Privacy Policy

Last updated: October 18, 2026.

This policy covers the hosted durmem limited public test, operated by Durmem LLC. It does not replace the policies of an operator running a self-hosted deployment.

What we collect

When you request access or sign in, we collect your email address, sign-in metadata and basic server logs needed to run and protect the service. If you choose Google sign-in, we receive the account information needed to authenticate you.

We use a third-party bot-protection service to help prevent automated abuse. It may receive browser and network signals needed to perform the check.

If you use a hosted durmem store, we store the memory content, facts, task evidence, store names, usage labels, and configuration details you or your agents add to that store.

How we use it

We use account information to manage access, contact you about your account, operate hosted stores, troubleshoot problems and prevent abuse.

We do not use your hosted memory content for anything other than providing the service to you. That means: storing the facts you save, answering your agents' queries, coordinating task state, and returning the context your connected tools request. The one exception is debugging: if you report an issue or the service errors, we may inspect the relevant data to diagnose and fix the problem. We do not read, analyze, sell, or use your hosted memory content for advertising, marketing, analytics, product improvement, or training any model.

Hosted-store access and encryption

Hosted stores are encrypted at rest and in transit. They are not end-to-end encrypted. durmem needs server-side access to hosted store content so the service can answer your agents' queries and operate shared memory features.

If your organization needs a strict zero-trust boundary where the service operator cannot access memory content, use a self-hosted deployment.

Retention and deletion

We may delete a hosted account and its stores after 30 days from sign-up or its most recent qualifying use, whichever is later, if it has never saved a memory. Starter examples do not count as saved memories. If an account has saved a memory, we may delete the account and its stores after 90 days without qualifying use. Qualifying use means a recorded read or write through a hosted store; it resets the clock. We send warning emails before deletion and include the planned date. If we cannot confirm eligibility or the required warnings, we do not automatically delete. Deletion includes hosted stores and their saved memories. Keep your own copies of anything important.

durmem records hosted accounts’ last-read and last-write dates in its account administration store and uses account creation and those last-use dates to apply this policy. Where eligibility or notice cannot be established, we do not automatically delete. Some limited operational, security, and legally required records, and older backup copies, may remain as described elsewhere in this section.

We will help you export, correct or delete your data on request by email. We may verify your identity first; these requests are handled manually, not through an export command.

We keep short-lived operational logs for security and troubleshooting. Apart from the inactive-account deletion described above, cleanup of account-administration, access-request and operational records is operator-managed; there is no guaranteed automatic 30-day deletion of those records. Limited records may remain where needed for legal obligations, security or abuse prevention. System journal entries expire under the host's journal policy rather than being selectively rewritten.

Terminal provisioning result files are eligible to be removed after 1 hour. Cleanup is best-effort and runs during later result polling, so files may remain longer.

We make nightly backups on the same server, kept for up to 7 days where storage allows, so we can recover from our own mistakes or a failed upgrade. They are stored inside your encrypted storage, and older ones are dropped first when space is short. They are not a guarantee and do not protect against losing the server itself, so keep your own copies of anything important. Deleting a store also deletes its backups. Any older encrypted backup copies are not rewritten in place and remain until we remove them.

Sharing

We do not sell your data, and we do not share your hosted memory content with third parties except the infrastructure providers strictly necessary to run the hosted service (e.g. hosting/storage), who have no independent right to use it. We may disclose account information (not hosted memory content) when required to comply with law, protect the service, or prevent abuse.

Hetzner provides hosting. Resend delivers service emails and processes the recipient address and email content for that purpose. Google processes sign-in information if you choose Google sign-in. If bot protection is enabled, its provider may receive browser and network signals needed for the check. These providers process the information needed for their role; this does not give them permission to use your hosted memory for their own purposes.

Security and notices

No service can guarantee complete security. If a security incident affects your data, we will notify affected users without undue delay and as required by law.

We will announce material policy changes and a pause or end of the test on the site and by email to your account address, with reasonable notice where we can. Pausing sign-up because the test is full needs no notice.

Contact

Send questions or requests to access, export, correct or delete your data to info@durmem.ai.