# memex pro privacy policy **Effective 5 October 2026.** memex pro is a private vault that runs on your own devices: your Android phone, and the phones, tablets, computers and browsers you add to it. It can share what you choose with other people and with AI assistants. **What you keep stays on your devices.** There is no account, and your vault is not kept on any server of ours. Your devices keep each other in step, directly or through our switchboard, and what they exchange is sealed end to end, so only your own devices can read it. Beyond that, what you keep leaves your devices only when you share it, and only for whoever you share it with. **We run a switchboard, and this page says exactly what it sees.** It introduces your devices to each other and to the devices of the people you share with, and passes along what they cannot exchange directly. It never holds a key to anything you keep. What it does keep (a few identifiers, the sealed pages of your recent changes on their way between your devices, which it cannot open, and a short log that names no one) is listed under [What the switchboard sees, and what it keeps](#what-the-switchboard-sees-and-what-it-keeps), with how long each is kept. **One thing leaves readable, and only once you approve it.** If you connect an assistant in the cloud, such as Claude, its questions and your devices' answers pass through the switchboard readable on their way, and the switchboard stores neither. See [An assistant in the cloud](#an-assistant-in-the-cloud). **Google is told a little, and never your content.** Two Google libraries inside the app report on themselves: the one that reads the words off pictures, exactly as it does in the free memex app, and the one that sells a subscription through Google Play. And if you ask to be told when somebody writes to you, Google's push service carries a notice to your phone, sealed so that only your phone can read it. All three are set out below. ## What stays on your devices Everything you keep (notes, pages, spreadsheets, links, saved web pages, photographs, PDFs, recordings, passwords and the tags on them) is stored on the devices you chose to hold it. On an Android phone, the records live in a SQLite database encrypted page by page with SQLCipher. Files (pictures, documents, recordings) are encrypted with AES-GCM before a byte is written. The keys are held in the Android Keystore, and where you have a fingerprint or face enrolled the operating system releases them only after it has checked it is you. Android is told not to include any of it in its own backups. A device you add is handed the keys your devices share over a connection sealed between the two, and holds nothing until you choose what it holds: everything, or only the tags you choose. Hidden things go to a device only when you choose that on its page, after a check that it is you. A browser can be one of your devices (see [memex on the web](#memex-on-the-web)). So can a small computer you run yourself, a Home, which holds your memex on its own disk, sealed under a passphrase you choose, and keeps its own nightly backups there. Until it is linked, a Home shows its code on a page on its own network, which anybody on that network can open. We cannot read any of it. We hold no key, no readable copy and no recovery route: if you lose every device that holds something and have no backup, it is gone, and nobody, including us, can restore it. ## When memex pro uses the internet memex pro reaches the network in four ways. The first two are the free app's, unchanged. **The built-in browser** fetches the web pages you ask it to, the way any browser does. Those websites see your IP address and whatever your request tells them. memex adds nothing of its own to those requests, does not track what you visit, and blocks requests to known tracking domains using a list stored inside the app. **Optional model downloads.** Transcription and meaning search are extras you can switch on. Turning one on downloads a model from Hugging Face (`huggingface.co`, and the content delivery network it redirects to) over HTTPS, from a fixed address written into the app. That request carries nothing about you or your vault, and every file is checked against a checksum written into the app before any of it is used. Once downloaded, the model runs on your device. **The switchboard.** From the first time you add a device, connect with someone, share something, open a link or show My code, memex pro keeps a connection to the switchboard at `memex.thinkingmachinelabs.dev` while it is open. (A copy of memex pro installed from outside Google Play also keeps it for a few minutes after you leave while it hands your vault to a new device, and shows a notification while it does.) The connection is encrypted with TLS. A phone that never does any of those things never connects. You can choose a switchboard of your own instead (see [Your own switchboard](#your-own-switchboard)). What passes between your devices, and between yours and other people's, goes through the switchboard or directly from one device to the other. The next section says what the switchboard sees. **Direct connections.** When two devices can reach each other directly, they connect with WebRTC. To find that path, each asks a public STUN server how its network address looks from outside: by default Google's (`stun.l.google.com`) and Cloudflare's (`stun.cloudflare.com`). Those servers learn the device's IP address and nothing else. The other device learns it too. **On your local network.** While a code of this phone's is on the screen (to add a device, to join a memex, or My code), memex pro also listens on the Wi-Fi it is on, never on mobile data, so a phone in the same room can connect directly, even with the internet down. What crosses that connection is sealed under a key the code makes. While a phone shows its own code to join a memex, it also announces on that Wi-Fi that a phone is ready to join, under a random name with nothing about you or your memex in it; any device on that network can hear that much. Two more paths belong to Google libraries inside the app, not to memex, and are described under [ML Kit diagnostics](#ml-kit-diagnostics) and [Google Play Billing diagnostics](#google-play-billing-diagnostics). Being told that a newer memex pro is available is none of these: the app asks the Play Store app on your phone, over the phone's own wiring, and sends nothing for it. ## What the switchboard sees, and what it keeps We run the switchboard at `memex.thinkingmachinelabs.dev` on a server we rent from Hetzner Online in Germany. **While a device is connected**, the switchboard holds, for that device: a fingerprint and a public key, which the device made for itself and which identify that device and nothing else; which rooms it is in; and when it was last heard from. A room is your own devices, a share, a person you are connected to or an assistant, and its name is random. From which devices meet in a room, the switchboard can tell which devices belong to one memex, and which memexes are connected or share something, as fingerprints and never as names. It lets go of a device's rooms within minutes of its connection closing. It also sees the IP address each connection comes from, as any server does, and uses it, in memory, to limit how often one address may connect and ask. It forgets the address within minutes of its last request (within an hour, for an assistant's server registering itself), and never writes it down. **What passes through, and is not kept:** - The greetings two devices exchange before anything else: their public keys, and signatures over them. - The offers two devices exchange to find a direct path, which carry their network addresses. - When no direct path opens, the frames between two devices, sealed under a key the two made between themselves. The switchboard sees their size and timing, never what they carry. - If you connected an assistant in the cloud, its questions and your devices' answers, readable ([below](#an-assistant-in-the-cloud)). **Sealed pages between your devices.** Every change one of your devices makes goes to each of your other devices as a page of changes left at the switchboard: collected at once by a device that is connected, and waiting for one that is not. The page is sealed twice: under your vault's own keys, and again to a single-use key that only the device it is for holds and throws away once it has read it. With the page, the switchboard stores the fingerprints of the two devices, which of the sender's changes it covers (as numbers), when it was left, and its size, which is padded to one of three fixed sizes. A page is deleted as soon as the device it is for has collected it, and in any case 14 days after it was last written. For this to work, the switchboard also keeps, for each of your devices, the single-use public keys the device has published, which of your devices may leave pages for it and which key each was handed, how far it has read each one's changes, and, once the device has proved its key there, a mark saying so, so that nothing can connect in its name without that proof; these are forgotten 45 days after the device last connected. Every one of your devices takes part; there is no switch for it, except a device the others have not heard from for thirty days, which is left nothing until it is heard from again. Files never wait there. **Words between you and the people you are connected to** wait there the same way: what you write to somebody, and what they write back, is left as a sealed page for their devices when none of them is connected, sealed under a key only your two memexes hold and again to a single-use key, and deleted when collected or after 14 days. A device of theirs may leave a page for yours only by presenting a token both your memexes make from a secret they share; your devices give the switchboard a hash of one token for each person you are connected to, and leave it out once you disconnect or block them. With such a page the switchboard stores what it stores for any page: the two devices' fingerprints, when it was left and its size. It learns that a device left a page for another, never whose memexes they are or what was written. **The log, for a memex the switchboard keeps one for.** Beside the pages, every change one of your devices makes is written once as a sealed, numbered entry in one ordered log for your memex, and each of your devices reads the log from where it left off, whether or not any other device is connected. An entry is sealed under a key only your devices hold; the switchboard cannot open it. With each entry it stores the writing device's fingerprint, the entry's number, when it was written, and its size, which is padded. Entries are deleted 60 days after they were written at most, and the whole log the moment a device that can add devices asks for it. Hidden things never go on the log. To know which devices may read and write it, the switchboard also keeps the list of your memex's device fingerprints, sent by a device that can add devices and replaced whenever one does; the list is forgotten 60 days after it was last sent. **The membership log, for a memex whose devices keep one on our switchboard.** That log, for as long as the memex uses it: its devices' public keys, which parts of the memex each may open (by opaque identifiers), and when each was added or taken out, every change signed by one of the memex's own devices, kept in the clear and naming nothing anybody keeps; the keys a change hands those devices, each sealed to the device it is for, deleted 60 days after the change; and the memex's sealed log entries, 60 days at most. We hold no key that opens any of it. The membership log itself is answered to any device that proves its key, so that the people a memex is connected to can check which of its devices may speak for it; everything else only to the devices the log names. A membership log no device uses is deleted 30 days after it began, unless it names the key the memex was first known by, which the people it is connected to go on reading. Only a memex's own devices can add or take out a device, change what one can open, change the keys its log is sealed under, or speak for it; we can refuse to keep a change, never write one. **The log.** The switchboard writes a short operational log, used for nothing but keeping it running. It holds when the switchboard started, the errors it met (a request that failed on the switchboard's side is noted by its status and the error, never by who asked or for which page), and once an hour how many connections came from versions of memex too old to prove their key. No line in it holds an IP address, the address of a page, a device's fingerprint, a room, or anything anyone wrote. It is kept on that server, copied nowhere, never more than 30 MB, and started afresh each time a new version of the switchboard is deployed. The web server in front of the switchboard keeps no log of requests. **What the switchboard never holds:** - a key to anything you keep, or the secret that opens a share or a link: the part of a link after `#` never reaches it; - your records, files or words in readable form, except an assistant's questions and your devices' answers, which pass through and are not kept ([below](#an-assistant-in-the-cloud)); - an email address or a phone number. There are no accounts. **If you ask to be told when somebody writes**, your phone gives the switchboard the address Google's push service gave it, and the public half of a key your phone keeps for notices, both signed by the phone. The switchboard keeps them until 60 days after the phone last gave them, or until you turn notifications off, and counts how many notices it pushed to the phone in the last day, to cap them. When somebody you are connected to leaves words for your phone, their phone seals your notice (their memex's name and the first words of the line) to your phone's key, and the switchboard has Google push it; at most one every three seconds and 300 a day a device. Without a notice, a page left for a device that asked to be told may send it one word, at most every ten minutes, so it can collect what waits. The switchboard can read none of it. See [Notifications, and Firebase Cloud Messaging](#notifications-and-firebase-cloud-messaging). ## An assistant in the cloud You can add memex to an assistant you use on the web, such as Claude, or any other that can add memex by its address. Nothing is connected until you approve it from your phone: the assistant's page shows a code, you scan it with Connect, and you type the number that page then shows. Connecting shares nothing. The assistant reads only what you share with it afterwards: never a hidden thing or a secret, and never the rest of your vault. Its questions are answered live by one of your own devices that is online, from what you shared with it and nothing else; when none is online it is told so and gets nothing. The assistant's connection ends at the switchboard, so the switchboard can read its questions and your devices' answers on their way. It keeps neither. **What the company behind the assistant receives** is what you shared with the assistant, and whatever else you tell it, processed on its own computers under its own terms and privacy policy. **What the switchboard keeps while an assistant stays connected:** its registration (the name it gave itself and where its sign-in returns to), the room your devices answer it in, hashed forms of its tokens and of the key your devices answer with, and which of your devices answered there. When you disconnect the assistant, its tokens, its room and that list are deleted, and it is refused from then on. Otherwise they expire 30 days after the assistant last used them, and its registration 60 days after. Nothing you wrote is held there readable: the sign-in page only learns that you approved. An assistant you run yourself (memex-agent, or Claude Desktop with the memex extension) holds what you share with it on the computer it runs on, sealed under a passphrase chosen there. The assistant it serves reads it there and may pass it to the company that runs it, under that company's terms. ## What the people you share with receive **Connecting with someone.** Your code carries your memex's name, a fingerprint of its key and the secret of a room where your devices wait: nothing you keep. Whoever holds it can ask to connect. Connecting gives each side the other's name, and nothing either of you keeps. **Sharing.** A share gives them what you chose, in the form you chose (the name only, a preview, or everything in words, with pictures, documents and recordings only when you say so), for as long as you chose. While it is open it follows your edits. Hidden things and secrets never enter a share. They also see your memex's name, and whether one of your devices is online to serve the share. When somebody opens your link, you learn the make and model of the device that opened it (or, for a browser, the browser and platform); when you open theirs, they learn the make and model of yours, and never the name your own devices know it by. **Words.** What you write to someone, and a reply on a share, travels between your devices and theirs sealed so that only the devices it is for can read it. The switchboard carries it sealed and keeps none of it. **Taking it back.** Ending a share stops the next read and tells their connected devices to delete what they hold; a device of theirs that was away is told when it next asks, for a week after. Nothing can reach a copy already opened on hardware you do not control, and memex does not pretend otherwise. **Blocking.** Blocking someone disconnects you, takes back everything you shared with them, and from then on every device of your memex ignores their memex: a request from them is answered as if you had not seen it, and nothing they send reaches you. They are not told they were blocked. The block is a record on your own devices, kept in step between them like anything else, and the switchboard does not learn of it. Unblocking deletes it. **Reporting.** Report, on a person's page, opens your own mail app with a message to us naming their memex and its code, for you to add to and send. Nothing is sent by memex itself, and nothing from your vault goes with it. We receive what you send, your email address with it, and use them only to look into the report and answer you. ## memex on the web memex on the web, at `memex.thinkingmachinelabs.dev/app`, is memex pro in a browser, and it is one of your devices like any other. What it holds rests in that browser's own storage: **the records in the clear**, readable by anyone who can open that browser profile, and the files sealed under your vault's keys. Who you are connected to, what people shared with you, and small notes such as which replies you have read rest there the same way. If you download the meaning-search model there, it rests in the browser's cache. Notices from the browser appear only if you switch them on. A share link opened in a browser without memex keeps what was shared in that browser in the same way, until it is forgotten there or the share ends. Disconnecting a browser from your memex erases what it holds, and so does clearing the site's data. A browser may also clear it on its own when space runs short. ## Your own switchboard On your phone, Your memex, then Switchboard, lets you use a switchboard of your own instead of ours. What your devices exchange from then on goes through yours, and the section above describes yours rather than ours. A share is made against the switchboard chosen when it was made and stays there, and people who share with you use their own choice. ## Unlimited, and Google Play memex pro is free to download. If you subscribe to Unlimited, you buy it from Google Play, with the Google account you use there, under Google's terms. Google handles the payment: we never see your card or your Google account. Google tells memex pro on your phone whether the plan is active. Nothing about your vault goes to Google or to us for it. The Google Play Billing library inside the app reports on itself to Google; [Google Play Billing diagnostics](#google-play-billing-diagnostics) says what it sends and when. Google gives us, as it gives every developer, a record of each order: the order number, the plan, the price and the date, with the country of the billing address and, in most countries, its state or region, city and postal code. We use it for our bookkeeping, and to find your order if you write to us about it, and for nothing else. You can cancel any time in the Play Store, under Payments & subscriptions. What Google does with your payment is governed by [Google's privacy policy](https://policies.google.com/privacy). ## Permissions - **Camera**: only while the in-app camera or the code scanner is open. A photograph goes from the sensor into the encrypted vault without being written to a file. - **Microphone**: only while you are recording. Recordings are encrypted in memory and never written out as an ordinary file. - **Biometrics / device lock**: used only to release the key that opens your vault. memex never receives your fingerprint or face data; Android performs the check itself. - **Notifications**: asked for once, the first time you write to somebody, and switched on or off at any time on This device. With them on, memex pro shows who wrote to you and the first line while memex is closed, and on the lock screen only who wrote, until the phone is unlocked; it shows nothing while memex is open. (A copy installed from outside Google Play also shows a notice while it hands your vault over in the background, saying what it is doing and nothing about your vault.) memex pro does not request location, contacts, or access to your photo library beyond the single picture you pick through Android's own photo picker. ## Children memex pro is not directed at children and is meant for people aged 18 and over. It includes a general-purpose web browser that can reach any website, and it lets people share things and words with each other, so it is not offered in Google Play's family programmes. ## ML Kit diagnostics memex pro reads the words out of your screenshots and PDFs, and scans the codes in them and the codes you point the camera at, using **Google's ML Kit**, bundled into the app and running on your device. **What never leaves.** Your pictures, your documents, the text recognised in them and the codes read out of them. ML Kit processes all of it on the device; Google states that it "does not send that data and the resultant outputs to Google servers." **What does leave.** ML Kit sends Google diagnostic and usage metrics about its own operation, over HTTPS. Per Google's published disclosure, that is: - device information: manufacturer, model, OS version and build, and which hardware accelerators are present - application information: the app's package name and version - a per-installation identifier, which Google states is not unique to a user or a device - performance metrics such as latency - the configuration of each call: image format and resolution, input and output sizes - the ML Kit feature and version used, the kind of event (initialisation, detection, release) and any error codes Google states that it uses this for diagnostics and usage analytics, and that it is not transferred to third parties. **Google provides no way for an app to disable it**, so memex cannot offer you a switch for it. The one thing memex can do is tell you, which is what this section is. The Google transport that carries these reports, and the billing library's below, adds to each one your phone's language, country and time zone, the kind of network it is on, and its mobile carrier's code. Google's handling of that data is governed by [Google's privacy policy](https://policies.google.com/privacy) and the [ML Kit terms](https://developers.google.com/ml-kit/terms). ## Google Play Billing diagnostics Subscribing to Unlimited goes through **Google's Play Billing library**, bundled into the app. The purchase itself is between you and the Play Store app on your phone. The library also reports on its own work to Google, over HTTPS: each step it took with the Play Store and whether it worked, with your phone's make, model, Android build and memory, memex pro's version, and a random number made afresh for each connection to Play, carried by the same transport as ML Kit's reports and with the same additions. memex pro connects to Play only when you look at your plan, add a device past your second, or buy, and, once you have bought, now and then as it opens, to see that the plan still renews. A copy of memex pro that Google Play did not install never connects. The report carries nothing of your vault, and **Google provides no way for an app to disable it** either. ## Notifications, and Firebase Cloud Messaging Telling you that somebody wrote while memex is closed goes through **Google's Firebase Cloud Messaging**, bundled into the app. It does nothing until you turn notifications on: before then the app asks Google for nothing. **What Google is told, with notifications on.** To give your phone an address it can be pushed at, Firebase sends Google an identifier made up for this installation, memex pro's package name and the fingerprint of its signing certificate, which Firebase libraries memex uses and on which days, your phone's Android version, the version of Google Play services on it and memex pro's version. Google then carries each push to your phone and learns that a push for that installation arrived, and when. Turning notifications off asks Google to delete the address. Google states that Firebase keeps the installation identifier until the app deletes it, and then deletes it within 180 days. **What Google is never told.** Who wrote to you or what they wrote. A notice is sealed on the writer's phone (with a fresh elliptic-curve key, HKDF and AES-GCM) to a key your phone made for this alone and keeps in Android's key store, where its private half cannot be taken out; Google and our switchboard carry it and can open none of it. Every notice is padded to one size, so not even its length says how long the line was. Nothing is sent for anything hidden, for an assistant, or to anybody you are not connected to: a link shared with whoever holds it tells only the people you are connected to who opened it. **What your phone keeps for this.** So that a notice can be shown while memex is closed and locked, your phone keeps a short list of the people you are connected to: the name you know each of them by, and the public keys of the devices of theirs it already knows. The list stays on your phone, sealed under a key in Android's key store, and is rewritten whenever memex is open and something changes. A notice is shown only when it was signed by one of those devices, and under the name on your list, never a name the notice claims; a notice that arrives while your phone is locked says only who wrote. A phone that has not opened memex since you blocked or disconnected somebody can still show their notice until it next opens. Erasing memex, or taking a phone out of your memex, turns notifications off and deletes the list, the key and the address; a new memex asks again. Google's handling of this data is governed by [Google's privacy policy](https://policies.google.com/privacy) and the [Firebase terms](https://firebase.google.com/terms). ## Other diagnostics memex pro contains no crash-reporting or analytics service of its own. If the app fails to start it shows the reason on screen, and keeps a copy in its own private storage so it can show it on the next launch; that file is readable by no other app and is deleted when it has been shown. It is never sent anywhere. Google Play collects anonymous crash and performance data for every Android app, including this one, under [Google's own privacy policy](https://policies.google.com/privacy). We see only aggregated technical reports through that; they contain no vault contents. ## Deleting your data **On your devices.** Everything you keep is on your devices. Uninstalling memex pro deletes what that phone holds. Inside the app, items can be deleted permanently, and a vault that cannot be unlocked can be erased outright from the lock screen. Disconnecting a device from your memex erases the vault from it: at once if it is online, and the next time it connects if not. **What you shared.** Ending a share, disconnecting from a person or showing an assistant out stops what they get from then on, as described above. **At the switchboard**, there is no account to delete, and everything expires by itself: a device's rooms within minutes of it leaving; a sealed page when it is collected, and 14 days after it was last written at most; a device's single-use keys and the rest of what the pages need 45 days after it last connected; an assistant's tokens when you disconnect it, or 30 days after it last used them, and its registration 60 days after. The log holds nothing about you. If you want something gone sooner, write to us. Because there are no accounts we cannot find anything by your name or email address, but we will delete whatever you can point us to. **Your subscription.** Google keeps the record of what you bought from Google Play, under Google's privacy policy. ## Changes If this policy changes, the revised version will be posted at this address with a new effective date. Because we hold no contact details for you, we cannot notify you directly. The date at the top is the record. ## Contact **Email:** blumrry@proton.me **Developer:** thinkingmachinelabsdev