Privacy Policy

Who we are: MemoBrain is developed and operated by Qingdao Memobrain Technology Co., Ltd. ("we", "us", "our"). This policy covers the MemoBrain desktop application, our website at memobrain.net, and any related online services (together, the "Service"). Questions about privacy: [email protected].

1. Data we collect

Information you provide directly

• Account information: email address and a password (or authentication token) when you register.
• License information: subscription details and license keys issued for your account.
• Payment information: handled by our third-party payment provider at checkout (see Section 3). We never receive or store your full card number.

Information collected automatically

• Usage data: feature interactions, crash reports and error logs, to help us improve the product.
• Device information: operating system, application version, and approximate region (derived from IP address) when the app contacts our servers.
• IP address: recorded in server logs for security and rate limiting.

AI request content

• Official AI features (points): the content you submit (text, diagrams, or documents you choose to include) is sent to our backend and forwarded to third-party AI model providers solely to generate the requested output (see Section 3).
• Bring your own key (BYOK): if you configure your own model provider API key, AI requests go directly from your device to that provider — they do not pass through our servers, and we never see that content or your key.

Cloud storage (if you opt in)

• If you opt into cloud sync or cloud storage, your documents are uploaded to our servers. You can delete them at any time, and deletion is irreversible after 30 days.

2. How we use data

We use the data we collect to:

• Provide, operate, and maintain the Service;
• Validate licenses and subscriptions;
• Process payments;
• Improve the product (e.g., fixing crashes, optimizing features);
• Prevent abuse, fraud, and security incidents;
• Comply with legal obligations.

We do not sell your personal data.

Legal bases (EEA/UK): performance of a contract (account, license, providing the Service and AI features); legitimate interests (security, fraud prevention, product improvement); consent (opt-in features such as cloud sync — withdrawable at any time).

3. Third-party services

We integrate the third-party services listed below. Each provider processes data under its own privacy policy — follow the links to review them. Third parties may adjust their data practices over time; their official policies prevail.

Provider	Purpose	Data involved	Privacy policy
DeepSeek (DeepSeek AI)	Official AI feature processing (one of the model providers behind AI points)	The content of your AI requests (text, diagrams or documents you submit) and generated output	platform.deepseek.com — privacy policy
Zhipu AI (Z.ai / 智谱)	Official AI feature processing (alternate model provider)	The content of your AI requests and generated output	open.bigmodel.cn/policy/privacy
Cloudflare, Inc.	CDN, DNS, SSL, DDoS protection; Cloudflare R2 for opt-in cloud document storage	Standard web logs (IP address, user agent, request time); for cloud storage, the documents you choose to upload	cloudflare.com/privacy
Self-hosted analytics	Aggregated product-usage measurement	Anonymized usage events; no document contents, hosted on our own servers	— (no third party involved)

Bring your own key (BYOK): if you configure your own model provider, AI requests go directly from your device to that provider and do not pass through our servers. Your handling of that provider is then governed by your own agreement with it.

4. Data retention

• Account and license data: kept while your account is active, plus a reasonable period afterward for legal and accounting reasons.
• Usage logs: retained for up to 12 months, then deleted or anonymized.
• Cloud documents: retained until you delete them, then purged after 30 days.
• AI request content: not retained by us beyond what is required to provide the feature (see the AI provider's policy for its own retention).

5. Your rights

Depending on your jurisdiction (e.g., GDPR in the EU/EEA, CCPA/CPRA in California), you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Delete your data;
• Export your data in a machine-readable format;
• Withdraw consent where processing is based on consent;
• Object to or restrict certain processing;
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email [email protected] with the subject "Privacy Request". We respond within 30 days. We may ask you to verify your identity first.

Deleting your data: cloud documents can be deleted by you at any time inside the app. To delete your account and its associated personal data, email us — we complete verified deletion requests within 30 days and confirm by email.

6. Cookies and local storage

• Login session: a session token cookie/local-storage entry that keeps you signed in.
• Preferences: local entries for language and interface choices (e.g., site language, settings) — never shared with third parties.
• Analytics: privacy-respecting, self-hosted, aggregated measurement only — no cross-site tracking, no advertising cookies.
• Desktop app: preferences, recent files, and local documents live in local storage on your device.

7. Security

We use industry-standard measures: TLS encryption for data in transit, minimal collection, and storage of API keys only on our servers — never inside the distributed client. No security measure is perfect; you use the Service at your own risk to the extent permitted by law.

8. Children

The Service is not directed at children under 13 (or under 16 in the EU/EEA). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

9. International transfers

Your data may be processed on servers located outside your country (including via our third-party providers). By using the Service, you consent to such transfers to the extent permitted by applicable law. We aim to use providers with adequate safeguards (e.g., standard contractual clauses where applicable).

10. Changes to this policy

We may update this policy from time to time. Material changes will be announced on our website or by email at least 14 days before they take effect. Continued use of the Service after changes take effect constitutes acceptance.

11. Contact

Questions about this policy: [email protected]

Last updated: October 14, 2026 · Version 1.2 (supersedes the September 14, 2026 draft)