Memoshelf Privacy Policy

Effective: Oct 13, 2026

Last updated: Oct 13, 2026

This Privacy Policy explains how Twig Group LLC d/b/a Memoshelf, an Oklahoma limited liability company ("Memoshelf," "we," "us"), collects, uses and shares information when you use memoshelf.com, the Memoshelf API and connector endpoint, the owner app, and related services (the "Service").

United States only. The Service is offered only to users in the United States. We do not knowingly accept users outside the United States, and we may close accounts that we learn are used from outside the United States. Your account information and Customer Content are stored in the United States.

1. Information we collect

Account information. Your email address, which you use to sign in by emailed link, your confirmation at sign-up that you are located in the United States and when you gave it, and basic account and workspace details such as your plan and settings. There are no passwords.

Customer Content. What you and your agents store in the Service: notes and rules pages (title, body, tags, pinned status), run logs (for example goal, tools, outcome, status, timing, tags and summaries), page-fetch requests and the cached markdown results, and webhook and alert settings you configure. We process Customer Content only to provide the Service to you.

Keys and connections. API keys are shown to you once and stored only as a one-way hash. Connector (sign-in-with-your-AI) codes, access tokens, refresh tokens and app secrets are also stored only as hashes. We keep key metadata (such as prefix, label, lane, creation, last-use and revocation times), records of connector authorizations you approve, and webhook signing secrets, which we keep so we can sign the deliveries you set up.

Usage and log data. Counts of runs, notes and page fetches, data volumes, per-key daily request counts by route and result, last-request times, request IDs, and audit records of certain account actions (such as exports and workspace deletion). When you sign up or make requests, our systems and hosting providers also process technical data such as IP address for rate limiting, security and abuse prevention.

Billing information. When you buy a paid plan, payment is handled by Stripe. Stripe collects your payment card details; we receive limited information such as your name, billing email, billing address, plan, payment status, and card brand and last four digits. We never receive or store full card numbers.

Website analytics. Our public marketing pages use Umami for page-view counts. Umami does not set cookies and does not identify you; it records page views, referrers and general device and country information. Analytics do not load in the signed-in owner app.

Communications. If you email us, we keep the message and your contact details.

2. How we use information

We use information to:

• provide, operate and maintain the Service, including storing and returning your content to the keys and connectors you authorize;
• sign you in, secure accounts, enforce rate limits and quotas, and prevent fraud and abuse;
• process payments and manage subscriptions;
• send account, security, billing and service emails, and notices inside the Service;
• measure usage, troubleshoot, and keep the Service working;
• understand traffic to our marketing pages; and
• comply with law and enforce our Terms.

We do not use Customer Content to train AI models, and we do not sell Customer Content. Memoshelf does not send Customer Content to any AI model provider on its own; your content goes only to the AI tools you connect, under those tools' own terms.

3. How we share information

We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising.

We share information only:

• with the service providers (subprocessors) listed below, who help us run the Service;
• with Third-Party Tools you connect. When your agent or connector reads from Memoshelf, we send it the content it requests on your behalf. That tool's own privacy terms then apply;
• to webhook endpoints you configure, which receive the event data you selected;
• for legal reasons, when we believe disclosure is required by law or needed to protect rights, safety or the Service;
• in a business transfer, such as a merger, acquisition or sale of assets, subject to this Policy; and
• with your direction or consent.

Subprocessors

We will update this list when it changes.

4. Cookies

Public pages set no cookies. When you sign in to the owner app, our authentication provider sets a small number of strictly necessary cookies that keep you signed in. We do not use advertising or tracking cookies, so there is no cookie banner.

5. Retention

• Runs and notes: kept for your plan's retention period (Free 30 days; Solo 90 days and Team 1 year), then removed automatically. Pinned rules pages are not removed by any plan's retention limit. Removed or deleted notes and runs are recoverable for 30 days and then permanently deleted.
• Plan changes: if a paid plan ends, runs and notes older than the Free plan's retention period are kept for 30 days so you can export them, then removed under the Free plan's retention rules. Pinned rules pages are kept.
• Workspace deletion: a deletion request can be cancelled for 30 days; after that the workspace is deleted. You can also delete your account data immediately, which removes your runs, notes, keys, fetch cache and sign-in identity and cannot be undone.
• Export files: available for download for 7 days.
• Page-fetch cache: 1 hour.
• Usage and audit records: kept while your account exists.
• Billing records: kept as required for tax and accounting.
• Hosting and request logs: kept by our hosting providers under their own retention settings.

6. Security

We encrypt traffic in transit (HTTPS everywhere), our database provider encrypts stored account data and content at rest, we hash API keys and connector tokens, we check every keyed read and write against the caller's own workspace, the database refuses direct access from outside the app, and we rate-limit requests. See memoshelf.com/security for details. No system is perfectly secure, and we cannot guarantee security.

7. Your choices and rights

You can view, export and delete your content in the Service on every plan, revoke keys and connector authorizations, and delete your account data. You can also email support@memoshelf.com.

US state privacy rights. Depending on where you live (for example California, Colorado, Connecticut, Virginia and other states), you may have the right to know what personal information we collect and how we use and share it, to access, correct or delete it, to receive a portable copy, and to opt out of sale, targeted advertising or profiling. We do not sell personal information or use it for targeted advertising. We will not discriminate against you for exercising your rights. You or an authorized agent can make a request at support@memoshelf.com. We will verify your request and respond within the time required by law. If we deny your request, you can appeal by replying to our response.

Customer Content about others. If your Customer Content includes personal information about other people, you control it and are responsible for it. Those people should contact you; we will help you respond as required.

8. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

9. Changes

We may update this Policy. If a change is material, we will give at least 30 days' notice by email or in the Service before it takes effect, unless the change is required by law. The "Last updated" date shows the latest version.

10. Contact

Twig Group LLC d/b/a Memoshelf 1216 E Kenosha St, Ste. 342, Broken Arrow, OK 74012 support@memoshelf.com