MemorySafe Hosted
Privacy policy
MemorySafe Hosted · Last updated: 3 November 2026
1. Who we are and what this covers
This policy covers MemorySafe Hosted, the online edition at memory.memorysafe.ca that keeps one memory for the AI assistants you connect to it. It is run by MemorySafe Labs Inc., 719 Rue Dollard, Longueuil, QC J4K 4M3, Canada.
It does not cover the free local MemorySafe plugin, which keeps your memory in a file on your own computer and sends nothing to us. It also does not cover our website's forms, which have their own privacy notice.
Person in charge of the protection of personal information: Carla Paetzold Centeno, CEO. Contact: contact@memorysafe.ca.
2. What we collect
We hold four kinds of information, and only what the service needs to work.
| What | Examples | Where it comes from |
|---|---|---|
| Account | Your email address, a sign-in ID for each way you sign in (email, GitHub) and the verified address it gave us, the date you joined | You, when you sign up; GitHub, if you sign in with GitHub |
| Memories | The facts your assistants save: text, project, protection, history of changes | Your assistants, when you or they save something; files you import |
| Connected apps | Which apps you connected (for example Claude, ChatGPT), when each last used your memory, sign-in tokens | The apps, when you connect them |
| Technical logs | Time, page or tool name, result, duration, and a scrambled (hashed) account number | Our servers, automatically |
What we do not collect. Our logs never contain your memories, your searches, your email address or your password. We do not use advertising cookies, analytics or tracking pixels. We do not read your chats: we only see what an assistant sends to your memory.
Your password is held by Amazon Cognito, our sign-in provider. We never see it.
If you sign in with GitHub, we keep only your GitHub account's numeric ID and its primary email address, if it is verified. GitHub also sends us other profile details (such as your username, name and photo) and the list of your addresses: we discard them without keeping them. We use the token GitHub gives us for that one read, then drop it without keeping it. We never see your GitHub password, and we ask for no access to your repositories. One verified address opens one MemorySafe account: sign in with GitHub, then by email with the same address, and you reach the same account and the same memories.
If you use organizations, we also hold the organizations you create or join, your role, who invited you and when you joined, and the email addresses you invite.
3. How we use it
We use your information only to run MemorySafe Hosted for you: to store your memories, give them back to the apps you connected, show them to you in your account, and keep the service secure and working.
What we never do:
- We do not sell or rent your information.
- We do not use your memories to train AI models, ours or anyone else's.
- We do not show ads or build advertising profiles.
- We do not look at your memories, except when you ask us to for support or when the law requires it.
We may email you about your account (sign-in codes, deletion receipts, important changes). Product news is opt-in only.
4. Where it is stored, and who helps us
Your account and memories are stored in Canada, in Amazon Web Services' Montréal region (ca-central-1). The database is encrypted at rest.
| Service provider | What it does for us | Where |
|---|---|---|
| Amazon Web Services | Servers, database, backups, logs | Montréal, Canada |
| Amazon Cognito (AWS) | Sign-up, sign-in and verification emails | Montréal, Canada |
| GitHub (Microsoft) | Sign-in with GitHub, if you choose it | United States |
GitHub handles your sign-in in the United States. It receives no memories: only the fact that you are signing in to MemorySafe. If you would rather nothing leave Canada, sign in by email.
Each provider may only use your information to provide its service to us. We will update this list before adding any new provider.
To send organization invitations we also use Amazon Simple Email Service (AWS, Montréal). An invitation names the organization and who invited you, and holds no memories.
5. The AI apps you connect
You decide which apps can use your memory. Each one asks you to sign in and to allow it, and the allow page names the app. You can see every connected app and disconnect any of them in Your agents, at any time.
A connected app can search, save and forget your memories. When it reads a memory, that text goes to the app's company (for example Anthropic for Claude, OpenAI for ChatGPT), often outside Canada. From then on, the app's own privacy policy applies, not ours. We do not control what those companies keep or how long.
We only send your memories to apps you connected yourself. We never send them anywhere else.
6. Organizations
You can create an organization and invite people by email, or join one you are invited to. An organization has a shared memory and team projects; your personal memory stays yours.
- Members see what is shared. What you or your assistant saves to an organization's shared memory or team projects can be read by its members and by the apps they connect.
- Owners and admins decide what the shared memory holds, manage members, and see a log of who joined, left or changed role. The log holds no memories.
- If you leave or are removed, what you contributed stays with the organization, still marked as yours, and you can still erase it.
- Inviting someone stores their email address and sends them one email. The invitation expires after 7 days. Please invite only people who expect it.
7. Sensitive information
Automatic saving is off until you turn it on. When it is on, MemorySafe refuses to save on its own any text that looks like a key, token or card number; that mentions passwords, medication, allergies, diagnoses, therapy, date of birth or similar; that contains a government ID number, an email address, a phone number, a street address or a postal code; that is a safety rule; or that is over 500 characters.
It can miss things. Automatic saving does not recognise facts about other people, or health details and secrets worded in ways it does not detect. Please tell your assistant not to save those. You can see and forget everything saved in your account at any time.
Not for health records. MemorySafe Hosted is not built for patient records, client files or other regulated health information. Please do not store them here. Our work with medical organisations is offered separately, under its own agreements.
8. How long we keep it, and how to remove it
We keep your memories until you remove them or delete your account. MemorySafe never deletes a memory on its own for being old.
| You choose | What happens | Can it be undone? |
|---|---|---|
| Forget a memory | Assistants stop seeing it. It stays in your Forgotten list. | Yes, restore it any time |
| Erase a memory | Its text, its history and your searches that quoted it are deleted. You get a receipt with no text in it. | No |
| Delete your account | All your memories, settings and app connections are deleted, and so is each way you sign in, with your email sign-in account. Your GitHub account is not touched. You get a receipt. | No |
Backups. Erased data can remain in our encrypted database backups for up to 30 days, then it is gone for good. We keep a deletion receipt, and a record that your sign-in was deleted so it cannot be reused to reopen your account: for good for an email sign-in, two hours for GitHub, after which signing in with it opens a new, empty account. Neither contains your memories.
Logs are kept for 30 days.
Organizations. If you are the only owner of an organization that has other members, hand it over or delete it before deleting your account. An organization its owner deletes can be restored for 30 days; then everything in it is deleted.
9. Your rights
You can do most of this yourself, in your account, without asking us:
- See your memories and connected apps.
- Download two files: your memories, ready to import into MemorySafe again, and everything we hold about you.
- Correct or forget a memory, and restore it.
- Erase a memory or delete your account.
- Disconnect any app.
Under Québec's Law 25, Canada's PIPEDA and, where they apply, other laws such as the GDPR, you can also ask us for access, correction, deletion or a copy of your information, or withdraw your consent. Email contact@memorysafe.ca. We answer within 30 days.
If you are not satisfied, you can complain to the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.
10. Security, cookies, children and changes
Security. Connections are encrypted (HTTPS). The database is encrypted at rest and reachable only by our servers. Each account's memories are kept apart by the database itself, so one person's queries cannot reach another's. Apps get short-lived access (one hour) that you can cut off at any time.
If something goes wrong. If a security incident puts your information at risk of serious harm, we will tell you and the Commission d'accès à l'information promptly, as Law 25 requires, and keep a record of it.
Cookies. We use only the cookies needed to sign you in and keep you signed in (about 30 minutes for your account pages). No advertising or analytics cookies.
Children. MemorySafe Hosted is not for children. You must be at least 16 to create an account.
Changes. If we change this policy in a way that matters, we will tell you by email or in your account before the change applies. The date at the top shows the latest version.
Questions: contact@memorysafe.ca · MemorySafe Labs Inc., 719 Rue Dollard, Longueuil, QC J4K 4M3, Canada.