The short version: your data is yours, it's encrypted in transit and at rest, and we don't sell, share, or train on any of it.
What we store
For every account:
- The transcripts of your voice and text messages.
- The structure the AI pulled out — reminders, people, lists, dates, places.
- Your reminders with their times and recurrence rules.
- On Archive, the original audio files of voice notes. On Defrag, audio is deleted after thirty days; transcripts stay.
That's it. We don't store your contacts, your location, or anything from outside Working Memory.
Where it lives
Everything sits in Cloudflare's data infrastructure:
- Transcripts, reminders, and structured data live in Cloudflare D1 — a SQL database.
- Voice audio lives in Cloudflare R2 — object storage.
- Search index lives in Cloudflare AI Search — what lets the app answer questions across your history.
Data is hosted in Cloudflare's global network. Cloudflare are SOC 2 certified and ISO 27001 certified.
Encryption
All traffic to and from Working Memory is encrypted in transit with HTTPS / TLS. Your voice note, your text message, the AI's answer — none of it travels in the clear.
Voice audio at rest is encrypted by Cloudflare's storage layer. The transcript database is encrypted by the same layer.
Who can see your data
You. Your data is scoped to your account and only your account can read it.
We don't sell your data, we don't share it with advertisers, and we don't bundle it with other users' data for analytics. The only humans at Working Memory who can read individual account data are engineers responding to support cases you've asked us to look into. Routine operations — deploys, monitoring, alerts — don't expose user data to staff.
How the AI fits in
The AI that transcribes your voice and parses structure is a Google model (Gemini). When you send a message, the audio or text is sent to Gemini, processed, and returned. Under the Vertex AI terms we use:
- Google does not train on your data. The content of your messages isn't used to improve their models.
- Your data isn't retained by Google after processing beyond a short operational window.
We don't train any model of our own on your data either. There is no "us" model.
How long things are kept
- Transcripts and structured data stay as long as your account exists.
- Voice audio stays for thirty days on Defrag, indefinitely on Archive.
- Deleted items are soft-deleted for one year, then permanently wiped by an overnight sweep. See Deleting your data for the full picture.
Your rights
You can export, delete, or get a copy of your data at any time. Email support and we'll honor it.
If you're in a jurisdiction with specific data rights (GDPR, CCPA, others), the same applies — those rights are the floor, not the ceiling. We treat every account the same way.