Privacy

About this policy

This policy covers how Memriq Holdings, Inc. ("Memriq", "we") collects and uses information from users of Memriq products and services, including (but not limited to) the public website at memriq.ai, the Memriq newsletter, and invite-only applications such as Topsway, Braid, Command, Counsel, Vault, and the Claude Certified Architect Trainer.

Apps you sign in to with Google

Every Memriq app signs in with Google through one Memriq sign-in page (account.memriq.ai), so when you choose Continue with Google in any of them, Google shows Memriq's name and links this policy. Each app also publishes its own privacy policy, which says exactly what that app collects and how it uses it, and applies alongside this one:

• Counsel — keeps the legal side of your own life in one place: what you tell it about yourself or a legal matter, and the documents and explanations you ask it for. If you sign in with Google, it receives your name, email address and Google account ID, only to sign you in; it asks Google for nothing else and reads nothing in your Google account. Its policy: counsel.memriq.ai/privacy.
• Reckon — reads the bank transactions of the accounts you connect through Plaid (read only; it cannot move money), the statements, pay stubs and receipts you upload, and the rules you write, and sorts them into files you download. Its policy: reckon.memriq.ai/privacy.
• Merc — helps with the things you buy and own: research and comparison, a purchase prepared up to the seller's own checkout when you say yes, a record of what you own, and returns, repairs and claims followed through. If you sign in with Google, it receives your name and email address, only to sign you in; if you connect your email or calendar, it reads shopping paperwork from your email (each message read once, in memory, and never stored — only the facts you keep) and reads your calendar only to suggest times. Its policy: merc.memriq.ai/privacy.
• Helm — a personal planning app for your boards and to-dos. If you sign in with Google, it receives your name, email address, profile picture and Google account ID; if you connect a Google calendar, it reads and writes the calendars you attach to a board, and an event you turn into a to-do has its description copied into that to-do. Its policy: memriqhelm.ai/trust/privacy.
• Drift — plans trips, alone or with the people you travel with. If you sign in with Google, it receives your name and email address; if you connect your Gmail or Google Calendar, it reads them through Harbor, Memriq's service for your own mail and calendar, only to find your travel confirmations, changes nothing there, and shows what it found as a proposal you accept or not. Its policy: drift.memriq.ai/privacy.
• Harbor — Memriq's service for your own mail, calendar and documents: it reads the sources you connect and keeps what matters, so it can answer you with its sources named. If you sign in with Google, it receives your name and email address; if you connect them, it reads your Gmail (read only), reads your Google Calendar and changes it only within the permission you set, and reads the Google Drive files you pick — or, if you allow it, searches your whole Google Drive (read only) to find the document you or your agent ask for. Other Memriq apps you use read your mail, calendar and Drive only through Harbor, for the purpose their own policy states, and none holds its own Google permission to them. What it reads from Google is used only to provide these features to you, adheres to the Google API Services User Data Policy including its Limited Use requirements, and is never sold, used for advertising or used to train a model. Its policy: harbor.memriq.ai/privacy.
• Haven — a personal health app for tracking, coaching and visit preparation. If you choose Continue with Google, to sign in or to join its waiting list, it receives your name and email address and uses Google for nothing else. Its policy: haven.memriq.ai/privacy.
• Alloy — exam preparation for the Claude certifications. If you sign in with Google, it receives your name, email address and Google account ID, only to sign you in; it asks Google for nothing else and reads nothing in your Google account. Its policy: memriqalloy.ai/privacy.

Google user data: Limited Use, and how it is protected

Memriq's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gmail and Google Drive are read only by Harbor, Memriq's service for your own mail, calendar and documents, and only after you connect them there; another Memriq app you use reads them only through Harbor, never with a Google permission of its own.

• Used only for what you asked for: information from your Google account is used only to provide the features you use. It is never sold, never used for advertising, and never used to build a profile for anyone else. No person at Memriq reads it, except with your permission for a specific message or file, when needed to investigate abuse or keep the service secure, or when the law requires it.
• AI and model training: to answer you, the text involved is sent to OpenAI's API — the only AI model provider that ever receives Google user data. OpenAI's API terms state that data sent through the API is not used to train OpenAI's models. Memriq never uses Google user data — raw, aggregated or derived — to develop, train or improve a generalized or foundational AI or machine-learning model.
• Encryption in transit: every connection between your browser, Memriq's services, Google and our database providers is encrypted (HTTPS/TLS).
• Encryption at rest: the Google access and refresh tokens Harbor holds are encrypted with a Memriq key before they are stored and never leave Memriq's servers; the only Google token that reaches your own browser is the short-lived one Google's file picker needs while you pick a file. Mail text Harbor keeps from Gmail, and the names of the people in it, are sealed with an encryption key of your account's own (AES-256-GCM), which is stored only in wrapped form under a Memriq service key.
• Access controls: your Google data is read only for the account that connected it — every read is tied to that signed-in account — and another Memriq app you use reads it only through Harbor, for that account. Helm's agent looks in your mail or Drive only for a to-do in your own accounts; when you choose to add an email or Drive file to a to-do on a board someone shared with you, Helm first tells you that everyone on that board will be able to read it, and it is kept in that board owner's account, sealed with its key. Memriq's internal tools have no screen that shows anyone's mail or Drive files, and the production databases are reachable only with Memriq operators' credentials.
• Retention: Harbor keeps the mail it has read until you delete it. Harbor keeps no Google Drive file contents and no copy of any file: it asks Google for the names of the files you picked each time you open Sources, and a search of your whole Drive, run when you or your agent ask, returns file names and links that Harbor does not store. When Helm's agent looks in your Drive for a to-do, the run keeps what it found (up to ten files: name, kind, last-changed date, link, owners and the words that found them, never their contents), sealed with your account's key, until you close your account. Google Calendar events are read from Google when a screen, your agent or another Memriq service you use asks for them, and Harbor does not store them; an event you bring into a Helm to-do becomes part of that to-do, kept until you delete it or close your account. When you attach a found file to a Helm to-do, Helm keeps only a pointer to it (its name, kind, last-changed date, link and the words that found it), sealed with the key of the account that holds the to-do (yours, or the board owner's on a board someone shared with you), until the to-do is deleted or that account is closed. Memriq Form keeps the Drive folder you chose and the link of each file it saved there for you. Disconnecting a Google account in Harbor stops all reading and deletes the stored Google tokens; what was already read stays until you delete it.
• Deletion: on Harbor's Sources screen you can delete everything one source was read into, and Settings → Trust deletes the mail and documents Harbor read when you close your account. You can also remove Memriq's access to your Google account at any time at myaccount.google.com/permissions.

What we collect

• Account data: when you sign in to a Memriq application with Google, we receive your email address and display name.
• Usage data: activity within an application (study attempts, feature usage, agent conversations, file uploads). The specific data depends on which Memriq product you use.
• Operational logs: standard server logs (timestamps, request paths, response codes) for diagnostics and security.
• Newsletter data: if you subscribe, your email address and any preferences you set.

How we use it

We use your data to operate the Memriq product you signed up for, to personalize that product to you (e.g., scoring, recommendations, agent grounding), and to communicate with you about the service. We do not sell your data and we do not share it with third parties for advertising.

Where it lives

Memriq applications run on infrastructure operated by Memriq in the United States, primarily Railway (compute), Neo4j Aura (graph data), MongoDB Atlas (document/event data), and Resend (transactional email). Sign-in is brokered by Google. LLM completions are processed by OpenAI; we transmit only the necessary context and prompts required by each product. Videos you ask Memriq Form to make are generated by Google's Veo models through the Gemini API; only the words you give for that video and any photos you upload for it are sent, and no Google user data (mail, calendar or Drive) is sent to it.

Cookies

Memriq applications use first-party session cookies issued by NextAuth (or equivalent) to keep you signed in. The public memriq.ai marketing site uses no third-party tracking cookies.

Your rights

You can request access to or deletion of your account data by emailing privacy@memriq.ai. We will confirm within seven days. If you are subscribed to a Memriq newsletter, every edition includes a one-click unsubscribe link.

Children

Memriq products are not directed to children under 13 and we do not knowingly collect data from them.

Changes

Material changes to this policy will be communicated to active users by email at least seven days before they take effect, and the "Last updated" date above will be revised.

Contact

Questions or requests: privacy@memriq.ai