Legal
Privacy
What Memorable holds, what it does not, and the mechanism behind each answer. The dashboard shows the same inventory against your own workspace, with live row counts, under What we hold.
Last updated 28 August 2026
Two paths, two different answers
Memorable captures in two ways, and the strongest sentence on this page is true of one of them. Keeping them apart is the only honest way to write this.
The coding path is the CLI. It sends a minimized trace of a finished session; the extraction worker turns it into a procedure and returns it to the machine that asked. The procedure is written by the CLI to your own store, your gbrain database or a local file. We keep no copy, which is also why we cannot show you one if you ask.
The browser path is off by default, per workspace. When a workspace turns it on, Memorable does store the procedures it learns from browser sessions, and a per-action record of browser runs. A workspace that never turns it on has no rows of that kind at all, and every sentence about the coding path holds for it verbatim.
Held in the account database
One row per workspace, one per person, and the plumbing that bills and secures them. Nothing here describes what anyone worked on.
- Workspace
- Name, slug, plan, seat count, monthly allowance, bonus remaining, Stripe customer and subscription ids, billing period start, and each capture switch.
- People
- The email address you signed in with, your role, and the identity provider's user id.
- API keys
- A SHA-256 hash of each key, its first eight characters for display, a name, an optional note, and timestamps. Never the key itself, it is shown once, at creation.
- Usage
- Session counts and overage per billing period. Integers, closed once and never recomputed.
- Repository names
- Only if your workspace turns recording on, and then as a git remote name, never a URL carrying a token, never anything from inside the repository. Off by default.
- Invitations
- Email address, role, a hash of the invitation token, and an expiry. The token itself exists only in the link that was sent.
- Evaluation runs
- Six integers and a suite name per uploaded run. The endpoint reads six integers off the body and writes six integers.
- Audit events
- Administrative actions taken in the dashboard, who, what, when, and the value before and after. Readable by owners and admins only.
Not held
The second column is the mechanism. "We do not store your code" is a promise; the mechanism is what survives someone asking how.
- Procedures, coding path
- Returned to the machine that asked and written by the CLI to your own store. The service keeps no copy.
- File contents
- Never sent. File paths are, and only through a fixed allow-list of argument fields.
- Task descriptions
- Derived on your machine, sent as one line for the length of one request, used to title and match the procedure, and written to no table.
- Conversation transcripts
- Stay on the machine. The corpus field in the extract request is sent empty.
- Source code
- Never read. Nothing in the capture path opens a source file.
- Environment values
- Never sent. Credential-shaped strings are redacted on your machine before the request is built.
Held outside the account database
Short-lived or hash-only, but real. A reviewer who finds one of these unlisted stops believing the rest of the page.
- API key hashes
- The full SHA-256 of each key, in Cloudflare KV, for as long as the key exists. A read of that store can never yield a usable credential.
- Per-request shape
- Request path, status code, key id, embedding outcome, client version and latency, in Workers Analytics Engine. Never request bodies, never raw keys, never IP addresses.
- Session ids
- An opaque id per counted session, for 48 hours, so re-sending a session already counted is free rather than billed twice. No content.
- Device login codes
- The short code you type and the hostname you are shown before approving it, for 10 minutes. Expires whether or not anyone approves.
- Browser step rows
- Only for a workspace on the browser path. Kept for that workspace's retention window, 30 days by default, settable between 7 and 180, then deleted by a daily sweep.
Recall, embeddings and third parties
Recall matches a task against stored procedures, and matching needs a vector. One line of text, the task description, truncated to 2,000 characters, is sent to be embedded. Nothing is persisted by that call.
By default the text is embedded on Workers AI inside our own Cloudflare account, and no third party sees it. A workspace can instead be set to Voyage AI, or connect its own vendor key, in which case that vendor does see the line and its own terms apply. Which of these is true for your workspace is a column on your workspace's row, readable in the dashboard, not a claim in this document.
The call is skipped entirely when the machine has its own embedding provider configured, in which case recall embeds locally.
Who processes data for us
- Cloudflare
- Runs the extraction API, the key store and the request-shape dataset.
- Supabase
- Runs the account database and sign-in.
- Stripe
- Runs billing. Card details go to Stripe and never reach us; we hold the customer and subscription ids.
- An embedding vendor
- Only where a workspace has chosen one, as above. On the default setting there is none.
Keeping and deleting
Account rows live as long as the workspace does. Deleting a workspace deletes its rows, and the dependent rows go with it, members, keys, periods, policies, invitations, evaluation runs and audit events are all removed by the database rather than by a script that has to remember them.
The short-lived stores expire on their own schedules, above. Procedures on the coding path cannot be deleted by us because we do not have them; they are in your store and you delete them there.
To reach an account you no longer have access to, or to ask what is held against an email address, write to nikhil@memorable.sh.
What we do not claim
How long Cloudflare's Analytics Engine retains a data point is Cloudflare's retention for that dataset, not a number we set or can promise.
For a workspace whose text reaches a third-party embedding vendor, what that vendor stores or trains on is governed by that vendor's terms, not by this page.
This page describes the service as it is built. It is not legal advice, and it does not replace an agreement signed for an enterprise engagement.
Contact
Questions about this page go to nikhil@memorable.sh.