Data & Security

This page explains, in plain language, what Mnemoria stores, how it's protected, and what happens to your data when it passes through the AI systems that power the product. If you want the more formal version of this, see our Privacy Policy. This page exists because Mnemoria is a product built on memory, and we think you deserve a clear, honest account of what that actually means technically, not just a legal disclaimer.

What Mnemoria stores

When you talk to Mnemoria, three kinds of data are created and stored:

• Your messages. Every message you send and every reply Mnemoria gives is stored permanently, in full, as the raw record of your conversation. This is intentional. Mnemoria's entire purpose depends on genuine continuity, not summarized or partial history.
• Extracted memories. After each message, Mnemoria identifies specific things worth remembering: beliefs you've stated, people you've mentioned, decisions, emotions, patterns, and stores these as discrete, searchable entries. This is what allows Mnemoria to recall something relevant from weeks ago even if you don't bring it up directly.
• Your account information. Your email, authentication details, and any profile information you choose to provide (name, age, profile photo).

We do not store more than this. We do not track your activity outside the app, we do not sell data to third parties, and we do not use your data to serve you ads. Mnemoria has no advertising business model.

Where your data lives

Your messages, memories, and account data are stored in a managed PostgreSQL database (via Supabase), hosted in the EU (Ireland). Access to this database is protected by row-level security policies that mathematically restrict every query to only the data belonging to the authenticated user making the request. One user's data is never reachable by another user's session, enforced at the database level, not just in application code.

Authentication is handled by Supabase Auth, using industry-standard practices: passwords are hashed (never stored in plain text), and sessions are managed via short-lived, cryptographically signed tokens (JWTs) that are independently verified on every single request to our backend.

How the AI itself works, and what Anthropic sees

Mnemoria is built on Claude, an AI model made by Anthropic, accessed through Anthropic's commercial API.

This distinction matters, and we want to be specific about it rather than vague: Anthropic's commercial API operates under different, stricter terms than their consumer-facing Claude.ai product. Under Anthropic's current commercial terms (verified as of [DATE]):

• Anthropic does not use API data to train its models, by default and without exception, unless we explicitly opted in to a different arrangement (we have not).
• API inputs and outputs are automatically deleted from Anthropic's backend systems within 7 days of being sent, as a matter of their standard retention policy.
• Anthropic does not review, use, or retain this data for any purpose beyond providing the API response itself, except in cases of suspected policy violations, where limited data may be retained longer for safety review.

In practice, this means: when you send a message, it is sent securely (via encrypted connection) to Anthropic's API to generate a response and to extract memories, and Anthropic's copy of that exchange is gone within a week. Your permanent, long-term record lives only in Mnemoria's own database, not with Anthropic.

We also use Voyage AI (an embeddings provider recommended by Anthropic) to convert your memories into a mathematical representation that allows semantic search. This is what lets Mnemoria find something relevant to what you're saying now, even if you've never used those exact words before. This data is used only to generate the embedding and is not retained by Voyage beyond that processing.

Encryption and access

All data in transit, between your device, our servers, and any third-party service we use, is encrypted via HTTPS/TLS. Your session with Mnemoria is authenticated on every request; no one, including us, can access your conversation or memories without your active, authenticated session, except as described in the section below.

Who at Mnemoria can see your data

As a small, early-stage team, we have technical access to the underlying database as part of operating the service, the same way any software provider's engineers can technically access production systems. We do not read individual users' conversations or memories as a matter of practice. Access is limited to what's necessary for debugging, security response, or maintaining the service, and we're building toward more formal access controls and audit logging as Mnemoria grows.

Deleting your data

You can permanently delete your account and all associated data (every message, every memory, every generated portrait) at any time from your Account settings. This is a real, complete deletion: your data is removed from our database, and your authentication record is deleted from our identity provider. This action cannot be undone.

A note on what this product actually does with your data

Mnemoria is built to notice patterns in what you tell it, including emotional patterns, recurring beliefs, and contradictions over time. We take this seriously as a design responsibility, not just a data question. Mnemoria is designed to adapt how it communicates with you, but never what it's honest about: it does not change its core values or judgment based on what might be easiest or most agreeable to hear. If you want to understand the reasoning behind this design choice in more depth, see How It Works.

Mnemoria is not a licensed therapist, a medical device, or a crisis service, and it does not diagnose any condition. If you are in crisis or need professional support, please contact a qualified professional or a crisis service in your region.

Questions

If you have questions about how your data is handled, or want to request deletion outside the app, contact us at mnemoriaproject@gmail.com.