Privacy policy

What we collect and why

Identity and access

You sign in with an email address — either a password or a magic link/one-time code. We don't offer or require social login, so no identity data flows to Google, GitHub, or Apple. Your email address and optional display name are stored with your account (Supabase Auth).

When you connect an AI assistant (Claude, Claude Code, or another MCP client), it authenticates through memsprout's own OAuth 2.1 server — the client never sees your password. We record each connection (which client, when connected, when last used) so you can review and revoke access. We do not record IP addresses or device fingerprints for these connections.

Content you store

Memories are the product: free-text content, optional title, tags, and metadata, plus their version history. To make search work, we generate a vector embedding of each memory, and for untitled/untyped memories an AI model extracts light metadata (people, action items, dates, keywords, a type) — see "How AI processing works." Files you attach (images, audio, video, documents) are stored with technical metadata (file type, size, dimensions, a content hash) and, for AI-generated files, the generation recipe (prompt, model, parameters).

Team and sharing data

Spaces have members with roles (owner, editor, viewer); organizations have a seat ledger. Inviting a teammate stores their email address with the invitation until it's accepted or expires (expired invitations are purged nightly). Anything you put in a shared space is visible to that space's members, including provenance — who captured it and when.

An activity log records actions in shared contexts. Log entries include the actor's name and email and, for untitled memories, a short excerpt (~80 characters) of the content, visible to people who already have access to that space.

Billing information

Paid plans are billed through Stripe. Your card details go directly to Stripe and never touch our servers; we store the Stripe customer and subscription identifiers and your seat count.

Technical data and cookies

We set first-party cookies only: your sign-in session (Supabase Auth cookies) and a theme preference (ms-theme, also mirrored in localStorage). We run no analytics, no trackers, and no advertising cookies. Fonts and assets are served from our own domain — visiting memsprout triggers no third-party requests from your browser.

Voluntary correspondence

If you (or your assistant, at your explicit request) file a bug report, the title, description, and steps you provide are posted to our GitHub issue tracker. Email you send to support, and messages via the contact form (delivered via Resend), are retained so we can help you.

How AI processing works

Three things — and only these three — send memory content to an AI provider. All of them route through OpenRouter to OpenAI models:

1. Search embeddings. When a memory is stored or updated, its text is embedded (currently with OpenAI's text-embedding-3-small) so that search works. Search queries are embedded the same way.
2. Metadata extraction. For memories without an explicit type, the text is sent to a small language model (currently GPT-4o mini) to extract people, action items, dates, keywords, and a type. Setting an explicit type skips this.
3. Topic assignment. In spaces, if no existing topic fits, a short excerpt is sent to the same model to propose a topic name.

Attached files are never sent to AI providers; only memory text is.

Our AI providers process this content to return results; per our provider settings and OpenAI's API terms, it is not used to train models.

Your AI assistant reads and writes memories on your behalf via MCP — what your assistant captures is stored and processed exactly like what you type yourself, and is labeled with its origin.

Third-party services (subprocessors)

We share data with these providers only as needed to run memsprout. We do not sell or rent personal data.

Where your data lives

memsprout runs on Supabase infrastructure hosted on AWS in the United States. If you use memsprout from outside the US, your data is transferred to and stored in the US.

How we secure your data

All traffic is encrypted in transit (TLS), and data is encrypted at rest (AES-256) by our infrastructure provider, which is SOC 2 Type 2 and ISO 27001 certified. Access control is enforced at the database layer with row-level security — space membership and roles are checked on every query, not just in the app. MCP clients hold scoped OAuth tokens you can revoke at any time.

Retention and deletion

When you delete a memory, it immediately disappears from the product and from your assistant's reach, along with its version history and attached files (files still referenced by other memories are kept until their last reference is gone; orphaned files are cleaned up nightly). Deleted content is currently retained in our backend rather than immediately destroyed.

Expired invitations and expired sign-in artifacts are purged nightly.

To delete your account and all associated data, email support@memsprout.com and we'll complete the deletion within 30 days.

Your rights

You can access and export your content at any time through the product or your connected assistant. You may request a copy, correction, or deletion of your personal data by emailing support@memsprout.com. We honor these rights for everyone, not just where a specific law (GDPR, CCPA, or a state privacy law) requires it. We verify requests against your account email.

Changes and questions

We'll note material changes here with an updated date. Questions: support@memsprout.com.