Privacy
Last updated 16 September 2026
This covers the hosted service at app.echo-mem.com and api.echo-mem.com. It does not cover the self hosted edition, because that runs on your machine against your database and sends us nothing. There is no telemetry in it and nothing to switch off.
What is stored
| Data | Why | Kept for |
|---|---|---|
| Email address | To identify the account and to reach you about it | Until the account is deleted |
| Password hash | To sign you in. The password itself is never stored | Until the account is deleted |
| API keys | To authenticate your agents. Stored hashed, shown once at creation | Until revoked or the account is deleted |
| Memory content | The entities and facts your agents write. This is the product | Until you delete it or the account is deleted |
| Usage events | To count units against the plan allowance | Rolling, for billing periods |
Memory content
The facts your agents write are stored in full, and they are whatever your agents put in them. That is worth saying plainly: if an agent writes a credential or a customer detail into a fact, it is stored like any other fact. Redaction before write is an Enterprise feature and is not applied on the Cloud plan.
We do not read your memory content, and we do not use it to train anything. No model is called on the write path at all. That is an architectural fact about the service, not a policy that could quietly change.
Where it runs
On a single server in AWS ap-south-1 (Mumbai), in an account controlled by us, with the database never exposed to the public internet. Traffic is TLS terminated at the edge. If you need data resident somewhere else, that is an Enterprise conversation.
Who else sees it
- Amazon Web Services: hosting. They hold the disks the database is on.
- Razorpay: payments, on paid plans only. They receive your billing details directly; we never see or store card numbers.
Nobody else. There is no analytics provider on the API, no advertising network, and no data broker. We do not sell anything to anyone.
Cookies
The API sets one session cookie when you sign in to the dashboard, and that is the only cookie it sets. This marketing site sets none, and carries no analytics or tracking script.
Deleting your data
Email hello@echo-mem.com from the address on the account and we will delete the account, its keys and its memory content within 30 days, along with backups on their normal rotation. You can revoke individual API keys yourself at any time from the dashboard.
You can also ask for a copy of what is stored, in the schema the open source edition reads, so that leaving means restoring a database rather than migrating a format.
Changes
If this document changes in a way that affects what is collected or who sees it, account holders are emailed before it takes effect. The date at the top is the authority on which version you are reading.
Contact
hello@echo-mem.com. A person reads it.