DRAFT — NOT IN FORCE. Written by our AI crew from the structure shared by five AI-memory companies' policies (mem0, Zep, Letta, Supermemory, Cognee) and the facts of how this site works. It is not legal advice. Items marked [TODO] need Ivo's answer, and the final text should be reviewed by a lawyer before the site collects real sign-ups.
Privacy Policy
Last updated: [TODO: date it goes live]
1. Who we are
This website and the NEME software are run by 0x2AI [TODO: legal entity name, address, country]. Questions about privacy: [TODO: privacy@0x2ai.com or another address].
2. The short version
- NEME is software you run on your own machine. Your agents' memory, messages and files stay on that machine. We never receive them.
- This website collects one thing on purpose: the email address you give us to get beta access, plus your yes/no for release updates.
- We don't sell your data, don't show ads, don't use analytics or tracking cookies, and don't use your data to train AI models.
3. The NEME software (self-hosted)
When you install NEME, everything it stores (memory, chat, mail, tasks, files, provider keys) lives on your hardware, under your control. We have no access to it. The bridge does not start connections of its own, with three exceptions you choose: the optional model download from Hugging Face, calls to an AI provider whose key you added, and services an administrator configures. Data you send to those providers is governed by their own privacy policies. NEME also has an offline lock mode that refuses all outbound connections.
4. What this website collects
| Data | Why | Legal basis (EU/UK) |
|---|---|---|
| Email address | To send your sign-in link and give you access to the beta download | Contract (you asked for access) |
| Release-updates choice (off by default) | To send product updates only if you ticked the box | Consent, which you can withdraw at any time |
| Account ID, sign-up time, where you signed up ("site") | To record that you signed up and avoid duplicates | Legitimate interest in running the beta |
| Technical data our providers log (IP address, browser, time of request) | To deliver the pages and emails and keep them secure | Legitimate interest in security and operation |
We don't ask for your name, payment details or anything else on this site. Purchases, when offered, go through our payment provider (Lemon Squeezy), which has its own policy.
5. Cookies and local storage
We set no tracking, analytics or advertising cookies. After you click your sign-in link, the login library keeps your session in your browser's local storage so you stay signed in; it also briefly remembers your release-updates choice between the sign-up form and the account page. Both are strictly necessary for the service you asked for. Signing out clears the session. Our fonts are currently loaded from Google Fonts, which receives your IP address [TODO: self-host fonts and delete this sentence].
6. Who we share it with
We share data only with the service providers that run this site for us, under their data-processing terms:
| Provider | What they do |
|---|---|
| Supabase | Sign-in, the sign-up database, and the download file |
| Resend | Sends the sign-in and update emails |
| Cloudflare | Hosts and delivers this website |
| Google Fonts | Delivers the page fonts (to be removed) |
We may also disclose data if the law requires it. We don't sell or rent personal data, and we don't share it for advertising.
7. How long we keep it
We keep your sign-up while you have beta access. If you ask us to delete it, we delete it within [TODO: e.g. 30 days]. Provider logs are kept for the providers' standard periods.
8. Your rights
Wherever you live, you can ask us to show you, correct, export or delete your data, and to stop sending you updates [TODO: add an unsubscribe link to update emails before sending any]. If you are in the EU/UK you may also object to or restrict processing, and complain to your data protection authority. If you are in California, you have the right to know, delete and correct your data, and we do not sell or share it as defined by the CCPA. Email us at the address in section 1; we answer within 30 days.
9. Where data is processed
Our providers may process data in the United States and other countries. Where EU/UK data is transferred, we rely on our providers' Standard Contractual Clauses or the EU-US Data Privacy Framework. [TODO: confirm Supabase project region]
10. Security
Data in transit is encrypted (HTTPS). Database access is restricted per user. No system is perfectly secure, and we will tell affected users promptly if a breach affects their data.
11. Children
This site and NEME are for developers and businesses, not for children under [TODO: 16 recommended]. We don't knowingly collect their data; if we learn we have, we delete it.
12. Changes
If we change this policy we'll update the date above, and for significant changes we'll email signed-up users before they take effect.