Privacy Policy

Effective date: October 23, 2026. Last updated: October 23, 2026.

This Privacy Policy explains how Memverix ("Memverix", "we", "us" or "our") collects, uses, stores, shares and deletes information when you use the Memverix desktop application, the website at memverix.evognix.com, and the related assistant connection service (together, the "Service").

Memverix is a local-first evidence search tool. You import documents, images, audio and video into the desktop app; Memverix indexes them on your device and lets an authorized AI assistant search and retrieve evidence through the Model Context Protocol (MCP).

1. Scope

This policy applies to the Service and to information we receive through it. It does not apply to third-party websites, AI assistants, or Google services. Those services have their own privacy policies, and we are not responsible for their practices.

2. Information we collect

Website account

If you sign up or log in on memverix.evognix.com, the gateway stores your Google account identifier, email address, display name, profile image URL, the date you joined, your last sign-in time and a sign-in count. It stores no Google access or refresh tokens and none of your files, vectors or search content. A signed session cookie keeps you logged in for up to 30 days. Email [email protected] to have this record deleted.

Google account information

When you choose to sign in with Google in the desktop app, we request the openid, https://www.googleapis.com/auth/userinfo.email and https://www.googleapis.com/auth/userinfo.profile scopes. We receive basic profile information from the profile scope, which may include a profile image URL and locale; we store only your Google account name, email address and unique Google account identifier (sub), and we verify that Google reports your email address as verified. We do not receive your Google password. We do not request access to Gmail, Google Drive, Google Calendar, Google Contacts, YouTube, location history, or any other Google content.

Library content

Files you import are processed on your device. The Memverix desktop app stores managed copies, extracted text, page and time anchors, embeddings and search indexes in its private application data directory on your Mac. Original files remain in the locations you chose. The public gateway does not store your library, extracted text, embeddings or vectors.

Assistant connection data

To connect an AI assistant, Memverix operates an OAuth authorization server at memverix.evognix.com. The gateway stores technical OAuth records in a SQLite database on its host: client registration, authorization codes, access tokens, refresh tokens, grants and sessions, together with a hashed device credential in the server configuration. Access tokens expire after one hour. Refresh tokens and grants expire after 30 days unless revoked sooner. Approval codes and in-flight MCP requests are held in memory only and are not written to persistent storage. Query text and returned evidence pass through the gateway in transit.

Website and technical data

We do not use analytics, advertising or tracking pixels on this website. The gateway sets strictly necessary cookies for OAuth session and CSRF protection. It is not an advertising cookie and is not used to profile you across sites. We may process your IP address in memory for rate limiting. Our content delivery and hosting providers may process IP addresses and request metadata and set security cookies to deliver and protect the Service. Nginx access logging is disabled, and application error logging omits request details.

3. How we use information

• To authenticate you and maintain your account record.
• To authorize and operate assistant connections, including verifying approval codes and issuing, rotating and revoking OAuth tokens.
• To route search requests to your paired Mac and return the evidence you requested.
• To secure the Service, prevent abuse and enforce rate limits.
• To diagnose failures and maintain reliability, using data that does not include request contents.
• To comply with applicable law and respond to lawful requests.
• To respond when you contact support.

4. Google User Data

This section applies specifically to information received from Google APIs.

What we collect from Google

• Your Google account name.
• Your Google account email address.
• Your unique Google account identifier (sub).
• Whether Google reports your email address as verified.

We request only the basic OpenID Connect identity scopes listed above. We do not receive Google content such as email messages, files, calendar events, contacts or videos.

How we use Google User Data

• To authenticate you when you sign in.
• To create, identify and display your local Memverix account.
• To protect the Service against unauthorized access and fraud.

We do not use Google User Data for advertising, profiling, resale, or to develop, improve or train generalized AI or machine-learning models.

What we do not do

• We do not sell Google User Data.
• We do not use Google User Data for advertising or marketing.
• We do not allow humans to read Google User Data unless you give us affirmative consent, we need it for security or abuse investigation, or applicable law requires it.
• We do not store Google access or refresh tokens. An access token is used in memory once to retrieve your verified identity and is then discarded.

Sharing Google User Data

We do not share Google User Data with third parties except: (a) with your explicit consent; (b) when required by applicable law, regulation, valid legal process, or to protect the rights, property or safety of Memverix, our users or the public; or (c) as part of a merger, acquisition or sale of assets, where the recipient is bound by this policy and we notify you. We do not transfer Google User Data to service providers, advertisers or data brokers. We do not share Google User Data with the AI assistant you connect; the assistant receives only the queries and library evidence you authorize.

Limited Use

Memverix's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion of Google User Data

Your Google account record is stored locally in the Memverix app data directory and remains until you sign out, delete the app data, or uninstall the app. Signing out deletes account.json. Because we do not retain Google access or refresh tokens, there is no stored Google token for us to revoke. You can revoke Memverix's access to your Google account at myaccount.google.com/permissions. To request deletion of Google User Data we control, email [email protected].

5. How we share information

We do not sell or rent personal information. We may share information in the following limited circumstances:

• Your AI assistant. When you authorize a connection, the assistant receives the queries you send and the library evidence returned for them. That assistant is operated by a third party and is governed by its own terms and privacy policy.
• Hosting and delivery. We use cloud hosting and content delivery providers to operate the gateway and website. They may process technical data such as IP addresses, request metadata and OAuth session records on our behalf under confidentiality and security obligations. They do not receive your Google account record or your library content.
• Legal and safety. We may disclose information when required by law or valid legal process, or when necessary to protect rights, safety and the integrity of the Service.
• Business transfer. Information may be transferred as part of a merger, acquisition or sale of assets, subject to this policy and notice to you.

6. Data retention

• Google account record: stored locally until you sign out, delete the app data or uninstall the app.
• Library content: stored locally until you delete a source or remove the app data. Deleting a source removes Memverix's managed copy; it does not delete the original file you imported. SQLite pages, backups and file-system snapshots may retain copies for a period.
• Gateway OAuth records: retained only for their configured lifetimes (access tokens one hour; refresh tokens and grants 30 days) or until you revoke assistant access in the desktop app.
• In-memory data: approval codes and in-flight requests are discarded after delivery, timeout or restart.
• Legal retention: we may retain limited records longer when required by law or to resolve disputes and enforce agreements.

7. Security

We use TLS for public traffic, bind management services to loopback, require proof key for code exchange (PKCE) for OAuth, rotate refresh tokens, store only a hash of the device credential, and request the minimum Google scopes needed for sign-in. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Your choices and rights

You can sign out of Google in the app, revoke the app's Google access at myaccount.google.com/permissions, disconnect assistant access from the desktop app, and delete your local app data. Depending on where you live, you may also have the right to access, correct, delete, restrict or object to processing of your personal information, to data portability, and to withdraw consent. To exercise a right, email [email protected]. We may need to verify your identity before responding. You may also complain to your local data protection authority.

9. Children

The Service is not directed to children under 13, or under 16 where required by local law. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will delete it.

10. International processing

Memverix is designed to keep your library and Google account record on your device. The gateway is hosted in the country where our hosting provider operates, and technical data may be processed there. Where required, we use appropriate safeguards for cross-border transfers. Your use of Google and third-party assistants is also subject to their international data practices.

11. Changes to this policy

We may update this policy to reflect changes in the Service, law or our practices. We will post the revised policy on this page and update the effective date. If a change materially affects how we use Google User Data, we will provide additional notice where required.

12. Contact

Privacy questions or requests: [email protected]
General support: [email protected]