Privacy Policy

This Privacy Policy explains how ReMemo (ReMemo Limited, “we”, “us”, or “our”) collects, uses, stores, and protects your personal information when you use the ReMemo mobile application and any associated services (collectively, the “Service”).

ReMemo is a personal notes application with an AI memory layer. Because the nature of the product involves storing your personal thoughts, ideas, and reflections, we take privacy seriously as a foundational commitment – not a compliance checkbox.

By using ReMemo, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

ReMemo uses two third-party AI services to power its core features. Understanding exactly what is sent to each service is important.

OpenAI (Embeddings) – Note text is sent to OpenAI’s text-embedding API to generate a numerical vector representation. This happens in three situations: when you save a note, or import notes from another app, in which case every imported note is sent; when text you are currently writing is used to find related past notes, including where you never save it; and when you ask a question, so your question can be matched against your notes. OpenAI retains API inputs in its abuse monitoring logs for up to 30 days and then deletes them. Those logs may include the text itself and information derived from it, such as automated classification scores. OpenAI does not use this text to train its models. Retention may be longer where required by law, or where OpenAI considers it reasonably necessary to protect its services or others from harm. ReMemo does not currently hold a zero-data-retention arrangement with OpenAI. See OpenAI’s Privacy Policy at openai.com/privacy.

Anthropic (Claude) – When you use the Ask feature, when your Weekly Digest is generated, when recurring themes are detected across your notes, or when Resonance runs as you write, excerpts from your most relevant notes are sent to Anthropic’s Claude API as context. Only the top semantically relevant note excerpts are sent per request – never your entire note library. Anthropic deletes API inputs and outputs within 30 days of receiving them, and does not use them to train its models under its commercial terms. Retention may be longer where required by law or to enforce Anthropic’s usage policies: where a session is flagged by Anthropic’s automated safety systems, inputs and outputs may be kept for up to two years, and automated classification scores for up to seven years. ReMemo does not currently hold a zero-data-retention arrangement with Anthropic. See Anthropic’s Privacy Policy at anthropic.com/privacy.

Unsaved text – Two features send what you are writing before you have saved it, and neither of them waits to be asked. In both cases the text is sent before it is saved, and is sent even if you never save it.

Finding related notes – the more frequent of the two, and it goes to OpenAI. Shortly after you stop typing, the text on screen is sent to be turned into a vector and matched against your own past notes. It begins once you have written a short phrase, repeats no more often than once every few seconds, and continues for as long as you are writing – including on text you later rewrite or abandon.

Resonance – the less frequent of the two, and the one that sends your text to Claude. When a past note is closely related to what is on screen, an excerpt of that past note and an excerpt of what you are writing are sent to Claude, which describes the relationship between them in a single line. Resonance does not run on every keystroke. Four conditions must all hold: the past note must be related closely enough to clear a similarity threshold we set on our own servers; it must be at least 24 hours old; you must have written at least 40 characters; and it must be a different past note from the one Resonance last asked about.

Data minimisation – Note content is truncated to a capped excerpt before transmission to any third-party AI service, so a long note is never sent in full. We send only the notes necessary to answer your specific query, generate your digest, or describe a connection Resonance has found.

Your notes and account data are stored on Supabase, a managed database platform built on PostgreSQL. Data is stored in eu-west-1. Supabase is SOC 2 Type II certified.

Row-level security – Every database query is scoped to your authenticated user ID through Supabase’s row-level security policies. No query can return another user’s data. This is enforced at the database layer, not the application layer.

Encryption – All data is encrypted in transit using TLS 1.2 or higher. Data at rest is encrypted using AES-256.

Access – ReMemo Limited is a one-person company. Its sole director builds and operates the Service, and is currently the only person with access to production infrastructure. That access is administrative, of the kind anyone running a hosted database necessarily has, which means your note content is technically reachable rather than sealed away. It is not read in the normal course of operating the Service, and would be looked at only to investigate a specific fault you had reported, or where the law required it. If anyone else is ever given production access, it will be limited to those who need it to operate the Service.

Depending on where you live, you may have the following rights regarding your personal data. We honour all of these regardless of jurisdiction – they reflect our values, not just our legal obligations.

ReMemo is not directed at children under the age of 13, or under the age of 16 in the European Union. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. If we make material changes – particularly any that affect how your note content is processed – we will notify you via push notification at least 30 days before the change takes effect. The updated policy will always be available at https://rememo.me/privacy.

Continued use of the Service after changes take effect constitutes acceptance of the updated policy. If you do not agree with the updated policy, you may delete your account before the effective date.

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we handle your data, please contact us: