What we store, who sees it, and how to make us forget it.

The service is operated by thin-memory. For anything on this page — questions, requests, complaints — write to thinmemory@proton.me.

This policy covers the marketing site, the REST API and the MCP endpoint. It does not cover Dodo Payments' checkout, which is a separate service with its own privacy policy.

Because the product stores text on your behalf, we wear two hats:

• Controller for account, billing, usage and website data. We decide why and how that is processed.
• Processor for the documents, memories, metadata and derived facts you submit ("Customer Content"). You decide what goes in and why; we process it on your instructions. If you run an agent for other people, their data is your responsibility. We will sign a data processing agreement (DPA) on request.

We do not collect card numbers, passwords, advertising identifiers, or analytics profiles. There are no analytics or advertising scripts on this site, and the claim page never stores your key in a cookie or local storage.

Cloudflare may process standard request metadata — IP address, user agent, country — as part of delivering any website. Our Worker logs record request outcomes, identifiers and error messages; they are not designed to capture request bodies.

When you sign in, Cloudflare Access processes the email address you enter to send a one-time PIN. We do not store that Access email in our application database. The signed-in claim relay forwards it to the API only for the duration of a claim, so a paid upgrade can link an existing free container when the checkout email differs; it is not retained after the request.

We do not sell personal data, share it for cross-context behavioural advertising, or use Customer Content to train models. We do not send marketing email. We do not make automated decisions that produce legal or similarly significant effects: fact extraction is a text transformation whose output is returned to you, not used to decide anything about you.

Two kinds of model call happen when you use the hosted service. You do not supply keys for either.

• Embeddings. Cloudflare Workers AI (@cf/baai/bge-m3) turns text into vectors. The vectors are stored in Cloudflare Vectorize with a container tag and a kind.
• Fact extraction. On /v1/add, up to 24,000 characters of the document are sent to Groq's OpenAI-compatible API using openai/gpt-oss-20b, with openai/gpt-oss-120b as a fallback. The model returns at most 12 short facts. Groq processes that text on our behalf under its API terms.

We do not permit providers to train on your content, and we do not use it to train anything ourselves. Providers and model names can change as the service evolves; when they do, we update this page.

Extraction is a feature of /v1/add only. POST /v1/memories stores text exactly as sent, with no LLM pass — use it when content must not leave Cloudflare's compute for inference.

Model output is probabilistic. Extracted facts can be incomplete, outdated or simply wrong. Treat them as candidates and verify before relying on them. See section 6 of the terms.

We use a small set of processors. Each is bound to use the data only to provide its service to us.

Beyond those processors, we share data only:

• when the law requires it — a valid legal request, court order or regulatory demand, or where necessary to protect someone's safety or our rights. We will tell you unless we are prohibited from doing so.
• in a business transfer — if the service is merged into or acquired by another entity, data may transfer as part of it. We will post notice before your data becomes subject to a different policy.
• with professional advisers — lawyers and accountants under confidentiality obligations.

We do not sell personal data and do not share it with data brokers, advertisers or ad networks. There is no financial incentive offered for personal data.

Cloudflare runs a global edge network and stores data in the region configured for the database and vector index. Groq is United States-based and processes data there; Dodo Payments' processing locations are described in its own privacy policy.

Where personal data leaves the EEA, the UK or Switzerland, we rely on the safeguards our processors make available — adequacy decisions or Standard Contractual Clauses, including the UK Addendum where relevant. Write to thinmemory@proton.me if you need details for a transfer assessment.

Deleting an item removes its database row and its vector at once. Copies inside point-in-time recovery expire on their own and cannot be queried through the API.

The service relies on a small number of concrete controls:

• TLS for every request; encryption at rest is provided by Cloudflare.
• Service keys are stored as SHA-256 hashes and shown exactly once. The master key is a Worker secret and is never written to the database.
• Every service key is pinned to one container, and containment is enforced during recall, not just in the UI.
• Only the operator holds production credentials; the claim endpoint is rate-limited per IP.

Content is not end-to-end encrypted. It is encrypted in transit and at rest, but the service has to read it to chunk, embed and extract facts, so someone with production access can technically read it. Do not store passwords, private keys, seed phrases or other secrets in a memory.

If you find a vulnerability, email thinmemory@proton.me with enough detail to reproduce it. Please give us a chance to fix it before publishing.

EEA, UK and Switzerland

You have the right to:

• access the personal data we hold about you, and receive a copy;
• correct data that is wrong or incomplete;
• erase data, subject to legal retention obligations;
• restrict or object to processing based on legitimate interests;
• receive your data in a portable, machine-readable format;
• lodge a complaint with your local supervisory authority.

California and other US states

Subject to the thresholds and exceptions in your state's law, you may request to know, access, correct or delete personal information, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information beyond providing the service. We will not discriminate against you for exercising a right.

elsewhere

If your local law gives you other rights — for example under India's Digital Personal Data Protection Act, Brazil's LGPD, Canada's PIPEDA or Australia's Privacy Act — we will honour them on the same terms. Tell us which right you are exercising when you write.

how to exercise them

Email thinmemory@proton.me. Include the email address on the account, or the container tag and key id if you have them. We may ask you to make an authenticated API call or otherwise confirm control of the account — this is how we avoid handing someone else's memories to a stranger. We answer within one month and will tell you if the law allows an extension of up to two more months.

You may use an authorised agent where the law allows it; we may still require proof that the agent can act for you.

If you are an end user of an application built on thin-memory, the developer of that application is the controller. Contact them first; we will assist them with your request.

You do not need to open a ticket to delete your own data:

• DELETE /v1/documents/{id} removes a document, its chunks and their vectors.
• DELETE /v1/memories/{id} removes one extracted or standalone memory and its vector.
• GET /v1/items and GET /v1/profile export what is stored.

Facts outlive their source document. Extracted facts are separate rows. Deleting a document does not delete the facts extracted from it; delete those by id, or ask for a full wipe.

For a full container wipe, email thinmemory@proton.me with the container tag and key id. We delete documents, chunks, memories, facts, vectors, keys, usage counters and the plan row within 30 days, except records we must keep for tax or billing disputes and copies inside point-in-time recovery that expire on their own.

cookies and tracking

This site sets no analytics or advertising cookies. Fonts are self-hosted, not loaded from a third party. After you sign in, Cloudflare Access sets strictly necessary cookies (for example, CF_AppSession and CF_Authorization) to keep you signed in; the session lasts 24 hours. There is nothing to opt out of, and we treat Global Privacy Control signals as a confirmation that no sale or sharing applies.

children

The service is for adults. It is not directed to anyone under 18, and we do not knowingly collect their data. If you believe a minor has sent content to the service, email us and we will delete it.

changes

We publish a new version and effective date when this policy changes. For material changes we will also post a notice on the site — and email the address on the account where we can — at least 14 days before the change takes effect.

contact

thin-memory
thinmemory@proton.me

You can also complain to the data protection authority in the country where you live or work. We would rather hear from you first.