MemoBrain is local-first: in the desktop app, your documents, diagrams and knowledge files are stored on your own device by default and never leave it unless you actively use a cloud or AI feature. The one exception is the web app (app.memobrain.net): files you create while signed in sync to our cloud automatically, so your work follows you across devices (see "Cloud storage" below).
Who we are: MemoBrain is developed and operated by Qingdao Memobrain Software Technology Co., Ltd ("we", "us", "our"). This policy covers the MemoBrain desktop application, our website at memobrain.net, and any related online services (together, the "Service"). Questions about privacy: [email protected].
We use the data we collect to:
We do not sell your personal data.
Legal bases (EEA/UK): performance of a contract (account, license, providing the Service and AI features); legitimate interests (security, fraud prevention, product improvement); consent (opt-in features such as cloud sync — withdrawable at any time).
We integrate the third-party services listed below. Each provider processes data under its own privacy policy — follow the links to review them. Third parties may adjust their data practices over time; their official policies prevail.
| Provider | Purpose | Data involved | Privacy policy |
|---|---|---|---|
| DeepSeek (DeepSeek AI) | Official AI feature processing (one of the model providers behind AI points) | The content of your AI requests (text, diagrams or documents you submit) and generated output | platform.deepseek.com — privacy policy |
| Zhipu AI (Z.ai / 智谱) | Official AI feature processing (alternate model provider) | The content of your AI requests and generated output | open.bigmodel.cn/policy/privacy |
| GitHub, Inc. | Third-party sign-in (OAuth): register or sign in with your GitHub account | The email and basic profile you authorize on GitHub (used to create or link your account) | docs.github.com/site/privacy |
| Google LLC | Third-party sign-in (OAuth): register or sign in with your Google account | The email and basic profile you authorize on Google (used to create or link your account) | policies.google.com/privacy |
| Cloudflare, Inc. | CDN, DNS, SSL, DDoS protection; Cloudflare R2 for opt-in cloud document storage | Standard web logs (IP address, user agent, request time); for cloud storage, the documents you upload (including new files auto-synced from the signed-in web app) | cloudflare.com/privacy |
| Self-hosted analytics | Aggregated product-usage measurement | Anonymized usage events; no document contents, hosted on our own servers | — (no third party involved) |
Bring your own key (BYOK): if you configure your own model provider, AI requests go directly from your device to that provider and do not pass through our servers. Your handling of that provider is then governed by your own agreement with it.
Depending on your jurisdiction (e.g., GDPR in the EU/EEA, CCPA/CPRA in California), you may have the right to:
To exercise any of these rights, email [email protected] with the subject "Privacy Request". We respond within 30 days. We may ask you to verify your identity first.
Deleting your data: cloud documents can be deleted by you at any time inside the app (trash is kept for 30 days). Account deletion is self-service inside the app: Account Center → Security → Delete account. It takes effect immediately — cloud documents, knowledge-base snapshots, bound devices and third-party sign-in links are erased at once, personal identity data (email, nickname, avatar, phone, WeChat identifier) is scrubbed, and the account can no longer be used. Order records are retained for legal and accounting purposes. You may also email [email protected] for assisted deletion.
We use industry-standard measures: TLS encryption for data in transit, minimal collection, and storage of API keys only on our servers — never inside the distributed client. No security measure is perfect; you use the Service at your own risk to the extent permitted by law.
The Service is not directed at children under 13 (or under 16 in the EU/EEA). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
Your data may be processed on servers located outside your country (including via our third-party providers). By using the Service, you consent to such transfers to the extent permitted by applicable law. We aim to use providers with adequate safeguards (e.g., standard contractual clauses where applicable).
We may update this policy from time to time. Material changes will be announced on our website or by email at least 14 days before they take effect. Continued use of the Service after changes take effect constitutes acceptance.
Questions about this policy: [email protected]
Last updated: October 22, 2026 · Version 1.5 (supersedes version 1.4, October 19, 2026 — adds disclosure of automatic cloud sync for new files created in the signed-in web app)
