Privacy Policy

Last updated: April 5, 2026

What We Collect

• Account information: Name and email address (provided at signup).
• Memory data: Whatever you store through the API — text content, metadata, tags, emotional context.
• Usage data: API call counts, memory counts, timestamps (for billing and rate limiting).
• Technical data: IP addresses, request IDs (for security and debugging, retained 30 days).

What We Don't Collect

• We do not use cookies or tracking pixels.
• We do not use analytics services (no Google Analytics, no Mixpanel).
• We do not track you across the web.

How We Use Your Data

• Memory data is used solely to provide the Service to you.
• We do not read, analyze, or mine your stored memories.
• We do not use your data to train AI models.
• We do not sell or share your data with third parties.
• Usage data is used for billing and rate limiting only.

Data Isolation

Each account's data is stored in a separate, isolated database. Your memories are never mixed with other users' data. There is no shared data layer.

Data Security

• API keys are hashed with SHA-256 before storage.
• All API traffic is encrypted via TLS (HTTPS enforced).
• Database files are stored on persistent volumes with access restricted to the application process.
• Security headers are set on all responses (HSTS, X-Frame-Options, etc.).

Your Rights (GDPR)

• Access: Export all your data at any time via GET /v1/data/export.
• Deletion: Delete all your data at any time via POST /v1/data/delete.
• Portability: Export returns standard JSON — take your data anywhere.
• Correction: Update or delete individual memories via the API.

Data Retention

• Your memories are retained until you delete them or your account is terminated.
• Memories with low salience may be automatically pruned by the decay system (this is a feature, not data loss — you control decay settings).
• After account deletion, all data is permanently removed within 24 hours.
• Technical logs (IPs, request IDs) are retained for 30 days.

Third-Party Services

• Stripe: Handles payment processing. See Stripe's privacy policy.
• Fly.io: Hosts the API infrastructure. See Fly.io's privacy policy.
• Netlify: Hosts the marketing website. See Netlify's privacy policy.

Contact

Questions about your data? Email aidan@deeprecall.dev