Last updated: November 8, 2026 · Kolivri Ltd

Privacy Policy

Memoria ("we", "our", or "the Service"), operated by Kolivri Ltd, provides deterministic graph and symbolic long-term memory infrastructure for AI coding assistants and autonomous agents. This Privacy Policy explains what data we collect, how it is isolated and secured, and how you control and delete your data.

1. Information We Collect

  • Account & Organization Information: When you register or sign in via Google OAuth, we store your email address, organization name, and password hash (scrypt, if using email/password login).
  • API Key Hashes & Metadata: When you mint an API key, the raw key is displayed once and never stored. We store only its SHA-256 cryptographic hash, key prefix (e.g., mem_dev_), optional label, creation timestamp, and last-used timestamp.
  • Encoded Memories & Context Metadata: When your configured AI client (Claude Code, Cursor, Windsurf, OpenCode, VS Code, Zed, or REST client) calls our MCP or HTTP endpoints, we store the memory content, type, salience score, and context tags strictly within your organization's isolated namespace.
  • Usage Metering & Billing Identifiers: We record rolling API call counts (usage_events) to enforce plan quotas and store PayPal payer/subscription reference IDs when you upgrade. Memoria never receives or stores your raw payment card or bank credentials.

2. Zero Model Training & Deterministic Processing

We never train AI or machine-learning models on your memories, code, or prompts. Unlike LLM-wrapper memory services that forward every write to third-party LLM APIs for extraction, Memoria processes, scores, and retrieves your memories deterministically. Your organization's memories are never shared with or visible to any other tenant.

3. Security & Tenant Isolation

  • Transport & Storage Security: All traffic is encrypted over HTTPS (TLS 1.2+ enforced). Data is stored in Google Cloud SQL (europe-west1) with strict per-organization (org_id and namespace) query isolation.
  • Client-Side Plugin Hardening: Our installer verifies SHA-256 archive checksums before extraction, sets 0700/0600 permissions on ~/.memoria/config.env, parses configuration without shell execution, and pipes Bearer tokens to curl via stdin so API keys are never exposed in the process table (ps aux).
  • Session & CSRF Protection: Web sessions use HttpOnly, Secure, SameSite=Lax cookies, 256-bit CSRF tokens verified in constant time (timingSafeEqual), and Cache-Control: no-store on all authenticated pages.

4. Data Retention, Export & Deletion

You retain full ownership of your data. You can view and delete individual memories at any time from the Memory Explorer on /account, via DELETE /v1/memories/:id, or via the forget_memory and delete_by_context MCP tools. You can revoke API keys instantaneously on /account. To request complete account and organization deletion, contact us at the address below.

5. Sub-Processors & Contact

We use Google Cloud Platform (Cloud Run and Cloud SQL in europe-west1, Belgium) for hosting and database storage, Google OAuth (when you choose "Continue with Google"), and PayPal for subscription billing. For privacy inquiries or data deletion requests, contact Kolivri Ltd at [email protected].