Privacy Policy

• Account data: your email, display name, and a hashed password (bcrypt — we cannot read it).
• Vault content: the memories and work artifacts you approve or explicitly save. Memory text and artifact content are encrypted at rest with an application-layer key, on top of database-level encryption.
• Access receipts: a log of every time a connected AI read from or wrote to your vault — which client, which tool, which memory ids, and when. Receipts exist for YOU; they are shown on your Activity page.
• Technical logs: errors and request metadata for keeping the service running. Our code is written so memory content never appears in logs.

• No selling or renting of your data. Ever. To anyone.
• No advertising trackers or third-party analytics scripts.
• No training AI models on your vault — yours or anyone else's.
• No browsing of your memories by us: the operator console shows counts and metadata only, never memory content.

Nothing becomes a permanent memory without your approval. Extracted candidates land in a Review Inbox as pending; only your explicit action (in the app, by swipe, or by telling a connected AI) makes them active. Each memory carries a per-memory consent mode (allow / ask / blocked) that controls whether AIs may retrieve it.

When you connect an AI (Claude, ChatGPT, or any other MCP client — Gemini has no MCP connector and is reached by the browser extension instead), it can retrieve only memories that are active and set to "allow". Anything it retrieves is recorded as a receipt you can inspect. Most AI hosts now keep memory of their own, so what one retrieves from you it may also remember — that copy lives under that provider's terms and controls, which is why your vault stays the original: it is the copy you can correct, revoke, export, and carry to the next AI. What a third-party AI does with text it has retrieved is governed by that provider's own terms — connect only AIs you trust.

The extension captures text only when you click— there is no background collection and no keystroke logging. The capture button exists only on the supported AI chat sites and sends that conversation's visible text. The right-click save-selection item works on any site, and sends only the text you selected plus that page's address as the memory's label — nothing else on the page is read, and outside the supported AI sites the extension reads nothing at all unless you invoke it on a selection. Captured text goes to your vault and nowhere else, and lands as pending until you approve it.

Data is stored with our infrastructure providers (currently Supabase for the database and Render for the API, in the United States), over TLS in transit and encrypted at rest. Our honest, published threat model — including what our encryption does and does not protect against — is on the Trust page.

• Forget:deleting a memory removes it from retrieval immediately — from that moment no AI can read it from your vault, on any connector. We govern the origin and every read after it: a memory an AI already retrieved may persist in that AI's own memory, under its controls rather than ours. That is why anything you set to "ask" or "blocked" is never sent in the first place.
• Purge: residual encrypted records of deleted items are permanently purged within 30 days. Until then a deleted memory sits in Trash, where you can restore it or purge it immediately.
• Export: you can export your entire vault at any time, free, from Settings. The Forget button and export are never paywalled.
• Account deletion: delete your account yourself from the Profile page. It schedules erasure for 30 days out — the account stays fully usable during that grace window and one click cancels it. When the window closes, a single cascade erases everything: memories, artifacts, receipts, events, and every device and connected-AI session. Prefer email? Write to us and we do it for you.

Access, correction, export (portability), and erasure are built into the product rather than hidden behind a process. If you are in a jurisdiction with specific data-protection rights (GDPR, DPDP, CCPA and similar), we honor requests under them — write to the contact below.

AI Pen Drive is not intended for children under 16.

If this policy changes materially, we will note it here with a new date and, for significant changes, notify account holders by email.