The deal, in the same typeface as the docs.

These terms are a contract between you and thin-memory ("we", "us"), for the thin-memory service. By creating a key, calling the API, connecting an MCP client, or using this website, you agree to them. If you do not agree, do not use the service.

If you accept on behalf of a company or other organisation, you confirm that you have authority to bind it, and "you" means that organisation. If you are accepting for yourself, you must be at least 18 and legally able to enter a contract.

Key claims. To claim a key, we require you to sign in through Cloudflare Access using an email address you control. You are responsible for keeping access to that address and for activity under your session. We may revoke access to claiming if the address is invalid or the session is abused.

You must not be barred from using the service under the laws of your country, any sanctions list, or applicable export controls, and you must not access it from a jurisdiction where doing so would be unlawful.

These terms, the privacy policy and any signed data processing agreement form the whole agreement. If a DPA conflicts with these terms on the processing of Customer Content, the DPA controls.

thin-memory stores text, derives chunks and facts from it, embeds it, and returns ranked results and context blocks. It is reachable over a small REST API and a remote MCP endpoint. Facts are extracted by managed models and embeddings run on Workers AI — there is no bring-your-own-key path on the hosted service.

The service runs on Cloudflare's platform, with Groq for extraction, Dodo Payments for billing, and Cloudflare Access for claim sign-in. We may change providers or models as long as the service keeps substantially the same shape.

The service is not a system of record or a backup. It is a memory layer for agents. Keep your own copies of anything you cannot afford to lose, and do not make it the only place a document exists.

We may add, change or remove features. We aim to give at least 30 days' notice of breaking API changes; security fixes, legal requirements and provider outages may require faster changes.

A service key (tmk_…) is a bearer credential pinned to exactly one container. A master key (tmm_…), held only by the operator, can mint keys and act on any container. Anyone who has a service key can read and write that container; there is no second factor.

• Keep keys secret. Do not put them in client-side code, public repositories, logs or screenshots. Store them in a secret manager or environment variable.
• You are responsible for activity under your keys until you revoke a key with DELETE /v1/keys/:id or tell us it is compromised. Email thinmemory@proton.me promptly if you cannot revoke it yourself.
• Keys are shown once. We store only a SHA-256 hash. You can re-claim a fresh key for the same container with the same receipt; old keys remain valid until you revoke them with DELETE /v1/keys/:id. If you have lost every key, contact us.
• One container per tenant. Do not mix unrelated end users in one container. Isolation is enforced server-side, but the boundary is the key.
• We may revoke or require rotation of keys that leak, are used for abuse, or are required to be rotated for security or legal reasons.

You retain all rights in the documents, memories, metadata and other content you submit ("Customer Content"). We claim no ownership of it.

You grant us a worldwide, non-exclusive, royalty-free licence to host, store, copy, chunk, embed, transmit to our processors, and return Customer Content to you — solely to provide, secure and support the service, and as described in the privacy policy. This licence ends when the content is deleted, except for copies in backups that expire on their own.

You instruct us to send excerpts to Cloudflare Workers AI for embeddings and to Groq for fact extraction when you call /v1/add. That is how the product works. If content must not leave Cloudflare's compute for inference, use POST /v1/memories instead.

You represent and warrant that:

• you have all rights, consents and notices needed to submit Customer Content;
• the content and our processing of it as described here do not infringe anyone's rights or break any law;
• where the content includes personal data of other people, you are the controller, you have a lawful basis, and you will handle their rights requests;
• you will not submit special category data without a valid legal basis and any required explicit consent.

We do not monitor Customer Content. We may access or remove it when you ask us to support you, when we must fix or secure the service, when we are legally required to, or when we reasonably believe it violates these terms.

You agree not to use the service to:

• break the law or harm people — including child sexual abuse material, terrorism, trafficking, malware, phishing, fraud, harassment, threats, or non-consensual intimate imagery;
• infringe rights — including copyright, trademark, trade secrets, privacy or confidentiality obligations you owe someone else;
• store regulated data without cover — health records or other protected health information, payment card data, government identifiers, biometric or genetic data, or special category data, unless you have a lawful basis and we have agreed in writing where required. We do not offer HIPAA business associate agreements by default;
• attack the service — circumventing authentication, quotas or container isolation; probing, scanning or penetration testing without our written permission; overloading the service; or interfering with other customers;
• reverse engineer the service except where that restriction is prohibited by law;
• resell raw access — you may build products that use thin-memory for your own end users, but you may not resell standalone access to the API as a competing memory service or present it as your own infrastructure;
• run high-risk systems — medical devices, life support, emergency services, aviation, nuclear facilities, autonomous weapons, or any use where a failure could cause death or serious injury;
• automate consequential decisions — using extracted facts as the sole basis for decisions with legal or similarly significant effects on a person, without meaningful human review;
• violate export controls or sanctions, or provide the service to anyone barred from receiving it.

We may suspend or terminate a container that violates this section, remove content, and report serious abuse to the authorities where required. Where it is reasonable and safe to do so, we will tell you and give you a chance to fix the problem first.

Security research is welcome: report vulnerabilities to thinmemory@proton.me before publishing, and do not access data that is not yours.

Fact extraction and search ranking use machine learning. Output can be inaccurate, incomplete, outdated, biased or fabricated — including facts that sound confident and are wrong. It is not professional advice, and it is not a substitute for your own review.

• Verify extracted facts before relying on them in a product or decision.
• Keep human oversight wherever an error could matter to someone.
• Extraction is best-effort. It may be skipped when a monthly budget is spent or a provider fails; the add still succeeds. If a fact must be stored exactly, write it through POST /v1/memories.
• Search is approximate. We do not guarantee that recall finds every relevant item, or that ranking is stable between calls.
• We do not train models on Customer Content.

Quotas apply per container, not per key, and reset on the first of the month, UTC. Adds and searches are hard limits: over quota returns 429. Extraction is soft-gated: the add succeeds and the source is stored, but facts are skipped until the period resets. We do not bill overages automatically.

We may change plan limits with reasonable notice. Usage that threatens the service or other customers may be throttled regardless of plan.

payments

Pro is sold through Dodo Payments, which acts as merchant of record. Dodo handles checkout, cards, tax, receipts, refunds and chargebacks under its own buyer terms. We never see your card details. The price, currency and tax shown at checkout govern.

renewal and cancellation

Pro renews automatically each month until cancelled. Cancel any time from the receipt or customer portal Dodo provides. Cancelling stops the next renewal; Pro stays active until the end of the period you paid for, then the container moves to Free limits with its data intact. If Dodo cannot collect a payment, the subscription may go on hold; Pro features drop to Free limits until the payment succeeds or the subscription expires.

price changes and refunds

We may change the price with at least 30 days' notice before your next renewal. If you do not agree, cancel before the renewal. Refunds are handled by Dodo under its policy and applicable law; contact us and we will help. Nothing in these terms limits a mandatory statutory right, including any consumer right of withdrawal that applies where you live.

The Free plan costs nothing, requires no card, and may be changed or discontinued. Paid features may be suspended while an invoice is unpaid or a chargeback is open.

We aim to keep the service available and fast, but we do not promise a service level. There is no uptime commitment, no credit regime and no support response time in these terms. Maintenance, provider outages and failures outside our control can interrupt the service.

Features may be added, changed or deprecated. We will give reasonable notice of material removals where we can, and we aim to give at least 30 days' notice of breaking API changes unless a security or legal issue requires otherwise.

Anything labelled beta or experimental is provided as-is, may change without notice, and may be withdrawn.

You can stop using the service at any time, cancel a subscription through Dodo, and ask us to delete a container. We can suspend or terminate your access if you materially breach these terms, do not pay, submit illegal content, create a security risk, or if the law requires it. Where it is reasonable, we will give notice and a chance to cure the breach first.

If we terminate your access for breach or legal reasons, keys are revoked and access ends. If you cancel a subscription, the container reverts to the Free plan at the end of the paid period; its keys and content stay intact, subject to the Free allowances. Customer Content is deleted within 30 days after an account termination unless we must retain it for a legal hold or billing dispute. Export anything you need before then using GET /v1/items and GET /v1/profile.

Sections on payment obligations, content licence for copies already in backups, intellectual property, disclaimers, limitation of liability, indemnity, governing law and general provisions survive termination.

We own the service, its software, design, documentation and marks. We grant you a limited, revocable, non-exclusive, non-transferable right to use the service under these terms. You may not copy, modify, distribute or create derivative works of the service except as allowed by law or with our written permission.

If you send feedback, you grant us a perpetual, royalty-free licence to use it to improve the service, without obligation to you.

thin-memory is an independent project. It is inspired by supermemory's surface but is not affiliated with, endorsed by, or sponsored by supermemory. Third-party names and marks belong to their owners.

The service depends on third parties — Cloudflare, Groq and Dodo Payments — whose terms also apply to their part of the stack. We are not responsible for their acts or omissions, and links to their sites are not endorsements.

To the maximum extent permitted by law, the service is provided "as is" and "as available". We disclaim all implied warranties, including merchantability, fitness for a particular purpose, title, non-infringement, accuracy and quiet enjoyment. We do not warrant that the service will be uninterrupted, error-free, secure, or that any memory will be accurate, complete or retained. Some jurisdictions do not allow these exclusions; in those places they apply only to the extent allowed, and statutory consumer guarantees still apply.

To the maximum extent permitted by law, we are not liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, goodwill, data, or business interruption, even if we were advised such damages were possible.

Our total aggregate liability arising out of or relating to the service is limited to the greater of (a) the amount you paid us in the 12 months before the event giving rise to the claim, or (b) USD 100.

Nothing in these terms excludes or limits liability for fraud, wilful misconduct, gross negligence, death or personal injury caused by negligence, or any liability that cannot lawfully be excluded. If you are a consumer, you keep every right your local law gives you, and the limits above apply only to the extent that law allows.

You acknowledge that the price and the free tier reflect this allocation of risk, and that we would not offer the service on these terms otherwise.

You will defend, indemnify and hold harmless thin-memory and anyone acting on its behalf from third-party claims, damages, losses and reasonable legal fees arising from: (a) Customer Content; (b) your end users' use of your application; (c) your breach of these terms; or (d) your violation of law or of someone else's rights.

We will tell you promptly about a claim, let you control the defence, and may participate at our own cost. Do not settle in a way that admits our fault or imposes obligations on us without our written consent. This obligation does not apply to the extent a claim is caused by our gross negligence, wilful misconduct or breach of these terms.

These terms do not select a governing law or an exclusive court. If a dispute cannot be resolved informally, it will be handled under the law that applies to it, by a court that has jurisdiction — including any mandatory consumer protection where you live.

Before filing anything, email thinmemory@proton.me with a description of the dispute and give us 30 days to resolve it. Most things are a bug and a refund, not a lawsuit.

If you are a consumer resident in the EEA or the UK, nothing in this section prevents you from bringing proceedings in your country of residence, or from relying on mandatory consumer protections that apply where you live.

Changes. We may update these terms. We publish a new version and effective date, and for material changes we will post a notice on the site — and email the address on the account where we can — at least 14 days before the change takes effect. Continued use after the effective date accepts the new terms; if you do not agree, stop using the service and cancel before then.

Entire agreement. These terms, the privacy policy and any signed DPA are the whole agreement and replace anything said before.

Severability and waiver. If a provision is unenforceable, the rest stays in force and the provision is narrowed to the minimum extent needed. A failure to enforce a right is not a waiver of it.

Assignment. You may not assign these terms without our written consent. We may assign them to a successor in a merger, acquisition or sale of the service, with notice.

Force majeure. We are not liable for delay or failure caused by events outside our reasonable control, including provider outages, network failures, natural disasters, war or government action.

Notices. We may notify you by email to the address on the account or by a notice on the site. You notify us at thinmemory@proton.me.

No third-party beneficiaries, no agency. These terms create no rights for anyone else. We are independent contractors; nothing here makes either of us the agent of the other.

Language. These terms are written in English; translations, if any, are for convenience and the English version controls.

contact

thin-memory
thinmemory@proton.me