MemoryOS Privacy Policy

Last updated: March 13, 2026

The short version: Your conversations are yours. We never sell your data. We never share between users. We never train AI models on your conversations. You can delete everything anytime.

1. Who We Are

MemoryOS is operated by Frank Kurka. Contact: contact Frank via MemoryOS or email fkxx@substack.com. Our infrastructure runs on Cloudflare (Workers, D1 database, R2 storage) in their global network.

2. Where Your Data Lives

MemoryOS has three distinct storage modes. You control which mode applies based on how you use the Service.

Mode	Where Stored	Who Can See It	Touches AI Servers?
🔒 Local Only (BYOK, skip auth)	Your browser only (localStorage)	Only you, on your device	Yes — sent to the AI provider YOU chose, using YOUR key
☁️ Our Cloud (Signed in)	Cloudflare R2 (encrypted at rest)	Only you, via your verified email	Yes — sent to the AI provider, using your key or ours
📤 Export Matrix (Your choice)	Wherever you send it	Depends on destination	N/A — you control this

3. What We Collect

Information you provide:

Email address — used for authentication and account identification
Conversations — stored in our cloud when you are signed in (not stored if you use Local Only mode)
Payment information — processed by Stripe; we never see or store your card number

Information we generate:

Usage metrics — prompt counts, token estimates, cost estimates (per user, per day)
Session tokens — for authentication (30-day expiry, stored in our D1 database)

Information we do NOT collect:

Your API keys (BYOK mode — keys stay in your browser)
Tracking cookies or advertising identifiers
Browsing history outside of MemoryOS
Device fingerprints

4. How We Use Your Data

Provide the Service — route your messages to AI providers, save conversations, enable search and export
Authenticate you — verify your email via OTP code, maintain your session
Monitor usage — enforce rate limits, track costs, prevent abuse
Improve the Service — aggregate (non-personal) usage statistics to guide development

5. What We Never Do

🚫 We never sell your data to anyone, for any reason.

🚫 We never share your conversations with other users.

🚫 We never train AI models on your conversations.

🚫 We never read your conversations for marketing purposes.

🚫 We never display advertising in MemoryOS.

6. Third-Party AI Providers

When you send a message, it is forwarded to the AI provider you selected (Anthropic, OpenAI, Google, OpenRouter, Together AI). Each provider has its own privacy policy governing how they handle your messages:

We do not add metadata, tracking, or additional content to your messages before forwarding them. In BYOK mode, your API key is sent directly to the provider — we never see it.

7. Payment Processing

Payments are processed by Stripe. We receive confirmation of successful payments (email, amount, plan) but never see or store your credit card number, bank account, or other financial details. Stripe's privacy policy governs their handling of your payment information.

8. Email Communications

We send verification codes via Resend for account authentication. We do not send marketing emails. We do not share your email address with third parties. You may receive operational emails related to your account (e.g., payment receipts from Stripe).

9. Data Retention and Deletion

Conversations: Retained until you delete them, or 30 days after account termination
Account data: Retained while your account is active
Usage logs: Retained for 90 days for operational purposes, then aggregated
Session tokens: Expire after 30 days automatically

To delete your data, use the delete function in the app for individual conversations. To request complete account deletion, email contact Frank via MemoryOS or email fkxx@substack.com.

10. Security

All data in transit is encrypted via HTTPS/TLS
Data at rest in Cloudflare R2 is encrypted by default
Email authentication uses time-limited OTP codes (10-minute expiry, 5 attempt limit)
Session tokens are cryptographically random UUIDs with 30-day expiry
API keys in BYOK mode never leave your browser
Admin access is PIN-protected and separate from user authentication

11. Children's Privacy

MemoryOS is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will delete it promptly.

12. International Users

MemoryOS infrastructure is hosted on Cloudflare's global network. By using the Service, you consent to your data being processed in the regions where Cloudflare operates. We aim to comply with applicable data protection laws including GDPR for EU users. EU users have the right to access, rectify, and delete their personal data — contact us to exercise these rights.

13. Changes to This Policy

We may update this policy as our practices evolve. Material changes will be communicated via the email associated with your account. The "Last updated" date at the top reflects when this policy was last modified.

14. Contact

Questions or concerns about your privacy? Contact Frank Kurka at contact Frank via MemoryOS or email fkxx@substack.com.