Privacy Policy
Last updated October 23, 2026
This policy explains what OwlMem collects, why, who else handles it, and the choices you have. OwlMem is operated by an individual based in Ontario, Canada, who is responsible for your personal data and is the person you reach at the address below. Contact: [email protected].
What we collect
| Data | What it is | Why |
|---|---|---|
| Account | Email address, space name, members, plan | Sign-in, running your space, billing |
| Sign-in and tokens | One-time sign-in links and agent tokens, stored only as hashes; a session cookie | Authentication |
| Your content | Knowledge documents, memories, settings you choose | Providing the service |
| Vault | Encrypted items we cannot read; item names, descriptions, versions and an access log in plain text | Storing and controlling access to your vault |
| Approval methods | Passkey public keys, your authenticator secret, your GitHub account ID and username if you link GitHub | Approving agent access to the vault |
| Technical | IP addresses and timestamps of sign-ins, agent requests and console actions | Security, abuse prevention, rate limits, troubleshooting |
| Billing | Stripe customer and subscription IDs, plan and status. Card details go directly to Stripe; we never see them | Payments |
| Usage | Counts such as storage used, memory writes and agents | Plan limits and the usage shown to you |
We do not use advertising or analytics trackers, and we do not sell or rent personal data.
How we use it
Only to provide, secure and improve OwlMem, to bill you, and to contact you about your account (sign-in links, billing, security notices, changes to these policies). We do not use your content to train AI models. Where the GDPR applies, our legal bases are performing our contract with you, our legitimate interest in keeping the service secure, and legal obligations (for example tax records).
Who else handles data
| Provider | Role | Data involved |
|---|---|---|
| Cloudflare | Network, TLS and DDoS protection in front of our servers | All traffic passes through it in transit |
| Stripe | Payments and invoices | Email, billing details, payment method |
| Zoho Mail | Sending sign-in and account emails | Email address, message content |
| Ollama (Ollama Cloud) | Language model that turns text you save as memories into searchable facts | The text of memories your agents save — not documents, not the vault |
| GitHub | Only if you connect a repository or link GitHub for vault approvals | Your knowledge base (sync); your GitHub ID (approvals) |
| Google Fonts | Fonts on our web pages | Your IP address when your browser loads the fonts |
We may disclose data if the law requires it, and will tell you unless we are legally prevented. If OwlMem is sold or merged, this policy continues to apply to your data.
Where data is stored
Your content, account and vault data are stored on servers we operate in Canada. The providers above may process data in other countries, including the United States, under their own safeguards (such as standard contractual clauses).
How long we keep it
- Account data and content: while your space exists. After you close it, we delete it within 30 days.
- Backups: daily, kept for 30 days, so deleted data disappears from backups within 30 days.
- Sign-in links expire after 15 minutes. Expired memories are invalidated automatically on the date you set.
- Access and audit logs: up to 12 months.
- Billing records: as long as tax law requires.
Security
Traffic is encrypted in transit. Tokens and sign-in links are stored only as hashes. Each space's knowledge base is a separate repository, and every request is checked against the space it belongs to. Vault items are end-to-end encrypted with AES-256-GCM using a key only you hold. No system is perfectly secure; if a breach affects your personal data, we will notify you without undue delay.
Cookies
We set one cookie, om_s, which keeps you signed in to the console. It is essential, HttpOnly and not used for tracking. We use no other cookies.
Your rights
You can see, export, correct and delete your content yourself in the console or through your agents. You can also email us to access, correct, export or delete your personal data, or to object to or restrict how we use it; we answer within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada, or, if you are in the EU, UK or another region with data-protection law, to your local authority. California residents: we do not sell or share personal information for cross-context advertising.
Children
OwlMem is not meant for anyone under 16, and we do not knowingly collect their data.
Changes
We will post changes here and update the date above. For material changes we will email account owners at least 30 days in advance.