Privacy Policy
Version 1.0. Effective 2026-10-20.
loremem is run by an individual developer, who is the controller of the personal data described here. Contact: l1106842466@gmail.com.
1. What we collect
- Account data. Your email address, display name and password hash. If you sign in with GitHub, Google or LINUX DO, we also receive your account ID, name, email address and avatar from that provider.
- Your content. Memories, skills, project settings and secrets that you or your agents store.
- Usage records. Sign-in sessions with IP address and browser user agent. Records of which API token and agent type made each change to your memories. Each read of a secret, with the API token used and the time.
- Agreement records. Which version of these terms and this policy you accepted, when, and from which IP address and user agent.
- Public site measurement. On loremem.com:
- Cloudflare Web Analytics measures page traffic and performance.
- Google Analytics loads only after you accept analytics, and it is currently not enabled.
- Your analytics choice is stored in the cookie
loremem_analytics_consentfor one year.
2. Why we use it
| Purpose | Legal basis |
|---|---|
| Running the service: signing you in, storing and recalling your memories, running Dream, keeping backups | Performing our contract with you |
| Security and abuse prevention: session and access records, secret read logs | Our legitimate interest in keeping the service and your data safe |
| Showing that you accepted the terms | Our legitimate interest in keeping evidence of the agreement |
| Public site analytics | Cloudflare traffic measurement: legitimate interest. Google Analytics: your consent. |
We do not sell your data. We do not use your content to train models. We do not use it for advertising.
3. Who processes it for us
- AI model providers. Search, recall and Dream send parts of your content to the third-party language-model and embedding providers we use. They process it to return results to us.
- Infrastructure. Our servers are in Hong Kong. Cloudflare provides DNS, network delivery and web analytics.
- Sign-in providers. GitHub, Google or LINUX DO, if you choose to sign in with them.
Some of these providers process data outside Hong Kong, including in the United States.
4. How long we keep it
- Account data and content: while your account exists.
- Session and access records: while your account exists, unless we delete them earlier.
- Agreement records: for as long as they may be needed as evidence, even after your account is deleted.
When you ask us to delete your account, we delete your account data and content within 30 days. Copies in backups are removed as those backups are rotated out.
5. Security
- Connections use TLS.
- Passwords are stored as hashes. API tokens are stored as hashes.
- Secrets are encrypted at rest with a key held by the operator.
- No system is perfectly secure. Part 12.1 of the Terms explains the specific risks of the Secrets feature.
6. Your rights
You can ask us to:
- give you a copy of your data;
- correct or delete it;
- restrict or object to how we use it.
Where we rely on consent, you can withdraw it at any time.
Write to l1106842466@gmail.com. We will reply within 30 days.
You may also complain to the data protection authority where you live.
7. Children
The service is not meant for anyone under 16. We do not knowingly collect their data.
8. Changes
This policy is versioned in the same way as the Terms:
- minor changes take effect when published;
- for major changes we ask you to accept the new version.