Privacy Policy

Last updated: October 22, 2026

RepoMemory is run by Plexsicity, who is responsible for the data described here. This policy describes what RepoMemory collects, why, and how it is handled. The short version: we collect the minimum needed to run an API with accounts and billing, we don’t sell data, and payment details never touch our servers.

What we collect

• Account data — your email address and your Plexsicity account ID, which Plexsicity Auth gives us the first time you sign in, plus your plan and notification settings. You sign in on Plexsicity Auth, so your password and passkeys stay there: RepoMemory never receives or stores them.
• API keys — a hash of each key, never the key itself, plus its first 16 characters so you can tell your keys apart, its name, and when it was created, last used and revoked.
• Usage data — a record of each successful request: the operation, the API key that made it (or that it came from the Playground), the credits charged, how long it took and when. It is used for quota enforcement, your usage dashboard and history, and abuse prevention. Failed requests are not added to your history. Your history also keeps a summary of each successful request: up to 20 of its top-level fields, with text cut to the first 200 characters and lists and nested values left out. For the ledger operations that means the project, the start of an entry’s title and body, a recall’s query and a claiming agent’s name.
• Ledger entries — your project names, and the decisions, lessons, guardrails, notes and tasks you or your agents record: each entry’s title, body, tags and status, the entry that replaced it, the reason it was retired, who wrote it (the API key’s name, “dashboard” or “signed-in agent”, and the name the agent gave), when it was last edited, and for a task the name the claiming agent gave and how long its claim lasts. They are kept so your keys can recall them, are visible only to your account and its team, and are never used to train models.
• Webhooks — the endpoint URLs you add, their signing secrets, and a log of delivery attempts (status code or error, and when). The events we send contain the operation, credits charged, processing time and timestamp, not your request or result.
• Teams — who belongs to which team and in what role, and the email addresses invited. A team’s owner sees its members’ email addresses; members and invitees see the owner’s, which is also in the invitation email.
• Notifications — the ones in your dashboard, such as quota alerts and new API keys.
• Billing data — handled by Stripe. When you first upgrade we create a Stripe customer with your email address; we store its customer ID, your plan and your billing period, never card numbers.
• Connection data — every request to this site and the API passes through Cloudflare and our web server, which see your IP address, the address you request and your browser or HTTP client, and may record them in access logs.

What we don’t do

• No selling or renting of personal data.
• No advertising trackers, and no third-party analytics services.
• No reading of your request history beyond what’s needed for operations, debugging, or abuse investigation.

Analytics, session recording & error reports

Each tool below runs on our own servers. Your data is not sent to Google Analytics, Hotjar, or any other third-party service.

• Page analytics (Umami). Counts page views and referrers. It sets no cookies, does not track you across sites, and does not build a profile of you. Because it collects no personal data, it runs without asking.
• Error reports (GlitchTip). When a page fails, in your browser or on our server, a report goes to our error tracker: the error, the page address, what happened just before it (such as clicks, navigation and requests) and technical details such as your browser version. The site also tells it each time you open a page, with a random ID rather than your account, so we can see how many visits run into errors.

Cookies & local storage

Your sign-in session is held in an encrypted, secure, httpOnly cookie that JavaScript can’t read, with a second, short-lived one while you sign in. If you change the theme, it is kept in local storage and a small cookie; local storage also remembers which team you’re viewing. If you turn on “Remember my request drafts” in the Playground, your drafts are kept in that tab’s session storage until you close it or sign out. We set no advertising or cross-site tracking cookies anywhere on the site.

Subprocessors

We share data only with the providers required to operate the Service, each receiving only what it needs:

• Stripe — payment processing. It receives your email address when you first upgrade; card details are handled entirely by Stripe and never reach our servers.
• Cloudflare — DNS and network protection in front of the Service. Every request to this site and the API passes through it.
• Forward Email — sends our emails (team invitations and quota alerts) and forwards mail sent to [email protected] to us.
• Plexsicity Auth (auth.plexsicity.com) — sign-in. Your Plexsicity account, with its password and passkeys, lives there.
• Our cloud hosting provider — application servers and the database, in the United States.

The tools under “Analytics, session recording & error reports” are self-hosted, so what they collect is kept on our own servers, not by another company; they are not subprocessors.

Retention & deletion

We keep your account data, API keys, usage history, webhooks and their delivery logs, team memberships and invitations, and notifications for as long as your account exists; none of it expires on its own. Ledger entries are kept until you delete them (on the dashboard’s Ledger page or through the API) or your account is deleted; retiring an entry hides it from recall but keeps it. The records we use to process each request and send its webhooks are deleted about a week after they finish, and records of quota-alert emails 90 days after the alert is processed. Our nightly database backups keep the 14 most recent copies, so deleted data can remain in a backup until it rotates out.

You can’t delete your account from the dashboard. To have your account and its data deleted, email [email protected].

Where your data is kept

We are based in Australia. The Service runs on servers in the United States, so your account, ledger entries and usage data are stored and processed there, and requests pass through Cloudflare’s network on the way. Stripe and Forward Email may process the data they receive in other countries under their own policies.

Children

The Service is for people aged 18 and over. We don’t knowingly collect data from anyone younger; if you believe a child has an account, email us and we will delete it.

Your rights

You can request a copy of your data, correction, or deletion at any time via the email above. If you are in a jurisdiction with specific data-protection rights (e.g. GDPR or CCPA), we honor requests accordingly.

Changes

If this policy changes materially, we’ll post the update here with a new date.

Contact

Privacy questions: [email protected].