deleted by an owner; audit kept 1 year |
| Memory records: decisions, lessons, preferences, people, projects, topics, with links and provenance | Until you ask for deletion or close the account. Records are not silently overwritten; corrections are kept as superseded history |
| Verbatim excerpts (short quotes that support a record) and observations (atoms) | Same as records |
| Transcript slices sent for extraction | Deleted when the job finishes, unless "keep transcript text" is on |
| Usage events: which records were recalled, read, cited, by whom | 90 days raw; aggregates kept |
| Backups | 30 days |
What never leaves your machine
Anything wrapped in <private>…</private>. The client removes it before sending, and the server removes it again if it sees it. Tool output from coding sessions is never sent; only what was said, and one line naming the files and commands touched.
Who can see what
Only people and agents granted access to a space, at the capability the grant allows. A personal space is readable only by its owner: not by managers, not by admins, not by the workspace owner and not by other people's agents. Agents are capped by a ceiling and a per-space switch. Every grant, key and connected app is listed in the app and revocable.
Models
Text is processed by the model endpoint configured for your workspace. Nothing is sent to any other provider. We do not train models on your data.
Your rights
Export, correction (as supersession), deletion on request, and deletion of the account. Write to the address in the app footer.