Privacy Policy

Last updated: October 5, 2026

WeMemi is built on a simple premise: your data belongs to you. The WeMemi app — on your computer and on your phone — is local-first: your memories, files, captured context, and AI sessions are stored on your own device and are never transmitted to us. We couldn't sell your data or hand it to advertisers if we wanted to — we never hold it. This policy explains the small amount of data we do handle, and why.

1. The application

On your computer

• All memory tiers, captured context, and databases live on your device, and can be encrypted at rest under a key only you hold. We have no access to them. The one exception is the optional cloud backup described in section 4 — and even then we hold only ciphertext we cannot decrypt.
• On-device AI inference runs locally. Your prompts and content are not sent to WeMemi servers.
• The app makes network requests only for: downloading model files and app updates, verifying your subscription (if you have one), and any cloud feature you explicitly enable (all cloud features are opt-in and off by default).
• Device sync and sharing: if you pair your own devices, or share a life event with another person, that data travels over an end-to-end encrypted connection authenticated by keys held on the devices themselves. WeMemi servers do not store this content and cannot read it — even where encrypted traffic transits a relay to get through a firewall, only the endpoints hold the keys.
• Browser extension: the optional Chrome/Firefox/Edge extension captures only the sites you have approved inside the app, and sends what it captures exclusively to the WeMemi application running on your own computer — never to any server.
• Attachments: photos and files you attach to a memory are copied into the app's local store on your device. They are not uploaded anywhere unless you explicitly enable the optional encrypted cloud backup.

On your phone (iPhone and Android)

The phone app runs the same memory engine as the computer app, under the same rules: what it collects is stored on the phone, is never transmitted to WeMemi servers, and is never sold, shared, used for advertising, or used to train AI models.

• What it can read, only with your permission: each of these is asked for by the phone's own permission prompt, is off until you allow it, and can be withdrawn at any time in the phone's settings.
  • Calendar (and, on iPhone, Reminders): your events and reminders, so your plans become part of your memory.
  • Contacts: names and details, so the app knows who the people in your memories are.
  • Photos: when and where each photo was taken, to build your timeline. The photos themselves are not uploaded anywhere.
  • Camera and microphone: used only while you press Record to film a video or tell a voice note onto a memory. The recording stays on the phone.
  • Local network: used to find your own other devices on the same network so they can sync directly.
• Things you send it yourself: text, links, images, documents, audio and video you share into WeMemi from another app's share sheet, or save from Safari with the WeMemi extension on iPhone, are stored on the phone like anything else you add.
• Connected accounts: Google, Microsoft 365 and Linear can be connected on the phone exactly as on the computer, under the same scopes and rules described in sections 2 and 3.
• Face ID and fingerprint: if you turn on App Lock, the phone's operating system checks your face or fingerprint and tells the app only whether it matched. WeMemi never receives or stores biometric data.
• On-device AI: questions you ask on the phone are answered by a model running on the phone itself. Your memories are not sent anywhere to be read. The model file is downloaded once from its public host (Hugging Face), which sees an ordinary download request.
• Sync with your computer: pairing the phone with your computer uses the same end-to-end encrypted device sync described above. The raw, high-volume layer of your computer's archive is never copied to the phone.
• No tracking: the phone app contains no analytics, advertising or tracking code, and does not track you across other companies' apps or websites.

2. Google user data

If you choose to connect your Google account, WeMemi requests read-only access to Gmail and Google Calendar, plus your basic profile (email address), strictly to import your own information into your private, on-device memory. Every scope we request is read-only — WeMemi cannot send mail or alter your calendar. We do not request access to Google Drive.

• What we access: your email messages (read-only), calendar events (read-only), and your account email address for sign-in identification.
• How it's used: solely to build your personal memory inside the WeMemi app on your device — for example, so your AI assistants can recall a commitment from an email or a fact from a document. Nothing else.
• Where it's stored: on your device, in the app's local databases. WeMemi servers never receive readable Google data: nothing is uploaded by default, and our sign-in relay only facilitates the browser redirect during connection — it never receives your Google data. OAuth tokens are stored on your own device. The only time a token reaches our relay is when it needs renewing: your device sends the refresh token, the relay exchanges it with Google using our confidential client credentials and hands the new access token straight back — it stores neither, keeping only a one-way hash of the refresh token so it can tell which account a renewal belongs to.
• How it's protected: on your device, the app's files are readable only by your own operating-system user account, and you can additionally turn on full encryption at rest — available on every plan, not a paid extra — under a Recovery Key that only you hold. If — and only if — you switch on the optional cloud backup, a copy of your archive is uploaded for disaster recovery. That copy is encrypted on your device before it leaves it, using a key derived from a Recovery Key that you alone hold and that is never sent to us. We store only ciphertext: no one at WeMemi, and no one who obtained our storage, can read it. If you lose your Recovery Key, the backup is permanently unreadable — including by us. Cloud backup is off unless you turn it on, and uploads travel over TLS.
• Who can see it: no one but you. No human at WeMemi can read your Google data, and we never transfer, sell, or share it with anyone.
• No ads, no AI training: Google user data is never used for advertising, never used to train AI or machine-learning models (generalized or otherwise), and never used to determine creditworthiness or for lending.
• AI processing is local: when your AI assistant draws on Google data, the model reading it runs on your own computer or phone. WeMemi ships no integration that sends your Google data to OpenAI, Anthropic, Google Gemini, or any other third-party AI provider — for training, inference, or any other purpose. The optional Chat feature described in section 5 refuses anything that came from your Gmail or Google Calendar, including a memory made from it; no setting changes this. See section 5.
• The Google Photos API is not used: WeMemi does not request the Google Photos scope and does not call the Google Photos API. No photo data is ever pulled from your Google account over an API. Photos reach WeMemi in three separate ways, none of which involves a Google API:
  • Photos you attach to a life event — files already sitting on your own computer that you attach by hand, one at a time. They are copied into the app's local store on your device and are never uploaded to us.
  • The optional Apple Photos connector — reads only day-grouped photo counts and captions, from a copy of your local macOS Photos database. It never reads the images themselves. On-device, opt-in, and unrelated to any Google service.
  • A Google Takeout archive you download and open yourself — if you ask Google for your own data export and hand the resulting file to WeMemi, the app reads the small JSON metadata files Google puts beside each photo — the date it was taken, its title and caption, and the names of any people Google had tagged in it — and groups them into one entry per day on your timeline. It never opens the image files themselves. This is you moving a file you already downloaded; WeMemi never contacts Google to obtain it, and the archive stays on your device.
• Revoking access: disconnect Google inside the app at any time, or revoke WeMemi from your Google Account security settings. Imported data can be deleted in-app. If you enabled cloud backup, you can switch it off at any time to stop further uploads, and you may request deletion of any stored backup by contacting us — we will delete it. Because we hold only ciphertext, discarding your Recovery Key also renders any stored backup permanently unreadable.

WeMemi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

3. Other connected accounts

Beyond Google, you can connect other accounts the same way — each one optional, connected by you, and removable by you. Every connection follows the same rules as Google above: your data is imported only into the private memory on your own device, is never transmitted to or stored on WeMemi servers, is never sold, shared, or used for advertising, and is never used to train AI models. Sign-in tokens are stored on your device. Our sign-in relay completes the sign-in with the service on your app's behalf, so it handles your tokens in memory for that moment. It then holds them only in encrypted form that only your device can decrypt, deletes them as soon as your app collects them, and marks any uncollected result to expire after two minutes and be purged automatically. When a token is renewed, the relay passes the request to the service and keeps no copy. You can disconnect any account in the app, and additionally revoke WeMemi from that service's own security settings.

• Microsoft 365 (Outlook mail and calendar): we request read-only data scopes — Mail.Read and Calendars.Read — plus your basic profile for sign-in identification. We do not request access to OneDrive or Teams. WeMemi cannot send mail or alter your calendar. Microsoft 365 data is handled in accordance with the Microsoft APIs Terms of Use, and is never used for advertising or model training.
• Slack, Notion, Spotify, GitHub, Linear, Jira, and Figma: each requests the narrowest scopes that service makes available for reading your own content — messages, pages, listening history, repositories, issues, and files respectively — and WeMemi uses them solely to import that content into your on-device memory. We never post, edit, or delete anything in a connected account.
• Local application data (Apple Mail, Messages, Notes, Calendar, Photos metadata, browser history, and files you point it at) is read directly on your machine, with your operating system's permission where the OS requires one, and never leaves it.

4. How we protect your data

Because WeMemi is local-first, the strongest protection is structural: sensitive data — including everything imported from Google — stays on your own machine and never reaches our servers, so there is no central store of it to breach. On top of that, the following controls apply.

On your device

• Encryption at rest: WeMemi can encrypt its entire local database using SQLCipher with AES-256 (CBC mode with per-page HMAC-SHA512 integrity verification). This is enabled by you in a one-time, confirmed setup step rather than silently by default, and once enabled it cannot be silently downgraded — a device that has been encrypted will re-encrypt an unencrypted archive restored onto it, and will refuse to open in plaintext if that fails.
• Key management: the database key is a 256-bit key held in your operating system's own credential store (macOS Keychain, Windows Credential Manager, the Linux secret service, the iOS keychain or the Android Keystore) — not in a file we control. Two backup copies of the key are sealed on disk under Argon2id key derivation with ChaCha20-Poly1305 authenticated encryption: one under your Recovery Key, one under an optional passphrase.
• Recovery Key: a 200-bit recovery code, displayed once and held only by you. We never receive it, and we cannot reset it or recover your data without it.
• Credential storage: Google OAuth tokens are sealed on your device with ChaCha20-Poly1305 under a 256-bit key held in your operating system's own credential store (macOS Keychain, Windows Credential Manager, the iOS keychain or the Android Keystore); the sealed file itself carries owner-only permissions. A copy of the data folder does not carry working access with it. Disconnecting an account revokes the grant at Google and deletes the tokens. During the sign-in handshake they are additionally sealed to your specific device using ephemeral X25519 key agreement with ChaCha20-Poly1305, so our sign-in relay is mathematically unable to read the tokens it relays, and the relayed record is single-use and deleted on first read.
• Secret redaction before storage: captured content passes through a redaction layer before it is written to the database, not after. Built-in patterns detect and mask or discard API keys, access tokens, private keys, passwords, payment card numbers, and similar credentials, and you can add your own rules. Refusals are logged by rule and location only — never by content.
• Application lock: an optional PIN or passphrase gates access to the app's interface, verified against an Argon2id hash with brute-force throttling that persists across restarts. This is an access control on the user interface; disk-level protection is provided by the encryption at rest described above, together with your operating system's own full-disk encryption.

In transit

• All network requests use HTTPS/TLS via a modern Rust TLS implementation (rustls). Certificate validation is never disabled or bypassed anywhere in the application.
• The app refuses to send prompts or memory content to any non-local inference endpoint unless you have explicitly consented to that specific endpoint, and such an endpoint must use HTTPS.
• Our cloud storage bucket rejects any non-TLS request outright.

On our servers

Our servers hold no Google user data of any kind — only the minimal billing record described in section 7. For that data:

• Encryption at rest: our database (Amazon DynamoDB) is encrypted at rest using AWS-managed keys, with point-in-time recovery enabled.
• Least-privilege access control: each server function runs under its own narrowly scoped IAM role granting only the specific permissions it needs — write-only where write-only suffices, and storage access scoped to a single bucket and a fixed set of operations. There is no shared, broadly privileged role.
• Secrets management: API credentials, including our Google client secret, are held in AWS Systems Manager Parameter Store as encrypted SecureStrings. They are never shipped inside the desktop application.
• Storage hardening: all public access to our storage buckets is blocked at the account level.
• Optional cloud backup (Ultra plan): backups are encrypted on your device before upload with ChaCha20-Poly1305, under a key derived via Argon2id from your Recovery Key. We store only ciphertext and cannot decrypt it. The application is never given credentials to our storage — it receives a short-lived, single-purpose upload URL.
• Sign-in: authentication uses single-use, expiring, HMAC-SHA256-signed email links, or in the phone app a single-use six-digit code sent by email that expires after 15 minutes and allows five attempts. We do not store passwords.

5. AI processing and model training

WeMemi's own AI runs locally on your own device: on a computer, in a self-hosted inference engine bundled with the application and reached only over your machine's own loopback interface; on a phone, inside the app itself. Your memories and your captured context are processed on-device. They are not transmitted to an external model provider unless you turn on Chat and choose to send them, as described below. Data imported from Google is never transmitted to an external model provider — not for inference, not for training, not for evaluation, and not for any secondary purpose.

• Chat is optional, separate, and off until you set it up. The app, on a computer and on a phone, has a Chat feature that talks to a model provider you choose — OpenAI, Anthropic, Google (the Gemini API), xAI, or OpenRouter — using an API key you supply, under your own account with that provider. Nothing is sent to a provider until you have saved its key on that device and approved that provider by name. Your key is stored encrypted on the device where you entered it (in its Keychain or keystore) and is never sent to us or copied to your other devices. WeMemi's servers are not in the path: we never receive what you send in Chat, the replies, or your key. Chat can also use the AI model already on your own device; a chat that does sends nothing anywhere.
• What Chat sends. The messages you type in Chat; the text of any file you attach (read on your device — the file itself is not uploaded); any picture you attach, after the app asks you; and, if you switch on web search for a chat, the provider runs searches based on that conversation. Before a message leaves, personal details in it — names, email addresses and similar — are replaced with placeholders on your device and put back in the reply. You can switch that masking off; passwords and keys are removed either way. A picture cannot be masked.
• Your memories are a second, separate choice. Chat is given none of your memories unless you first pick the ones it may have and then switch memories on for a particular chat. Only those are sent, to that chat's provider, and the provider cannot ask for more. You can also choose to send your name and the short description of yourself from Settings.
• Google data is never sent. We do not send Google user data — raw, aggregated, anonymized, or derived — to OpenAI, Anthropic, Google Gemini, or any other third-party AI or machine-learning provider. Chat refuses content that came from Gmail or Google Calendar, including a memory you picked that came from one of them or whose origin the app cannot establish. There is no setting that changes this, and switching masking off does not change it.
• What the provider does with it. Anything you send in Chat is handled by that provider under your agreement with them, including whether they keep it or use it to improve their models; this can differ between their free and paid plans. OpenRouter passes each message to a company that hosts the model you chose, and the app asks it to use only hosts that do not keep or train on your prompts.
• Where Chat history is kept. Your chats are stored encrypted on your device, in a store of their own that is not synced and is not part of the optional cloud backup. By default a copy of each conversation is also saved into your memory archive, where it is treated like any other memory: it syncs between your own devices and is included in the encrypted cloud backup if you use those features. You can turn that copy off. Deleting a chat leaves its copy in your archive, where you can remove it. A reply you choose to save to memory is filed in your archive the same way. The app keeps a list of every call Chat made — when, to which provider, and how much — without the words.
• Sharing from Chat. On a phone, Share hands a chat, a reply or a picture to an app you pick through the phone's own share sheet, and Save Image puts a picture in your Photos. Nothing is shared until you pick where it goes; what happens to it then is up to that app.
• Links in replies. A source or link in a Chat reply opens a web search for its title in your browser instead of the address the model supplied.
• We do not use Google user data to create, train, fine-tune, or improve any foundational or generalized AI/ML model, whether ours or anyone else's.
• The application will not send content to any inference endpoint outside your own machine unless you explicitly and specifically enable one; this is off by default, requires recorded consent, and requires an HTTPS endpoint. Should you choose to enable such an endpoint, the operator of that endpoint is disclosed to you at the point of consent, and data handling then additionally depends on that operator.

6. This website

The website and the application are two separate systems, and this section is only about the website. Visiting wememi.com is an ordinary web visit and we measure it the way any site does. That measurement can never reach what the application holds: your memories, files, captured context, and AI sessions live on your own computer, encrypted, and are never transmitted to us at all — so there is nothing for any website tool to see. Knowing that someone downloaded the app tells us nothing whatsoever about what they later put in it.

• Website analytics: we use Google Analytics to count visits and downloads, so we know whether anyone is finding the site. It records page views, approximate location (city level, derived from IP), and browser and device type, and it sets cookies (named _ga) so a returning browser isn't counted twice. Google processes this as our data processor.
• What it never sees: anything from inside the application. There is no identifier shared between the website and your WeMemi installation, no analytics code of any kind ships inside the app, and your memories are never transmitted to us, so they cannot be measured, sold, or handed to an advertiser by us or by anyone else.
• We run no advertising, remarketing, or ad-personalization scripts, and we sell data to nobody.
• Amazon affiliate links: the hardware guide links to computers on Amazon, and we earn a commission on qualifying purchases. The links are plain links with no script of ours behind them. Once you follow one, you're on Amazon, under Amazon's own privacy notice. Amazon reports commissions to us as totals by product, never who bought what, and nothing from the application is ever involved.
• Standard web server logs (IP address, user agent, requested page) are retained briefly by our hosting infrastructure (Amazon Web Services) for security and operations. We use these to count downloads of the app.
• If you choose to give us your email on the download page, we store it only to send you occasional product updates. It's optional — the download works without it. We never share or sell it, and you can ask us to remove it anytime at privacy@openmindex.ai.

7. Purchases and accounts

• If you buy a subscription on the website, payment is processed by Stripe. We never see or store your card details. Stripe's privacy policy applies to payment data.
• If you subscribe in the iPhone app, payment is processed by Apple through In-App Purchase, under Apple's own terms and privacy policy. We never see your payment details, your Apple ID, or your name. Apple sends us a signed record of the subscription — the product, a transaction identifier, and its renewal and expiry dates — which we attach to your account through a random identifier created for that purpose. The Android app has no in-app purchases.
• We store a minimal billing record: your email address, your plan, and its status. That's the entire "account".
• Sign-in uses one-time email links, or one-time emailed codes in the phone app; we don't store passwords.
• Transactional email (sign-in links and codes, receipts) is sent via Amazon SES. We do not send marketing email without your explicit consent.

8. Your rights

• You can export or delete your local data at any time — it's on your device, in open formats.
• You can delete any chat, or all Chat history at once, in the app. That removes the chats, any pictures made in them, the activity list, and the copies saved to your memory archive.
• You can delete your account yourself, at any time, from wememi.com/delete-account or from Settings in the app. That cancels any subscription immediately and removes your account, your billing details, your cloud backups, your support conversations and the usage records tied to your email. We keep a record that the deletion happened, and Stripe keeps past invoices for tax purposes; our encrypted server backups roll off within 35 days. You can also ask us by emailing privacy@openmindex.ai.

9. Changes

If this policy changes, we'll update this page and the date above. Material changes will be called out on the download page.

10. Contact

Questions? privacy@openmindex.ai