Privacy Policy

Last updated: October 23, 2026

What we collect

Retayn stores encrypted memory. We do not receive the plaintext of that memory. Specifically:

• Encrypted memory segments. AES-256-GCM on your device, or on the bot’s computer, before transmission. We store ciphertext we cannot decrypt.
• Blinded search terms. HMAC-SHA256 hashed on that same computer. We see hashes, not words.
• Embedding vectors. Computed before upload. We store them for similarity search. They are lossy and are not the original text.
• Metadata. Timestamps, memory layer, session id, and the agent tag. The tag is plaintext so recall scope can filter on it.
• Account info. Email from the OAuth provider, an API key hash, usage counts, and the plan.

What we cannot see

Encryption keys are derived from your passphrase on the computer that runs the client SDK or the Grok Bot plugin. On those clients we do not receive the passphrase or the derived keys. We cannot decrypt stored content, read search queries as words, or recover data if you lose the passphrase. The security page has the threat model, key derivation, and the VS Code exception.

Grok Bot

On Grok Bot, the passphrase lives on the bot’s computer. It is private from Retayn. It is not private from that computer, or from whoever administers the host. Anyone who can read the host can read the passphrase and, with the ciphertext, the memory.

Third-party services

• Cloudflare — infrastructure (Workers, R2, Vectorize). Subject to Cloudflare’s privacy policy.
• Stripe — payment processing for optional hosted plans. Subject to Stripe’s privacy policy.
• GitHub and Google — OAuth sign-in only. We receive your email and display name.

Retayn does not send your memories to an LLM. The bot you use decrypts on its own computer and may then put a recalled line into its own prompt. That step is the bot’s, not a call we make.

Data retention

Free accounts: 30-day retention. Pro and Ultra: kept until you delete them. You can delete stored memory with POST /v1/wipe and your API key, from the dashboard, or by contacting us.

Data deletion (GDPR / CCPA)

Request account deletion with POST /v1/wipe, or email [email protected]. We delete stored data within 30 days.

Contact

Questions: [email protected].