Privacy Policy
Effective date: 2025-01-01
Last updated: 2025-01-01
This Privacy Policy explains what data MemStrata (“we,” “us,” or “our”) collects when you use our software and services. The short version: almost everything stays on your machine.
1. What we do not collect
Section titled “1. What we do not collect”We do not collect, transmit, or have access to:
- Your source code
- Your AI prompts or conversations
- AI responses from your LLM provider
- Your file paths or directory structure
- Your API keys for LLM providers
- Any personally identifiable information beyond what Stripe collects for billing
This is not a policy aspiration — it is an architectural constraint. The MemStrata harness runs on localhost and does not have a pathway to send code or prompts to our servers.
2. What we collect
Section titled “2. What we collect”2a. Subscription and billing data (via Stripe)
Section titled “2a. Subscription and billing data (via Stripe)”When you subscribe to Pro or Pro+, Stripe collects your payment information, email address, and billing details. We receive from Stripe:
- A Stripe customer ID (opaque token)
- Subscription status (active, trialing, cancelled)
- Billing cycle dates
We do not receive your full credit card number. Stripe’s privacy policy governs Stripe-collected data.
2b. License verification data
Section titled “2b. License verification data”On each MemStrata startup, the client sends a signed JWT to memstrata.dev/lic containing:
| Field | What it contains | Notes |
|---|---|---|
sub_id | Opaque subscription identifier | Not your email |
hwid_hash | HMAC-SHA256 of machine fingerprint | Salted per-license; not reversible to raw hardware IDs |
exp | JWT expiry timestamp | Short-lived |
ver | MemStrata version string | For compatibility checks |
The license server returns a validity response and logs the sub_id and timestamp for abuse detection. Raw hardware identifiers are never stored.
Retention: License verification logs are retained for 90 days, then deleted.
2c. Optional: anonymous capture failure events
Section titled “2c. Optional: anonymous capture failure events”If the browser extension fails to capture a session (e.g., the AI provider changed their DOM), MemStrata can report:
| Field | What it contains |
|---|---|
provider | Provider name (e.g., claude.ai) |
timestamp | UTC timestamp of the failure |
No message content, no user identity, no session ID. This is opt-out. Disable it in Settings → Privacy → “Report capture failures.”
Retention: Aggregated and deleted within 30 days. Used only to prioritize extension compatibility fixes.
3. Local-only data (not transmitted)
Section titled “3. Local-only data (not transmitted)”The following data is generated and stored locally on your machine and is never sent to us:
| Data | Location |
|---|---|
| Codebase graph and AST index | ~/memstrata/index.db |
| Telemetry and savings metrics | ~/memstrata/telemetry.db |
| Session history | ~/memstrata/sessions/ |
| Provider API keys | OS keychain |
You own this data entirely. Uninstalling MemStrata does not delete it (so your data persists across reinstalls). To delete it, run memstrata purge --all or delete the ~/memstrata/ directory manually.
4. Third-party services
Section titled “4. Third-party services”| Service | Purpose | Their privacy policy |
|---|---|---|
| Stripe | Subscription billing | stripe.com/privacy |
| Vercel | Website hosting | vercel.com/legal/privacy-policy |
| Plausible | Anonymous website analytics | plausible.io/privacy |
Plausible is used for website analytics only (memstrata.dev). It does not use cookies, does not fingerprint users, and does not share data with third parties.
5. Your rights
Section titled “5. Your rights”You may at any time:
- Request deletion of your server-side data by emailing privacy@memstrata.dev with your subscription ID. We confirm deletion within 48 hours. (There is very little to delete — primarily license verification logs.)
- Export your local data at any time; it’s plain SQLite files you own.
- Opt out of capture failure reporting in Settings → Privacy.
- Cancel your subscription at any time via the Stripe Customer Portal.
6. Data retention
Section titled “6. Data retention”| Data type | Retention |
|---|---|
| License verification logs | 90 days |
| Capture failure events (optional) | 30 days, aggregated |
| Stripe billing records | Per Stripe’s retention policy (7 years for financial records) |
| Local telemetry files | Indefinite; on your machine; under your control |
7. Security
Section titled “7. Security”License server communications use TLS 1.3. JWTs are signed with RS256. The license server is deployed on Cloudflare Workers with no persistent storage of raw hardware identifiers.
To report a security vulnerability: security@memstrata.dev (PGP key available on our GitHub repo).
8. Changes to this policy
Section titled “8. Changes to this policy”Material changes will be communicated by email (to the address on your Stripe account) and by updating the “Last updated” date above. We will not retroactively change how we handle data already collected without notice.
9. Contact
Section titled “9. Contact”Privacy questions: privacy@memstrata.dev