Introduction

This Privacy Policy explains what personal information Rock Nest LLC ("we", "us") collects when you use MyMemory (being renamed Everstash), including the web app at mymemory.dev, the browser extension and our other apps (together, the "Service"), how we use it, who we share it with, and the choices you have.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Information We Collect

Information you give us

• Account information: your name, email address and profile picture when you sign up or sign in.
• Your content: the notes, links, web pages, files, images, videos and other items you save; the chats and searches you run; and anything you dictate or record.
• Voice and meeting recordings: when you use dictation or live voice, your audio is streamed to our speech-to-text provider to turn it into text. When you record a meeting, we store the audio recording in your account along with its transcript until you delete it.
• Profile memory: if enabled (on by default, with opt-out), we store your preferred name, custom instructions, and an automatically maintained memory summary under Settings → Personalization → Memory. The summary is updated periodically from your chat history and can be edited at any time. It is not a complete record of everything that could be inferred from your history. Deleting memory and turning it off does not delete your chats or saved notes; re-enabling rebuilds the summary gradually from retained chats. Full erasure of inferred context requires deleting the source chats as well. Do not store passwords, API keys or tokens there.
• Connected services: if you connect Notion, YouTube or another integration, we store the access tokens needed to import from it, and the content you choose to import. You can disconnect at any time.
• Google Drive: if you connect Google Drive (paid plans), you choose files and folders in Google's file picker, which is loaded from Google when you open it. We read the files you pick and files later added to a picked folder, and we keep their text, a small preview image and file details (name, link, type and when it was last edited), updating them when the files change. We do not keep copies of the files themselves: when you open a synced PDF or slide deck, it is read from Google Drive at that moment. Your Google sign-in is handled by our authentication provider, which holds the access needed to sync. When you disconnect, syncing stops and that access is removed, and you choose whether to keep or delete the memories made from your files. See "Google user data" below.
• OneDrive: if you connect OneDrive (paid plans), we can read the files in your own OneDrive (not files others share with you), and we show you its folders so you can choose files and folders. We read only the files you choose and files later added to a chosen folder, and we keep their text, a small preview image and file details (name, link, type and when it was last edited), updating them when the files change. We do not keep copies of the files themselves: when you open a synced file, it is read from OneDrive at that moment, except Word (.docx) and plain text files, which show the text we keep. Your sign-in is handled by our authentication provider, which holds the access needed to sync. When you disconnect, syncing stops and that access is removed, and you choose whether to keep or delete the memories made from your files. We use OneDrive data only to provide the features you turned on, never for advertising, never sell it and never use it to train AI models.
• Payment information: if you subscribe, payment is handled by our third-party payment processor, which collects and stores your card details; we receive your plan, billing status and billing address, and never your full card number.
• Messages to us: what you send when you email us or contact support.

Information collected automatically

• Usage data: the pages you visit, features you use, device and browser type, approximate location derived from your IP address, and referral and campaign details (for example, the site or link that brought you to us).
• Session replay: see "Analytics and session replay" below.
• Error reports: when something breaks, technical details of the error (such as the page, browser and the steps that led to it) are sent to our error-monitoring provider.

In the browser extension

The extension can see the pages you visit, but it saves a page only when you click the extension button or use its save shortcut. We do not record your browsing history. When you save, the extension sends that page's address and content to your account.

Google User Data

MyMemory's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google Drive data only to provide the features you turned on (saving, searching and chatting with your files), we never use it for advertising, we never sell it, we never use it to train AI models, and no person at MyMemory reads it unless you ask us to (for example, for support), it is needed for security or abuse investigations, or the law requires it. Google Drive content is sent to our service providers (such as AI processing) only to provide those features.

How We Use Information

• To provide the Service: save, process, index and search your content, and answer your chats using your saved content.
• To personalize the Service, for example with profile memory.
• To send account and service emails (sign-in, billing, security, and notices about important changes).
• To send product updates, tips and digest emails. You can unsubscribe from these at any time using the link in each email.
• To understand how the Service is used, fix bugs, and improve features.
• To keep the Service secure and prevent abuse, fraud and spam.
• To comply with the law and enforce our Terms of Service.

We do not use your saved content or chats to train AI models.

Analytics and Session Replay

We use a third-party analytics service for product analytics (events and funnels). When you are signed in, we may link these events to your account.

We also use it to monitor our AI features, so we can check their quality, speed and cost and fix problems. For each AI request we keep a record that includes the text sent to the model (which can include your question, the saved items it draws on and your profile memory), the model's response, and your account. Some high-volume background requests are only sampled. Only our team can view these records, they are deleted automatically after 30 days, and they are never used to train AI models.

Session replay (recordings of how you use the app, made by the same service) follows a three-state preference: off, masked (behavior only, with page text hidden), or full detail with page text. The default depends on your region and on the Global Privacy Control (GPC) signal from your browser; GPC always turns recording off. You can change the preference under Settings → Privacy. Switching to a more limited preference or turning replay off deletes prior session recordings only; it does not erase your product analytics events (for example, onboarding steps). Even full detail never records password fields.

How We Share Information

We share personal information only with service providers who process it on our behalf to run the Service, under contracts that limit how they may use it, and as described below. These are the kinds of providers we use:

• Hosting, storage and security: cloud hosting, databases and file storage for your account data and content, and bot protection.
• AI processing: AI model providers that generate chat answers, summaries, tags and search results. When you use these features, the relevant content (your question, the saved items it draws on, and your profile memory if enabled) is sent to the model provider to produce a response.
• Speech-to-text: a speech-to-text provider converts dictation, live voice and meeting audio into text.
• Web page fetching: services that fetch and convert public web pages you choose to save.
• Sign-in: an authentication provider that handles sign-in and account security.
• Payments: a payment processor handles subscription payments.
• Email: an email delivery provider that sends account, product and digest emails.
• Analytics and monitoring: the analytics service described above (product analytics, session replay and AI request records) and an error-monitoring service.
• Notifications: browser and device push services that deliver notifications you turn on.

We may also share information:

• When you ask us to, for example when you share an item publicly or connect an integration.
• For legal reasons, to comply with law, a valid legal request, or to protect the rights, safety and property of our users, the public or us.
• In a business transfer, such as a merger, acquisition or sale of assets, in which case this policy continues to apply to your information.

Embedded Content

Saved video and social posts may display an embedded player from the original platform. These players can load automatically when their cards are near the visible part of the page, before you press Play. The platform receives your IP address, browser and device information, and request/referrer details; it may also receive or set its own cookies or use local storage, including cookies associated with an account you have there. Its own privacy policy governs that information. Our analytics and session-replay preferences do not control these players. Where a saved-preview switch is available, you can use it to remove the player and stop further requests from that player; this does not undo information already sent. Browser privacy controls can also block third-party content and cookies.

Cookies

We use cookies and similar storage to keep you signed in, remember your settings (such as your theme and privacy preferences), remember where you came from when you signed up, and run the analytics described above. We do not use advertising cookies. Blocking cookies in your browser may stop sign-in from working.

Data Storage, Security and Retention

Your information is stored with our hosting and database providers, mainly in the United States. If you use the Service from outside the United States, your information will be transferred to and processed in the United States.

We use industry-standard measures, including encryption in transit, to protect your information. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

We keep your account information and content for as long as your account is active, or until you delete them. When you delete your account, it is scheduled for deletion with a 14-day grace period in which you can cancel; after that, your account and content are permanently deleted. Copies may remain in backups for a limited time until they are overwritten, and AI request records (see "Analytics and Session Replay") remain until they expire 30 days after they were made. We may keep limited records, such as billing records, where the law requires it.

Your Choices and Rights

• Access and export: download your data from Dashboard → Export.
• Correct: edit your profile, content and profile memory in the app.
• Delete: delete individual items, or schedule account deletion from Dashboard → Account.
• Marketing emails: unsubscribe at any time using the link in any email.
• Session replay: change your preference under Settings → Privacy.

Depending on where you live (for example in California, the European Economic Area or the United Kingdom), you may have additional rights: to know what personal information we hold about you, to receive a copy, to correct it, to delete it, to object to or restrict certain processing, and to withdraw consent. Where these laws apply, we process your information to provide the Service you asked for (contract), for our legitimate interests in running, securing and improving the Service, with your consent (for example, marketing emails and session replay where required), and to comply with the law. You can exercise these rights by emailing privacy@mymemory.dev. We will not discriminate against you for exercising them. You may also complain to your local data protection authority.

Children

The Service is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, contact us and we will delete it.

Changes to This Policy

We may update this policy from time to time. When we do, we will update the date at the top of this page, and if the changes are significant we will notify you by email or in the app before they take effect.

Contact Us

If you have questions about this policy or your information, contact us at:

Rock Nest LLC, 525 Route 73 North, Ste 104, Marlton, NJ 08053, USA

Email: privacy@mymemory.dev