Privacy policy

This policy covers two separate things that are easy to conflate: what the memory-mcp software does with your data once installed, and what happens to your data during the purchase itself.

The software, once installed

memory-mcp is local-first by design. Everything it stores — memories, transcripts, the knowledge graph, the relationship ledger — lives in one SQLite file on your own device (~/.memory_mcp/memory.db by default). There is no cloud component, no telemetry, and no external network call in normal operation.

Your content is encrypted at rest by default, using AES-256-GCM, before it's ever written to that file — a copied database or backup holds ciphertext, not readable memories. This can be turned off (MEMORY_MCP_CONTENT_ENCRYPTION_ENABLED=false) if you have a reason to, but it's on unless you choose otherwise.

The one exception: the default embedding provider (FastEmbed) downloads its model from Hugging Face the first time it runs (roughly 50MB). After that first run, it's fully offline. If you explicitly configure MEMORY_MCP_EMBEDDING_PROVIDER=api to use an external embeddings API instead, memory content is sent to whatever API you configured — that is an explicit choice you make, not the default behavior.

Diagnostics are opt-in and off by default. If you turn them on (MEMORY_MCP_DIAGNOSTICS_ENABLED=true), a diagnostics snapshot contains only aggregate counts and version/platform strings — never memory content, transcript text, ledger claims, tags, or persona names. Nothing is sent anywhere automatically; exporting a diagnostics file writes it to your own disk for you to inspect and decide whether to share.

Licensing works the same way. memory-mcp does not phone home to verify your license, check for updates, or report usage. There is no license-key validation server call, on install or afterward — deliberately, to keep "local-first and private" true rather than aspirational.

See the Security & privacy section of the product page for the full technical detail, including consent categories and audit logging.

The purchase

Payment is processed by Lemon Squeezy, acting as merchant of record. When you buy memory-mcp, Lemon Squeezy — not this project — collects and processes your payment details, billing name, and email address, in order to complete the transaction, handle applicable sales tax/VAT, and let you re-download your purchase later. That data is governed by Lemon Squeezy's own privacy policy, not this one. This project only receives confirmation that a purchase was made, not your payment details.

Contact

This policy is issued by Patrick Morrison, trading as Morrisons AI Solutions, VAT number IE7181577J, of Boyle, Co. Roscommon, Ireland.

Questions about this policy: morrisonsaisolutions@gmail.com