Privacy Policy
Effective date: November 5, 2026
Who we are
Mnemi is a research continuity tool operated by MNEMI INC., a company incorporated in Ontario, Canada ("Mnemi", "we", "us"). This policy explains what personal information we collect, how we use it, who we share it with, and the choices you have.
It covers the Mnemi web app at app.mnemi.co, the Mnemi browser extension, Mnemi's connectors for AI assistants (such as Claude and ChatGPT), and this website.
For privacy questions or requests, contact our privacy officer at privacy@mnemi.co.
Information we collect
Account information. Your email address and, if you sign in with Google, the basic profile details Google shares (name and email). We use this to create and secure your account.
Content you create. Research sessions, notes and moments, questions you ask and the answers Mnemi generates, artifacts, and other material you add to your workspace.
Content you capture. When you choose to capture something, Mnemi stores information about it so you can find and use it later:
- Web pages: the URL, title, an AI-generated summary, and passages of the page's text used for search.
- Uploaded documents and images: text extracted from them (up to the first 5,000 characters of a PDF or document) and an AI-generated summary. We do not keep the original file. Images are re-encoded before processing, which removes embedded metadata such as location and camera details.
- Passages you highlight, and items from sources you choose to watch.
Captured content comes from third parties and may include personal information about other people. Mnemi does not detect or filter this. Please capture responsibly.
Technical information. Sign-in cookies, and a small amount of settings data stored in your browser. Our hosting provider processes IP addresses and request details in its logs. We do not store IP addresses in our application database.
Usage information. Records of actions within Mnemi (for example, creating a session or capturing a page), used to run and improve the product.
Communications. Messages you send us, and the information you give during onboarding about what you plan to use Mnemi for.
How we use information
We use personal information only to provide and protect Mnemi. Where data protection laws such as the GDPR require a legal basis, the bases are listed below.
| Purpose | Legal basis |
|---|---|
| Create and run your account, store your research, and generate summaries, search results and answers | Performance of our contract with you |
| Send service emails (sign-in codes, account approval, and the weekly digest if you receive it) | Performance of our contract; legitimate interests for the digest |
| Keep Mnemi secure, prevent abuse, and enforce rate limits | Legitimate interests in operating a secure service |
| Understand how Mnemi is used and improve it | Legitimate interests |
| Comply with legal obligations | Legal obligation |
We do not use your content for advertising. We do not sell personal information.
AI processing
Mnemi sends your content to AI model providers to do its core work: summarizing pages and documents, building the search index, extracting text from images you upload, answering your questions, and generating session images. We send the content needed for the task, and we don't attach your name, email or account details to these requests.
Mnemi is not tied to a single AI provider. Today our AI model provider is OpenAI. The current list is under Service providers below.
Mnemi does not use your content to train or fine-tune AI models. Reviewing AI requests and responses to improve Mnemi's quality is not training. Separately, AI providers may retain content for a limited time under their terms, for example for abuse monitoring. Not training is not the same as zero retention. For OpenAI specifically: OpenAI doesn't use data sent through its API to train its models, Mnemi has not opted in to share data with OpenAI, and OpenAI keeps abuse-monitoring logs for up to 30 days unless the law requires longer.
You can also connect a model provider with your own API key (currently Anthropic). Features you run with your key send your content to that provider under your own account with them. Your key is encrypted at rest and used only to make those requests.
Research runs. When you approve a research run, Mnemi checks the sources you've asked it to watch and uses its AI model provider to assess what it finds, sending your session topic, what you're trying to figure out, and the text of the pages being assessed. Web search is currently available only on founder accounts. There, Mnemi sends up to two short search queries per run to Tavily, written by Mnemi's model from your session topic and research goal, so they can contain wording from your research. Tavily receives the query text only: no account, session or workspace identifier.
Service providers
These are the service providers (subprocessors) we use today. Each receives only what it needs for its role. We update this list as providers change. We will notify you before a new provider starts receiving your content, or before your content is used in a materially new way. Moving to a different model from a provider already listed does not require notice. List last updated: November 5, 2026.
| Provider | Role | What it receives |
|---|---|---|
| Supabase | Database, sign-in, file storage | All account data and content stored in Mnemi |
| Vercel | Hosting | Web requests, including IP addresses, and server logs |
| OpenAI | AI model provider | Content needed for summaries, search, answers, image text extraction and generated images |
| Resend | Email delivery | Your email address and email contents, including session topics in the weekly digest |
| Upstash | Rate limiting | Internal user and session IDs and share-link identifiers, used to count requests. No research content. Expire automatically. Stored in the US (US East) |
| Sign-in with Google | Standard sign-in information, if you choose Google sign-in | |
| Anthropic | Model provider you connect with your own API key (optional) | Content for the features you run with your key |
| Jina AI | Fallback page reader, used when Mnemi can't read a page itself (the site blocks it, times out, or returns almost no text) | The page's full web address, including anything after the "?". No account details or cookies. |
Because Jina receives the full address, avoid capturing private links that carry access tokens, such as shared document links. Capturing with the browser extension sends the page text directly, which usually avoids the fallback.
When you load a Mnemi page, your browser fetches typefaces from Google Fonts, so Google receives your IP address and browser details.
Sharing
We do not sell your personal information, and Mnemi shows no ads. We share information only in these cases:
- With the service providers listed above, to run Mnemi on our behalf.
- When you share a session. A share link lets anyone who has it view that session and the captured pages it shows, without signing in. Pages you've muted, and pages Mnemi couldn't read, aren't included. Links stay active until you revoke them. Treat a share link like a password.
- When you connect an AI assistant. If you connect Claude, ChatGPT or another assistant, you give it a token for your account. By default it can read your Mnemi data, add and change content, close some review items on your behalf (such as dismissing a suggested shift), and delete moments, kept items, watched sources and whole sessions. It cannot confirm a belief change: that always requires you, in Mnemi. Disconnecting inside the assistant does not revoke access; revoke the token in Mnemi's Settings. The assistant's provider handles the data under its own privacy policy.
- When required by law, or to protect the rights, safety or property of Mnemi, our users or others.
- In a business transfer, such as a merger or acquisition. If this happens, we will tell you, and this policy will continue to apply to your information.
Where your data is stored
Your Mnemi data is stored in Canada (Montreal, AWS region ca-central-1). Some of our service providers process data in the United States and other countries.
When personal information from the EU, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the data processing terms our providers offer for international transfers.
If you are in Canada, your information may be processed outside Canada and may be accessible to courts and authorities in those countries under their laws.
How long we keep information
We keep your account information and research content until you delete it or delete your account.
| Information | How long we keep it |
|---|---|
| Sessions, notes, captures, questions and answers | Until you delete the session or your account. Exception: questions you asked inside a session stay after that session is deleted, until you delete your account. |
| Full text extracted from a captured page | Cleared once the page's summary and search index are built. If processing fails, kept until you delete the session or your account, so it can be retried. |
| Search passages and extracted document text | Until you delete the session or your account |
| Activity records | Until you delete your account. |
| AI request records used for quality checks | Until you delete the session or your account. |
| Hosting logs | Up to 30 days |
| Backups | Up to 7 days, then removed automatically |
We may keep limited information longer when the law requires it, or to resolve disputes and enforce our terms.
Deleting your data
Deleting a session removes it along with its captures, notes, search index and related records. Not yet removed with it: the questions you asked inside the session, which are removed when you delete your account, and the session's generated image, which we remove on request.
Sessions that contain research findings you've merged can't currently be deleted on their own. Deleting your account removes them.
Deleting your account in Settings deletes your workspace and everything in it, including sessions, captures, uploads, search index, questions, notes, artifacts, research history, watched sources and access tokens, then your sign-in and any saved AI provider key. Generated session images aren't deleted yet; we delete them on request.
If removing your sign-in fails after your data is deleted, contact privacy@mnemi.co and we'll finish it. Until it's finished, we keep only an internal identifier recording that your deletion is in progress, and delete that too once your sign-in is removed.
Data in backups is removed as backups expire, within 7 days. Information already processed by service providers is handled under their retention terms, described above.
If you have trouble deleting anything, contact privacy@mnemi.co and we will complete the deletion.
The Mnemi browser extension
The extension reads a page only when you choose to capture it. It does not track your browsing, watch the tabs you visit, or collect anything in the background.
When you capture a page, the extension sends Mnemi the page's URL, title, any text you've selected, and up to 50,000 characters of the page's visible text. It skips form fields, so anything typed into inputs or text boxes is never collected. Hidden page elements are skipped too.
Captured content is sent only to Mnemi. The extension stores its sign-in state and recording status in your browser.
Access to all websites is optional and requested only when you take an action that needs it.
Google user data. Mnemi's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google sign-in information only to sign you in and operate your account.
Cookies and local storage
The Mnemi app uses only essential cookies, which keep you signed in. It uses no analytics or advertising cookies.
The app also stores a few settings in your browser, such as whether you've completed onboarding. These contain no research content.
Our website, mnemi.co, uses no analytics and sets no cookies.
Security
We protect your information with measures including:
- Access controls that limit each account to its own data, except for content you choose to share.
- Personal access tokens stored in our database only as hashes, and provider API keys you add stored encrypted. An AI assistant you connect holds a credential that carries your token, so revoke the token in Settings to end its access.
- Protection against requests to private networks when Mnemi fetches pages on your behalf.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.
Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you;
- correct information that is inaccurate;
- delete your information;
- receive a copy of your information in a portable format;
- object to or restrict certain processing;
- withdraw consent where we rely on it.
You can delete sessions and your account yourself in Mnemi. To stop receiving the weekly digest, email us. For anything else, email privacy@mnemi.co. We will respond within 30 days and may need to confirm your identity first. We will not treat you differently for exercising these rights.
You can also complain to a data protection authority: in Canada, the Office of the Privacy Commissioner of Canada (or your provincial commissioner); in the EU, your local supervisory authority; in the UK, the Information Commissioner's Office. We'd appreciate the chance to help first.
Age requirement
Mnemi is for adults. You must be at least 18 years old to use it. We do not knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18, we will delete it. If you believe a minor is using Mnemi, contact us at privacy@mnemi.co.
Changes and contact
We may update this policy as Mnemi changes. We will post the new version here with a new effective date. If a change materially affects how we handle your information, we will tell you by email or in the app before it takes effect.
Contact: MNEMI INC., Ontario, Canada, privacy@mnemi.co