Legal

Privacy policy

Last updated 13 October 2026

lore is shared long-term memory for AI coding agents, run at app.lorememory.ai by its maintainer. This page says what lore collects, why, where it is kept, who else handles it, how long it stays, and what you can do about it. It is written to meet Brazil's data protection law (LGPD). Questions and requests: privacy@lorememory.ai.

What we collect

• Your account: username, email address, an optional full name, and your password, stored only as a salted hash.
• Your keys: the API keys you create, stored only as hashes, with a label and when each was last used.
• What your agents send: when connected, your agents send lore the prompts you type, which tool they ran, and a short excerpt of each tool result (at most 2 KB), plus session metadata such as the time and the repository. With lifecycle hooks installed, this happens automatically. Files you list under [capture] ignore_paths in .ai-memory.toml are dropped on your machine before anything is sent.
• Memory pages: the pages lore compiles from those sessions, and any page you or your agents write or edit, with their version history.
• Activity records: an audit log of changes (who did what, and when), and your IP address, held in memory only to rate-limit sign-in and sign-up.
• Cookies: only the two lore needs to keep you signed in and to protect forms (a session cookie and an anti-forgery token). No advertising or tracking cookies.

Why

To run the service you signed up for: keep your agents' memory, let the people you invite read it, and keep the service secure. That is the legal basis for most of it (performance of a contract). The audit log and your username on shared pages are kept for accountability and security (legitimate interest; see after you delete your account).

Secrets

Before anything is stored, lore strips values that look like secrets (API keys, bearer tokens, private keys, passwords in URLs). This is a safety net, not a guarantee: do not paste secrets into your agent.

Who else handles your data

• Vultr: hosts the server, in São Paulo, Brazil.
• Cloudflare: sits in front of the server (network and TLS), checks sign-ups for bots (Turnstile), hosts this website, and stores the encrypted database replica used for disaster recovery (R2).
• Anthropic: lore sends captured session content to Anthropic's API to compile it into memory pages. Under Anthropic's API terms, that content is not used to train their models.
• Brevo: sends lore's emails (password recovery, invitations, verification) to your address.

Some of these providers process data outside Brazil. We don't sell your data or share it with anyone else, except where the law requires it.

Who can see your memory

Memory in your personal workspace is visible only to you. A repository's memory is visible to the people you invite to it, at the level you choose (reader, writer or admin), and to the members of a team workspace when you share it there. Memory is not public. The operator can reach the server's data for maintenance and security.

How long we keep it

• Your account and its memory stay until you delete them.
• The disaster-recovery replica keeps at most 72 hours of history.
• Full backups taken before maintenance are kept for up to 30 days, then deleted automatically.
• The memory wiki keeps its own version history on the server; see below.

Deleting your account

Delete your account yourself from your account page ("Delete account"), or email privacy@lorememory.ai from your account's address. Your personal workspace, and every repository where you are the only admin, are archived for 30 days: hidden from everyone, and restored if you sign in again. After 30 days they are deleted. Repositories that have other admins carry on without you. Your API keys stop working at once.

After you delete your account, your username stays reserved, so nobody else can take it. Pages, captures and audit entries you left in other people's repositories keep your username, marked as a deleted account. That record is kept for accountability and governance (legitimate interest). Your email and full name are removed.

What remains: the disaster-recovery replica forgets deleted data within 72 hours, and full backups taken before the deletion are deleted within 30 days. The memory wiki's version history on the server still holds earlier versions of deleted pages. It can't be reached through lore, only by the operator on the server, and we are working on removing it.

Your rights

Under LGPD you can ask to confirm what we hold about you, get a copy, correct it, delete it, or object to how it is used, and you can complain to Brazil's data protection authority (ANPD). Write to privacy@lorememory.ai; we answer within 15 days.

Changes

If this policy changes in a way that matters, we will say so on this page and email account holders before it takes effect.