Privacy policy for Memory by Kiawak

1. Controller

The controller is Lukas Köppl, Kiawak, Kolpingstraße 24, 84030 Ergolding, Germany, phone +49 151 47854616, e-mail contact@kiawak.com. No data protection officer is appointed because the legal requirements are not met.

2. Principles

Memory has no advertising, no analytics and no tracking and sets only one cookie: the login cookie (section 5). Your notes are visible only to your account and to the AI tools you connect yourself (section 8). Kiawak does not sell data, uses it neither for advertising nor for training AI models and does not let any AI of its own analyse your notes.

3. Hosting and server logs

Memory runs at Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA): program (Cloudflare Workers), database (Cloudflare D1), e-mail delivery and delivery of the pages. When you open a page, Cloudflare processes technically necessary data such as IP address, time, address and browser details to deliver the page securely and quickly (Art. 6 (1) (f) GDPR). A data processing agreement with Cloudflare is in place; Cloudflare is certified under the EU-US Data Privacy Framework, the EU standard contractual clauses apply in addition. Fonts are loaded from the own server. Kiawak itself keeps no access logs; Cloudflare retains technical logs only briefly. Error messages of the program contain no content of your notes.

4. Storage in your browser

Your browser's local storage only keeps your view: light or dark display (mem-theme) and app settings such as the note opened last and the width of the side panels (mem-ui). These values do not leave your browser; this storage is strictly necessary for the function you requested (§ 25 (2) no. 2 TDDDG). The demo runs entirely in your browser with invented example data and sends nothing to Kiawak.

5. Customer account

For an account Kiawak stores your e-mail address, your password only as a salted hash (PBKDF2-SHA256, not reversible), the language, the times of registration, e-mail confirmation and last use and your consent to the terms of use (version, time, IP address).

Signing in sets the cookie __Host-mem_s (HttpOnly, Secure, 30 days, deleted on sign-out); Kiawak keeps only a hash of it. It is technically necessary (§ 25 (2) no. 2 TDDDG). The legal basis for the account is Art. 6 (1) (b) GDPR. The data is kept until you delete the account, which you can do at any time under “Account”. Accounts whose e-mail address is not confirmed after 30 days and that hold no notes are deleted automatically.

6. E-mails

Memory only sends e-mails that belong to its use: confirming the e-mail address, a new password and a notice when a new AI tool was connected by signing in. They are sent via Cloudflare Email Service (Cloudflare, Inc.) from contact@kiawak.com. There is no newsletter and no tracking pixels. Legal basis: Art. 6 (1) (b) GDPR.

7. Your memory: notes, links, history

Kiawak stores in the database your notes with title, folder, text, tags, kind (e.g. fact, preference, person, project), importance, pinning and times, the links between notes, who changed a note last (you or the name of a connection) and how often an AI fetched it. Up to 20 earlier versions of each note are kept so that you can undo changes, also changes by an AI. The “History” log shows which connection read, searched or wrote what and when (with the search term); entries are deleted after 180 days.

All content is visible only to your account and to the connections you set up. Kiawak does not look at your content unless you expressly ask for it (e.g. when looking for an error) or a law requires it. Deleted notes stay in the trash for 30 days and are then deleted for good; they remain in the database backups for up to 30 days. Files you import (e.g. an Obsidian folder as ZIP) are read in your browser; Kiawak only receives the notes created from them. You can export at any time (Markdown as ZIP, JSON).

Please do not store passwords, access data, payment data or special categories of data (e.g. health data) in Memory. If you store details about other people, you are responsible for being allowed to; if you use Memory as a business for data of third parties, you can ask Kiawak for a data processing agreement (Art. 28 GDPR). Legal basis: Art. 6 (1) (b) GDPR.

8. Connections with AI tools

You decide which AI tools access your memory: with an API key you create, or by signing in from within the tool (OAuth, e.g. in Claude or ChatGPT). For each connection Kiawak stores its name, its rights (read, or read and write), an optionally allowed folder, the time it was set up and last used, the number of requests and the key only as a hash. You can change or delete any connection at any time under “Connect your AI”; it stops working at once.

When a connected tool queries your memory, Kiawak, at your instruction, transmits the requested notes to that tool and stores what it writes. What the provider of the tool (e.g. Anthropic, OpenAI, Google, Mistral or the operator of your own agent) does with this content is governed by your contract with that provider and its privacy policy; these providers are not Kiawak's processors, and data may reach third countries such as the USA. The legal basis for the transmission is Art. 6 (1) (b) GDPR (the connection you set up).

9. Protection against misuse

To protect against misuse (e.g. many sign-in attempts or very many requests) your IP address is stored with a counter for no more than four hours, counters for an e-mail address or connection for no more than three days and the number of requests per day and account for 40 days (Art. 6 (1) (f) GDPR).

10. Recipients and third countries

Recipients are Cloudflare (operation, database, e-mail delivery), the AI tools you connect (section 8) and Apple (iCloud, Apple Distribution International Ltd., Ireland) as provider of the mailbox that holds messages sent to Kiawak. Transfers to Cloudflare in the USA are based on the EU-US Data Privacy Framework and the EU standard contractual clauses. Data is not passed on for advertising.

11. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability. You can download a copy of your data under “Account”, your notes also as Markdown files in the app. You can also complain to a supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Right to object (Art. 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR (sections 3 and 9). An e-mail to contact@kiawak.com is enough.

12. Obligation to provide data

An account needs an e-mail address and a password; without an account only the demo can be used. All content of the memory is voluntary. There is no automated decision within the meaning of Art. 22 GDPR.