Privacy Policy

Your account

Hosted accounts are existing-only; new sign-ups are closed, and local mode needs no account. For an existing account, we hold your email address, and you sign in with a password, which Supabase Auth handles, or with Google.

Coding sessions

When a session ends, or when you run membral sessions, the CLI uploads the transcripts of the coding agents it supports (Claude Code, opencode, Copilot, Codex and others). For each session it keeps:

• what you typed and what the agent wrote back, including its reasoning text when the transcript holds it;
• which tools the agent called and which files it touched;
• text the agent wrote into files, up to 8,000 characters per write (the text an edit replaced is not kept);
• short digests of git, gh, glab and test-runner commands;
• the repo path, git remote URL and branch, start and end times, the models used, token counts, and which sub-agents ran.

By default only the last 30 days are uploaded. Older sessions go up only if you ask with --all or --since.

At setup you choose which projects sync; the choice is saved in ~/.membral/sync.json. A project you switch off is skipped. A project that is not in the list yet syncs by default, unless you set defaultNewProjects to false.

Prompts, for recall

Before each Claude Code prompt of four or more words, a hook sends the first 2,000 characters of the prompt to the server, which looks up past records about it. The prompt text is not stored. The hook's local log, ~/.membral/hook.log, never holds the prompt.

When your agent searches with memory_search, the server stores the search text and which records it returned.

Chats

If you use the Chrome extension or membral import, your ChatGPT and Claude.ai conversations are uploaded too.

No analytics

The web app includes no analytics or tracking library.

• The output of the tools the agent ran (file reads, command output) is dropped before upload, for every supported agent. Only whether the call succeeded is kept.
• Shell commands other than git, gh, glab and test runners are not kept, only the tool name.
• Text shaped like a key, token or password is replaced with [REDACTED] before it is stored. This works by known patterns, so a secret in an unusual shape can get through.
• When the agent writes to a file that looks like a secret store (.env, private keys, .npmrc, .netrc, credentials files and similar), no text is kept, only the path.
• Phone numbers and email addresses are removed from the records extracted from your sessions.
• API keys are stored only as a SHA-256 hash.
• The Chrome extension reads your claude.ai and chatgpt.com session cookies only to fetch your conversations from those sites. Its sync code does not send them to Membral.

• In a hosted Postgres database on Supabase. Tables have row-level security, so a signed-in account can read only its own rows. Server code that reads with the database's admin key filters by your account id.
• We run the service and hold that admin key, so we can technically read stored data. Nothing in the product shows your data to another account.
• The Supabase database is deployed in Singapore.
• The web app and its API run on Vercel. Their functions have been observed running in Vercel's Singapore region (sin1).
• Each API key or device key belongs to one account, and a key can be limited to one code project.

Supabase

Hosts the database and handles sign-in.

Vercel

Hosts the web app and the API.

OpenRouter

Today, on membral.me, the server sends model calls through OpenRouter: session text goes to a Google Gemma model to extract decisions and findings, and record text, search text and recall prompts go through the same OpenRouter key to build embeddings for search and to answer chat. You set up no key. Extraction is on by default for every account and covers sessions from the last 30 days. The operator may change providers, and this page is updated when that happens. Running extraction through a Claude Code login is refused on the hosted service. If you run Membral yourself, you choose the model provider (see "Run it fully local").

Google

Only if you choose to sign in with Google.

• Your account. In Settings, "Delete my account" deletes the account and every row tied to it. This cannot be undone.
• A device key. Revoke it in Settings.
• Export. "Export my data" in Settings gives an NDJSON file with your profile, your chat conversations and the memories taken from them.

Not available yet:

• Deleting one coding session or one extracted record. Only deleting the whole account removes them.
• Exporting your coding sessions or the records extracted from them.

Retention: your data is kept until you delete it. Deleting your account deletes your data. There is no automatic deletion after a number of days yet.

Switching a project off in ~/.membral/sync.json stops future uploads; what was already uploaded stays until you delete the account.

membral local up runs the whole service in Docker on your machine, with its ports open only on 127.0.0.1. Nothing leaves the machine except the calls extraction makes to the model you choose:

• your Claude Code login (claude-code): session text goes to Anthropic under your own account;
• a hosted model with your own API key: session text goes to that provider;
• a local Ollama model: nothing leaves your machine;
• no model: import, session pages, keyword search and MCP still work, and nothing is extracted.

The setup is in the README.

• Supabase Auth cookies keep you signed in.
• membral_theme remembers your light, dark or system choice.
• membral_tz remembers your time zone, so dates show in your local time.

No tracking or advertising cookies.

Questions: support@membral.me.