Vibe Memory — Privacy Policy

Effective date: 2026-11-11

Data controller: Acrylic Code Inc. ("we", "us", "our")

Contact: colton.dyck@acryliccode.com

Service: Vibe Memory (also written vibe-memory) — a persistent personal-memory connector (an MCP server) you connect to an AI assistant such as Claude or ChatGPT.

1. What Vibe Memory does

Vibe Memory gives your AI assistant a long-term memory. When you connect it, your assistant can save notes ("memories") and recall them in later conversations. You may also import your own exported chat history from Claude or ChatGPT so your memory starts populated. We process your data only to provide this service to you.

2. Information we collect

• Sign-in and identity. You sign in on our own sign-in page with an email code, an email address and password, or your Google or Apple account. Codes and passwords you type on our page are sent to our identity provider, WorkOS, to verify, and are not stored by us; WorkOS stores your password hash if you set a password, and sends the sign-in emails. If you choose Google or Apple, you are handed to that provider to sign in, and through WorkOS we receive only your email address and basic profile (your name), which we use solely to identify your account. We receive a stable account identifier from WorkOS and derive an internal per-user tenant ID from it.
• Sign-in protection. To stop abuse, we keep short-lived counters of sign-in attempts, counted against a keyed hash of your email address and against your network address. The longest counting window is 60 minutes, and a pending sign-in expires after 10 minutes. WorkOS's fraud protection (Radar) may additionally ask you to confirm by email, and receives your IP address and user agent for that check. A per-IP request limit on the sign-in pages runs on Cloudflare.
• Memories you store. The content your assistant saves on your behalf — text you or your assistant choose to remember.
• History you import (optional). If you use the import feature, you upload your own Claude/ChatGPT export file. We extract memories from it and then process the file as described below.
• Usage metadata. Operational records such as counts of memories, embedding/token usage, and timestamps, used to run and rate-limit the service.

We do not ask you to store, and you should not store, payment-card numbers, government IDs, health records, or login credentials in your memory. Vibe Memory is a general note-style memory and does not request sensitive data categories.

3. Data we receive from Google or Apple sign-in

• What we receive. When you sign in with Google or Apple, that provider sends your account details to our identity provider, WorkOS, and through WorkOS we receive your email address and your name. We do not request, receive or store anything else from your Google or Apple account: no contacts, calendar, files, photos, or messages. We ask Google only for the basic sign-in information: your identity, email address and profile name.
• How we use it. Only to create and identify your account, to sign you in, to show you which account you are using in the dashboard, and to show the other members of a shared memory space you belong to who you are (your name, or your email address if there is no name). We do not use it for advertising, we do not sell it, we do not share it with data brokers, and we never use it to train AI or machine-learning models, ours or anyone else's.
• Where it is stored. WorkOS holds your email address and name as your sign-in identity. We also keep a copy of your email address and name in our own database, recorded each time you sign in, and used for the purposes above.
• Who we share it with. Only the sub-processors listed in §5, and only to run the service: WorkOS (identity), Supabase (our database) and Cloudflare (requests in transit). Your Google or Apple sign-in data is never sent to Voyage AI, to the Gemini API, or to Amplitude. The "Google (Gemini API)" row in the sub-processor table concerns conversation history you choose to import and has nothing to do with your Google sign-in data.
• How we protect it. It is encrypted in transit (TLS on every request). Supabase encrypts all stored data at rest, and WorkOS's data processing terms commit it to encrypting personal data in transit and, where appropriate, at rest. Access to production systems is restricted to the operator. Every dashboard request is authenticated, and every database operation is scoped to your own account.
• Retention and deletion. We keep your sign-in identity for as long as your account exists. Deleting your account from the dashboard deletes your memories as described in §7, and deletes the copy of your email address and name in our database. Your sign-in identity record at WorkOS (email address and name) is not removed automatically by that step; to have it deleted, email colton.dyck@acryliccode.com and we will delete it. You can also revoke Vibe Memory's access from your Google account at any time at https://myaccount.google.com/permissions, and for Apple, in your Apple ID settings under "Sign in with Apple".

Vibe Memory's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use your information

• To store and retrieve your memories and provide the connector's features.
• To generate vector embeddings so your assistant can find relevant memories (see sub-processors).
• To extract memories from history you choose to import.
• To secure, rate-limit, debug, and maintain the service.

We do not sell your data, serve ads, or use your memories to train AI models — ours or anyone else's. We use your data solely to provide the service to you.

5. Sub-processors (who else processes your data)

We rely on these providers. Each processes data only to deliver our service:

When you choose to sign in with Google or Apple, that company acts as an independent sign-in provider under its own privacy policy; in that role, Google and Apple are not our processors.

If we add or change a material sub-processor, we will update this list.

6. Data isolation

Your memories are stored under your own tenant and are isolated from other users at the database level. The only memories other users can see are those in a shared memory space they are a member of (see §7). Imported history is not separated by source conversation or project within an account.

7. Shared memory spaces

Besides your personal memory, you can create shared memory spaces and invite other people into them.

• Only the owner of a shared space can invite people to it, and invitations can only be made for a shared space, never for your personal memory. An invitation expires (after 7 days by default) and grants either read or write permission.
• Every current member of a shared space can read the memories in it, and members with write permission can add to it.
• The owner can remove a member. That removes the member's access but does not delete what they recorded in the space.

Deleting your account. Deleting your account deletes every memory in your personal space. It is refused while any shared space you own still has other members: first remove those members, transfer the space to another member, or delete the space. When you delete your account, every shared space you own that has no other members is deleted first, together with all the memories in it. Memories you recorded in a shared space someone else owns stay in that space with your authorship removed; they are not deleted.

8. Data retention and deletion

• We retain your memories until you delete them. There is no fixed expiry.
• You can delete an individual memory (your assistant's "forget" tool) or erase all of your memory from your dashboard at any time. Deletion removes your stored memories and their embeddings from our database.
• An export file you upload for import is deleted from storage when the import completes. If an import does not finish (it fails, is interrupted, or is stopped because you erased your memory), its file expires automatically from storage after 7 days.
• Operational logs are retained for 7 days and do not include the body of your memories (see §10).

9. Your rights

You may, at any time: access your memories (via your assistant or dashboard), delete some or all of them, and disconnect the connector. To make a request or ask about your data, contact colton.dyck@acryliccode.com. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA; we honor applicable requests.

10. Logging and security

We operate on Cloudflare and Supabase infrastructure with encrypted transport. We restrict access to production data. Our operational logs record metadata (timestamps, tenant IDs, tool names, error codes) and exclude the body content of your memories. We authenticate every request and enforce per-user isolation on every database operation.

11. Children

Vibe Memory is not directed to children under 16 and we do not knowingly collect their data.

12. Changes to this policy

We may update this policy; we will revise the effective date and, for material changes, provide notice through the service.

13. Contact

Acrylic Code Inc. — colton.dyck@acryliccode.com.