Privacy notice
Effective 1 November 2026
Your memories live on your own computer. exomem.io forwards requests between your assistant and that computer without storing what passes through. We keep your email address, your connections and short technical logs. We do not sell personal data, show advertising or use your data to train AI.
1. Who is responsible
Gevolut Oy (Business ID 3659534-1), Vaasanpolku 3 B 40, 00500 Helsinki, Finland is the controller of the personal data described here. Email hello@exomem.io for privacy questions or requests.
2. What we process
- Account data: your email address, account creation and last sign-in times, sessions.
- Connections: which apps (for example ChatGPT or Claude) you connected, when, and the access you granted; hashed access and refresh tokens.
- Device data: your paired computer's name, Exomem version, last-seen time and a hashed device token.
- Memory content in transit: the search requests your assistant sends and the excerpts your computer returns. Excerpts can contain message and note text, voice-memo transcripts, dates, source and collection names, the names of people in those records, and record identifiers. They pass through exomem.io's memory to be forwarded and are never written to disk or logs.
- Outcome logs: for each request, the tool name, time, duration, route (your device, the demo) and result status. No request arguments or results.
- Technical data: IP addresses and request times, used for rate limits and security.
- Feedback: one-line reports sent with
log_feedbackare written to the Exomem on your own computer, not to exomem.io. Feedback sent while you use the demo workspace is kept by us for at most one year to improve the demo; it is not linked to your account, so do not include personal details.
3. Why and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing sign-in, connections and request forwarding | Contract with you |
| Security, abuse prevention, rate limits, outcome logs | Legitimate interests |
| Support and legal claims | Contract; legitimate interests |
Exomem does not categorise or analyse what your memories are about. You decide which of your own archives to import and which to keep local-only.
4. Who receives it
- Your assistant provider (OpenAI, Anthropic): receives the answers you ask for, under its own privacy policy.
- Cloudflare: network provider. Cloudflare terminates TLS and carries requests and answers between your assistant, exomem.io and your computer; it does not keep their content.
- Resend (EU region, Ireland): sends sign-in emails.
- Apple: hosts our support email.
exomem.io runs on a server operated by Gevolut Oy in Finland. Cloudflare and Apple may process data in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses.
5. How long we keep it
| Account, connections, device | Until you delete them or your account |
| Sign-in links | 15 minutes, single use; removed within a day |
| Access tokens / refresh tokens | 1 hour / up to 90 days after last use; a connection lasts at most a year |
| Outcome logs | 30 days |
| Technical logs | Rotated by size (at most 50 MB per service), not by age |
| Sign-in records of directory reviewer accounts | 1 year |
| Backups of the account database | Encrypted, deleted on a rolling 30-day cycle |
6. Your rights
You may access, correct, delete or export your data, restrict or object to its use, and complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local authority. Delete your account on the account page or email hello@exomem.io.
7. Changes
We will post changes here and update the date above.