Privacy Policy

Last updated: 15 July 2026

Who We Are

POWER MEMORY ("we", "us") is a Memory as a Service platform operated from the United Kingdom. We provide AI memory vaults that let you store, organise, and retrieve personal context across Claude, ChatGPT, and Grok surfaces via MCP (Web, Desktop, Android, iOS) and via our browser extension for Chrome and compatible browsers, which works on Google Gemini, Microsoft Copilot, and Perplexity.

Contact: contact@powermemory.ai

Data Controller: POWER MEMORY is the Data Controller for account data (email, hashed API keys). You are the Data Controller for the memory content you store in your vault; we act as Data Processor on your behalf.

Jurisdiction: Infrastructure is hosted in the European Union (Germany). POWER MEMORY is registered with the UK Information Commissioner's Office (registration number ZC124021).

Relationship to AI providers: POWER MEMORY is an independent third-party service. We are not affiliated with, endorsed by, or sponsored by Anthropic, PBC or any other AI provider. "Claude" is a trademark of Anthropic, PBC.

What We Collect

We collect the minimum data needed to provide our service:

✓
Email address — used for authentication via magic link. We do not collect your name, phone number, physical address, or any other personal identifiers.
✓
Memories — text content you choose to store in your vault. You control what goes in and what gets deleted.
✓
API keys — hashed cryptographic keys for MCP access. We store only the hash, never the full key.
✓
Terms acceptance records — when you accept our Service Notice, we record the notice version, the time of acceptance, your browser's user-agent, and a truncated cryptographic hash of your IP address (which cannot be reversed to identify you), solely as evidence of the agreement. Retained for the life of your account plus 6 years.
✓
Feedback submissions — if you use our contact form, we store your message, the reply email you optionally provide, and technical details (your browser’s user-agent and a truncated one-way hash of your IP address) to provide support and prevent abuse. Your feedback is also emailed to our admin inbox through Resend, our email provider.

What We Do NOT Collect

✗Names, phone numbers, or physical addresses
✗Payment information (free tier only at this time)
✗Analytics, tracking pixels, or third-party cookies
✗IP addresses for profiling or advertising
✗Browsing history or device fingerprints

How We Protect Your Data

Your memories are encrypted at rest using SQLCipher (AES-256 encryption). All connections use TLS 1.2+ (HTTPS). API keys are stored as SHA-256 hashes — we never store the original key. Session tokens are HTTP-only, secure cookies with strict SameSite policy.

Third-Party Services

We use three third-party services:

Resend (email delivery) — processes your email address solely to deliver magic link authentication emails. Region: EU (Ireland). Resend Privacy Policy.
Contabo GmbH (infrastructure hosting) — provides the servers where your encrypted memory vault is stored. Region: EU (Germany). Data is encrypted at rest; Contabo does not have access to unencrypted vault contents. Contabo Privacy Policy.
Cloudflare, Inc. (edge CDN, DDoS protection, DNS) — processes HTTP request metadata (IP, user-agent) to protect our infrastructure from attacks. No memory content transits Cloudflare in unencrypted form. Region: Global. Our contact form also uses Cloudflare Turnstile, an anti-bot check: when you submit feedback, your IP address is sent to Cloudflare to confirm you are human. Cloudflare Privacy Policy.

We do not use Google Analytics, Facebook Pixel, or any advertising or tracking services. We do not sell, share, or trade your data with anyone.

Ask Your Vault (optional, bring-your-own-key)

Ask Your Vault is an optional, opt-in feature currently in limited Labs testing with a small allowlist; it is not yet available to all users. This section describes how it works so you can understand it before it reaches you; if it is not enabled for your account, nothing described here happens.

Ask Your Vault lets you ask a question and have an AI model answer using memories from your own vault. It works only with an AI API key you supply (your own OpenRouter key). When you use it, this is a transfer you direct, on your own key: PowerMemory facilitates the request — we are not a data processor for the AI inference itself, and we have no control over how the third-party model or its provider handles the content once it is sent. It is read-only — it can never add to, change, or delete anything in your vault.

Where your data goes. The memories you select as scope, plus your question, are sent from our server to OpenRouter (openrouter.ai), which routes the request onward to the AI model provider you choose. Depending on the model and provider you select, this may involve processing in the United States or other countries outside the UK and EU. You choose the model, and by choosing the model you choose the provider.

Zero-data-retention routing (default on). By default we request zero-data-retention (ZDR) routing from OpenRouter, so the request is directed only to providers that have agreed not to retain it. If you knowingly select a model that has no ZDR route, you can turn ZDR off for that request — that is your explicit, informed choice, and we warn you before you do.

A secret safety-net. Before your selected memories are sent — and again on the model's reply — we automatically scan for content that looks like an API key, token, or credential. If we detect one, that request is blocked: nothing is sent, or the answer is withheld, and you are asked to remove the secret first. This is an automated safety net, not a guarantee; you remain responsible for what you put in scope.

What is never sent. Only the memories you put in scope leave — never your whole vault, never another user's data, and never memories that are deleted, superseded, archived, stale, or in your trash. The AI model receives temporary reference labels for your memories, not their permanent identifiers.

Your key, and no transcripts. The API key you supply is held only in memory for your session in order to make the request — we never store it, and it is discarded when you log out or the session ends. We do not keep server-side transcripts of your questions or the answers; our own logs record only counts (which scope, which model, token counts, cost) — never the content and never your key.

Two ways to connect your key. You can connect your OpenRouter key in two ways: paste it, or authorize PowerMemory on OpenRouter ("Connect OpenRouter"). If you authorize, OpenRouter creates a new API key on your account and sends it to our server; we hold it exactly as we hold a pasted key — in memory, for your session, never written to disk. That key remains yours and stays on your OpenRouter account: clearing it here only makes us forget it. To destroy it, delete the key that OpenRouter created for PowerMemory at openrouter.ai/settings/keys (it will carry our name; Ask Your Vault shows you its exact label once you have connected). OpenRouter's authorization screen offers an optional credit limit — we cannot set it for you, and if you leave it blank your key may have no spending limit. We check after connecting and tell you which it is.

The honest limit. Once content is sent on your key to OpenRouter and the provider you selected, we cannot control what they do with it — their retention and handling are governed by their terms, not ours. Treat Ask Your Vault as a transfer you initiate, like exporting data to a third party of your choosing. We do not claim your data "never leaves your control": it leaves, at your direction, to the provider you pick.

For a plain-language walkthrough, see Ask Your Vault (privacy explainer).

Cookies

We use a single cookie:

session — a JWT authentication token. HTTP-only, Secure, SameSite=Lax. Expires after 7 days. No tracking, no analytics, no third-party cookies.

Your Rights (GDPR)

Under UK GDPR, you have the right to:

Access — view all memories stored in your vault via the dashboard or MCP API.
Delete — remove any or all memories at any time. Delete your account from your dashboard (Security → Danger zone), or by emailing us.
Export — retrieve all your data via the MCP API (memory_read).
Rectify — edit memories by deleting and re-creating them.
Object — contact us to object to any processing.

To exercise any right, email contact@powermemory.ai. We respond within 30 days.

Data Retention

Your memories are stored until you delete them. Magic link tokens expire after 15 minutes and are marked as used. If you delete your account, all data is permanently removed after a 14-day grace period — and in any event within 30 days.

Children

POWER MEMORY is not intended for children under 16. We do not knowingly collect data from children.

Browser Extension (Chrome & Compatible)

The PowerMemory browser extension is an additional client surface that connects to the same vault as our web app. When you install and authorize the extension, the following applies in addition to the policies above:

What the extension stores locally (chrome.storage.local)

  • pm.auth — your access token, encrypted with AES-GCM (v2 envelope). Refresh tokens are stored encrypted only if your authorization granted them.
  • pm.last_saved — timestamp and ID of your most recent memory save, used to display confirmation states.
  • pm.last_seen — per-category timestamps for "NEW badge" tracking. Local-only triage state.
  • pm.acknowledged_ids — list of memory IDs you have manually acknowledged via the ✓ button. Local-only flag, never sent to the server.

No analytics, no fingerprinting, no telemetry. The extension does not collect or transmit data beyond what you explicitly trigger (save a memory, inject a memory, request your vault).

AI platforms the extension runs on

The extension injects a small UI (Save button + side panel) into the following AI chat platforms when you visit them: Google Gemini, Microsoft Copilot, and Perplexity. The extension reads page content (selected text, input draft, or the most recent AI response) only when you explicitly trigger a save — there is no passive monitoring, scraping, or background collection. Claude, ChatGPT, and Grok are reached separately via MCP connectors, not via this extension.

Authentication

The extension authenticates via OAuth 2.1 with PKCE (no client secret, no password handling). Your token is bound to your PowerMemory account; revoke at any time from your dashboard.

Permission justifications

  • alarms — Keep the service worker alive long enough to refresh authentication tokens.
  • storage — Local encrypted token cache and UI state.
  • identity — Run OAuth 2.1 PKCE flow via chrome.identity.launchWebAuthFlow to authorize the extension against your PowerMemory account. Only the powermemory.ai/oauth/* endpoints are contacted.
  • host_permissions for gemini.google.com, copilot.microsoft.com, and www.perplexity.ai — Inject the UI on those pages and read page content only when you click Save.

Distribution

The extension is distributed via the Chrome Web Store. We do not receive analytics from the Chrome Web Store beyond aggregate install counts.

Changes

We may update this policy. Material changes will be communicated via email to registered users. The "last updated" date at the top reflects the latest version.

California Consumer Privacy Act (CCPA)

If you are a California resident, you have the following rights under the CCPA:

  • Right to Know: You may request what personal information we collect, use, and retain about you.
  • Right to Delete: Delete your account from your dashboard (Security → Danger zone), or by emailing us. Subject to legal retention exceptions.
  • Right to Opt-Out of Sale: We do not sell personal information to third parties. There is nothing to opt out of.
  • Right to Non-Discrimination: We will not deny service, charge different prices, or provide a different quality of service because you exercised your CCPA rights.

To exercise these rights, contact us using the email or postal address in the Contact section.