memex privacy policy
Effective 14 September 2026.
memex is a private vault that runs entirely on your Android phone.
Nothing you keep in memex is ever collected. There is no account, no server, no analytics service and no advertising. Nothing you keep in memex — not a note, a picture, a document, a recording, a password, a search or a page you saved — is ever transmitted to us or to anyone else, because there is nowhere for it to be transmitted to: memex’s own code has no way to send it. Uninstalling the app removes everything it holds.
One component reports on itself, and it is not ours. Reading the words off a picture or a PDF uses Google’s ML Kit, which runs entirely on your device. Your images and the text in them are never sent to Google. The library does send Google diagnostic metrics about its own operation, and Google provides no way to switch that off, so it is described in full under ML Kit diagnostics below. We tell you because Google’s terms require it and because the alternative is a claim that is not true.
What memex stores, and where
Section titled “What memex stores, and where”Everything you keep — notes, pages, spreadsheets, links, saved web pages, photographs, PDFs, recordings, passwords and the tags on them — is stored in the app’s own private storage on your device. No other app can read it and it is never uploaded.
The records live in a SQLite database encrypted page by page with SQLCipher. Files — pictures, documents, recordings — are encrypted with AES-GCM before a byte is written. The keys are held in the Android Keystore, and where you have a fingerprint or face enrolled the operating system releases them only after it has checked it is you. Android is told not to include any of it in its own backups.
We cannot read any of it. We do not hold a key, a copy or a recovery route: if you lose the device and have not made your own backup, the contents are gone, and nobody — including us — can restore them.
When memex uses the internet
Section titled “When memex uses the internet”memex’s own code makes network requests in exactly two situations, both of which you start, and neither of which sends anything about you or your vault. A third path belongs to a Google library inside the app and is described under ML Kit diagnostics below.
The built-in browser fetches the web pages you ask it to, the way any browser does. Those websites see your IP address and whatever your request tells them, the same as if you had visited them in Chrome. memex adds nothing of its own to those requests, does not track what you visit, and blocks requests to known tracking domains using a list stored inside the app. You can choose in Settings whether the browser keeps cookies and sign-ins between sessions.
Optional model downloads. Transcription and meaning search are extra
capabilities you can switch on in Settings. Turning one on downloads a machine
learning model from Hugging Face (huggingface.co, and the content delivery
network it redirects to) over HTTPS, from a fixed address written into the app
— memex cannot be pointed at any other. That request tells Hugging Face that
some device asked for a public file; it carries nothing about you or your
vault, and every file is checked against a checksum written into the app
before any of it is used. Nothing is downloaded until you tap. Once
downloaded, the model runs on your phone, and the text, speech and searches it
processes never leave it.
Those two are the whole of memex’s own network code. An automated check runs on every build and fails it if anything else in the app reaches for the network, which is why the list is short and stays short. That check reads source, so it cannot see inside a compiled library — which is exactly why ML Kit gets a section of its own below rather than a footnote.
When something leaves your device, it is because you sent it
Section titled “When something leaves your device, it is because you sent it”Three things can leave, and each one is an action you take deliberately:
- A backup. You choose the destination yourself through Android’s file picker. What is written there is a single encrypted file, sealed with a passphrase you choose and that the app never stores. Nothing is uploaded; we never see it.
- A sealed envelope. One or more items, encrypted under a one-time code shown to you once, shared through Android’s share sheet to whoever you choose. Again: ciphertext, and we never see it.
- A pack of text for an AI assistant. Plain words that you select, handed to whichever app you choose through the share sheet. Pictures, files, passwords and anything marked sensitive are never included. memex sends nothing itself — it hands the text to the app you pick, and that app’s own privacy policy governs what happens next.
memex keeps a private record inside your vault of what you shared and when. That record never leaves your device.
Permissions
Section titled “Permissions”- Camera — only while the in-app camera is open. A photograph goes from the sensor into the encrypted vault without being written to a file.
- Microphone — only while you are recording. Recordings are encrypted in memory and never written out as an ordinary file.
- Biometrics / device lock — used only to release the key that opens your vault. memex never receives your fingerprint or face data; Android performs the check itself.
memex does not request location, contacts, or access to your photo library beyond the single picture you pick through Android’s own photo picker.
Children
Section titled “Children”memex is not directed at children. It includes a general-purpose web browser that can reach any website, so it is not suitable for children and is not offered in Google Play’s family programmes.
ML Kit diagnostics
Section titled “ML Kit diagnostics”memex reads the words out of your screenshots and PDFs, and scans the codes in them, using Google’s ML Kit, bundled into the app and running on your device. This is the one component in memex that sends anything to a third party, so it is set out here in full.
What never leaves. Your pictures, your documents, the text recognised in them and the codes read out of them. ML Kit processes all of it on the device; Google states that it “does not send that data and the resultant outputs to Google servers.”
What does leave. ML Kit sends Google diagnostic and usage metrics about its own operation, over HTTPS. Per Google’s published disclosure, that is:
- device information — manufacturer, model, OS version and build, and which hardware accelerators are present
- application information — memex’s package name and version
- a per-installation identifier, which Google states is not unique to a user or a device
- performance metrics such as latency
- the configuration of each call — image format and resolution, input and output sizes
- the ML Kit feature and version used, the kind of event (initialisation, detection, release) and any error codes
Google states that it uses this for diagnostics and usage analytics, and that it is not transferred to third parties. Google provides no way for an app to disable it, so memex cannot offer you a switch for it. The one thing memex can do is tell you, which is what this section is.
Google’s handling of that data is governed by Google’s privacy policy and the ML Kit terms.
Other diagnostics
Section titled “Other diagnostics”memex contains no crash-reporting or analytics service of its own. If the app fails to start it shows the reason on screen, and keeps a copy in its own private storage so it can show it on the next launch; that file is readable by no other app and is deleted when it has been shown. It is never sent anywhere.
Google Play collects anonymous crash and performance data for every Android app, including this one, under Google’s own privacy policy. We see only aggregated technical reports through that; they contain no vault contents.
Deleting your data
Section titled “Deleting your data”All of your data is on your device. Uninstalling memex deletes it. Inside the app, individual items can be deleted permanently, and a vault that cannot be unlocked can be erased outright from the lock screen. There is no server-side copy to request the deletion of, because there is no server.
Changes
Section titled “Changes”If this policy changes, the revised version will be posted at this address with a new effective date. Because we hold no contact details for you, we cannot notify you directly — the date at the top is the record.
Contact
Section titled “Contact”Email: blumrry@proton.me
Developer: thinkingmachinelabsdev