Skip to content
Memoturn

Privacy

Last updated 2026-05-27Terms of use

Scope

Memoturn is open-source software licensed under MIT. This policy covers the hosted service operated by Memoturn at memoturn.ai and api.memoturn.ai. If you self-host from the source code, you are the controller and this policy does not apply to your deployment.

What we collect

When you use the hosted service we process:

  • Account data. Email, hashed password (or OAuth subject id), display name, and the organization the account belongs to.
  • Project content. Turns, memories, facts, candidates, rules, skills, claims, reviews, presence, and anything else you record through the API, MCP, or CLI. Used only to operate the service: storage, search, broadcast, consolidation.
  • Embeddings. Vector representations derived from your project content, used for semantic search. Generated by Cloudflare Workers AI (model @cf/baai/bge-large-en-v1.5) and stored in Cloudflare Vectorize.
  • Redaction signals. The deterministic secret scanner runs on every recorded turn. Spans matched by 25+ credential patterns are replaced with placeholders before storage; the original credential value is never persisted.
  • Operational logs. Request metadata — IP, user agent, response status, latency, query telemetry — for rate limiting, abuse prevention, and the observability dashboard. Retained 30 days.

Sub-processors

The hosted service runs on:

  • Cloudflare (Workers, Durable Objects, Vectorize, Workers AI, KV, R2, Hyperdrive, Queues). Hosts the edge worker, the per-project coordinator, the embeddings index, payload and skill object storage, and the ingest pipeline.
  • Neon (managed Postgres). Stores account, project, turn, memory, fact, candidate, rule, skill, and observability rows.
  • Google and GitHub. OAuth providers. Used only if you sign in via OAuth, in which case the provider sees the sign-in flow and returns a subject id we store against your account.

Retention and deletion

Project content is retained for the lifetime of the project. Operational logs are retained 30 days.

Per-turn and per-memory deletion works today through the API and the MCP forget_memory tool. Project, organization, and account deletion runs through the privacy contact below; a self-serve delete endpoint is planned.

Your rights and contact

If you are in the EU, UK, or California, you have rights to access, correct, export, or delete your data, and to object to or restrict its processing. To exercise any of these, or to ask anything else about privacy, email privacy@memoturn.ai. We respond within 30 days.

We do not sell personal data, do not use your project content to train models, and do not run third-party tracking on the hosted dashboard or the marketing pages.

Back to home