Privacy policy

This policy covers two separate things that are easy to conflate: what the Vaultic software does with your data once installed, and what happens to your data during the purchase itself.

Optional website analytics

Updated 11 November 2026. With your permission, this website uses PostHog (EU hosting) to count page visits and clicks leading to our Lemon Squeezy checkout, and Metricool for website visit statistics. We do not load either analytics service until you choose “Allow analytics”. You can reject analytics or withdraw permission using “Analytics preferences” in the footer. Your choice is remembered on this browser for up to 180 days.

PostHog uses a random browser identifier stored in local storage after permission. We send the page path and basic browser/device information. We strip query strings and URL fragments from PostHog events. We do not enable session recordings, automatic form capture or named user profiles. Network requests necessarily reach the analytics providers; PostHog IP anonymization is enabled for our project. Browser privacy signals (Do Not Track or Global Privacy Control) prevent analytics loading even if permission was previously given.

This website analytics is separate from Vaultic: no local Vaultic memories, conversations or files are collected through this website setup. Checkout clicks are not evidence of completed purchases. For provider information see PostHog privacy and Metricool privacy. Contact us using the details below to ask about website analytics data.

The software, once installed

Vaultic is local-first by design. Everything it stores — memories, transcripts, the knowledge graph, the relationship ledger — lives in one SQLite file on your own device (~/.memory_mcp/memory.db by default). There is no cloud component, no telemetry, and no external network call in normal operation.

Your content is encrypted at rest by default, using AES-256-GCM, before it's ever written to that file — a copied database or backup holds ciphertext, not readable memories. This can be turned off (MEMORY_MCP_CONTENT_ENCRYPTION_ENABLED=false) if you have a reason to, but it's on unless you choose otherwise.

By default nothing is downloaded when you run it. The embedding model is included in the package, so the server runs fully offline once it is installed. If you choose a different embedding model, that model is downloaded from Hugging Face the first time it runs.

The one exception: if you explicitly configure MEMORY_MCP_EMBEDDING_PROVIDER=api to use an external embeddings API instead, memory content is sent to whatever API you configured — that is an explicit choice you make, not the default behavior.

Diagnostics are opt-in and off by default. If you turn them on (MEMORY_MCP_DIAGNOSTICS_ENABLED=true), a diagnostics snapshot contains only aggregate counts and version/platform strings — never memory content, transcript text, ledger claims, tags, or persona names. Nothing is sent anywhere automatically; exporting a diagnostics file writes it to your own disk for you to inspect and decide whether to share.

Licensing works the same way. Vaultic does not phone home to verify your license, check for updates, or report usage. There is no license-key validation server call, on install or afterward — deliberately, to keep "local-first and private" true rather than aspirational.

See the Security & privacy section of the product page for the full technical detail, including consent categories and audit logging.

The purchase

Payment is processed by Lemon Squeezy, acting as merchant of record. When you buy Vaultic, Lemon Squeezy — not this project — collects and processes your payment details, billing name, and email address, in order to complete the transaction, handle applicable sales tax/VAT, and let you re-download your purchase later. That data is governed by Lemon Squeezy's own privacy policy, not this one. This project only receives confirmation that a purchase was made, not your payment details.

Contact

This policy is issued by Patrick Morrison, trading as Morrisons AI Solutions, VAT number IE7181577J, of Boyle, Co. Roscommon, Ireland.

Questions about this policy: morrisonsaisolutions@gmail.com