Privacy

The content you send: text you write, files you upload, messages you forward from a connected account, and anything a connector reads on your behalf. Alongside it we store what the system derived from that content, which is the memories themselves, the entities and relationships extracted from them, and the vectors used to search them.

Your account details: email address, username, display name, and a hash of your password. The password itself is never stored and cannot be recovered from the hash, which is why a reset issues a new one rather than telling you the old.

Every request to the API is counted, and a sample of individual requests is kept for a short window. A kept record includes the time, the path, the response status, how long it took, your address, an approximate location derived from it, your network operator, and your browser or client’s user agent. Requests that failed are kept in full; successful ones are sampled.

This exists so that when something breaks there is enough to find out why. It is not used to build a profile of you, and it is not sold or shared.

You. Every read of your memories is scoped to your account, and access rules attached to content when it was captured are carried through rather than widened.

Applications you have explicitly connected, limited to the permissions you approved on the consent screen. You can see what is connected and revoke any of it from your dashboard, and revoking takes effect immediately.

Our operators, for the narrow purpose of keeping the service running: schema and delivery diagnostics, and support you have asked for. There is no browsing of customer memories.

Language and embedding models process your content in order to extract memories, transcribe audio, read images and answer searches. Which providers are used depends on the request; they receive the content necessary for that task and are not permitted to train on it.

Our email provider sees the address and content of mail we send you. Our hosting and database providers hold the stored data. Nothing is sold to anyone, and there is no advertising on this service.

Memories are kept until you delete them or close your account. Individual request records are pruned after a short window; the aggregate counts behind them are small and are kept longer, because they carry no identifying content.

Deleting your account removes your memories, your uploaded files, your sessions, your API keys and your connections. It is not reversible.

Everything stored about you is readable through the API under your own credentials, so an export is something you can perform yourself at any time without asking.

To delete a single memory, delete it. To delete everything, close your account from the dashboard. If either is not working, write to privacy@persistmemory.com and we will do it.

Passwords are hashed with scrypt. Session tokens rotate on every use, and a token presented twice ends the whole session family, because a replayed token is the signature of a stolen one. API keys and other bearer values are stored hashed, so a leaked backup does not contain anything that can be presented as a credential.

If this policy changes in a way that affects what is collected or who can read it, the date above changes and you are told by email before it takes effect. Questions go to privacy@persistmemory.com.

See also the terms of service.