Privacy Policy
Last updated 2026-10-21
This policy explains what personal data Alexein (“we”) handles in running twin memory, and why. It covers two different kinds of data, and we treat them differently.
- Account data: about you, the developer or team using the Service. For this we are the controller.
- Customer Content: what your app sends us about your end users. For this you are the controller and we are your processor, under the Data Processing Agreement. If you are an end user of an app built on twin memory, that app’s privacy policy governs your data; ask its operator to see or erase it.
Account data we collect
- Your name, email address and organisation, when you sign up.
- Your API keys, stored only as SHA-256 digests with their first ten characters.
- Request metadata: time, route, project, the end-user id your app sent, status, duration, key id and model spend. Request bodies are not logged. These records are kept for 7 days.
- Usage totals per day, for limits and billing, kept for 35 days.
- Billing details, when paid plans open, handled by our payment processor.
Why we use it
- To run the Service and enforce plan limits (performing our contract with you).
- To keep the Service secure and investigate abuse (our legitimate interest).
- To email you about your account, security and material changes (our contract with you).
- To send product news, only if you opt in, and you can opt out at any time.
Customer Content
We process Customer Content only to provide the Service to you: to store it, read it into records, search it and return it. We do not sell it, use it for advertising, or use it to train models. Each of your end users’ memory is kept in a separate database. You can erase any part of it, or an end user whole, at any time, and the Service returns a receipt of what was removed.
Who else sees data
Two steps send text to a language model: reading an added item into records, and filtering a search. Both go through OpenRouter to the model provider serving the request. Our hosting provider stores the data. The current list of subprocessors is in the DPA. We disclose data to authorities only when the law compels us, and tell you first where we are allowed to.
Where data is kept
Data is stored with our hosting provider in [region to be confirmed]. Where data leaves the UK or EEA, we rely on the safeguards the law provides, such as standard contractual clauses.
How long we keep it
- Account data: while your account is open, then up to 30 days.
- Request logs: 7 days. Daily usage counts: 35 days.
- Customer Content: until you erase it, it expires, or your account closes and 30 days pass.
Your rights
You can ask to see, correct, export or erase your account data, or object to how we use it, by writing to privacy@twinmemory.dev. You may also complain to your data protection authority.
Cookies
The console uses only the cookies needed to sign you in, and the website keeps your theme in your browser’s local storage. We use no advertising or tracking cookies.
Changes
We will post changes here and change the date at the top. For a material change, we will email account owners before it takes effect.