Effective 5 September 2026. Version 2 — 19 September 2026. This page says exactly what is stored, where, for how long, and who can see it.
| Data | Where | How long |
|---|---|---|
| Account: email, display name, password hash | Postgres (control plane) | Until you close the account |
| Workspace structure: spaces (buckets in the API), groups, grants, keys (hashed), connected apps, audit log | Postgres | Until deleted by an owner; audit and event logs 365 days |
| Memory records: decisions, lessons, preferences, people, projects, topics, with links and provenance | ArcadeDB, one database per workspace | Never deleted by the service while the workspace exists; a correction is stored as a supersession, so the prior version stays as history, not as a live record |
| Verbatim excerpts (short quotes that support a record) and observations (atoms) | ArcadeDB | Same as records |
| Transcript slices sent for extraction | Postgres job queue | Deleted when the job finishes, unless "keep transcript text" is on |
| Usage events: which records were recalled, read, cited, by whom | Postgres | 90 days raw; aggregates kept |
| Backups | Nightly Postgres (control-plane) dumps and nightly ArcadeDB (memory-database) backups on the VPS (/root/arcade-backup.sh), plus an encrypted off-site copy of each night's control-plane dump published as a GitHub release asset (scripts/offsite-backup.sh; see Subprocessors) | On the server: the 14 most recent control-plane dumps (14 days at nightly cadence), and the 7 most recent backups per memory database. Off-site encrypted copies: 14 days, oldest pruned automatically. Closing an account or deleting a workspace propagates through every one of these within the 30 days Terms promises. |
Anything wrapped in <private>…</private>. The client removes it before sending, and the server removes it again if it sees it. Tool output from coding sessions is never sent; only what was said, and one line naming the files and commands touched.
Only people and agents granted access to a space, at the capability the grant allows. Personal spaces are visible only to their owner and the agents that person connects; not to admins or the workspace owner. Agents are capped by a ceiling and a per-bucket switch. Every grant, key and connected app is listed in the app and revocable.
Text is processed by the model endpoint configured for your workspace. If your workspace has not configured one, it runs on the platform's default endpoint, operated by [TO CONFIRM: default model provider]. Nothing is sent to any other provider. We do not train models on your data.
| Subprocessor | Purpose | Region |
|---|---|---|
| Hetzner | Application, database and ArcadeDB hosting | Ashburn, VA, US |
| GitHub | Storage for encrypted, off-site backup copies (release assets on a private repository) | US |
| Stripe | Payment processing and billing | US |
| Your workspace's configured model endpoint, or the platform default ([TO CONFIRM: default model provider]) | Chat, extraction and dreaming | Depends on the endpoint chosen |
Usage events are kept 90 days as individual rows, then only as aggregates. Audit log and event log rows are kept 365 days. Memory records, once superseded, are kept as history rather than deleted — nothing in a workspace's memory graph is deleted while the workspace exists. Backup copy retention (off-site and on-VPS) is listed once, in the Backups row of the table above.
You can close your personal account or delete a workspace you own from Settings. Deleting a workspace removes its control-plane rows (members, groups, grants, keys, connected apps, audit log) and drops its entire memory database — every record, excerpt and observation in that workspace's ArcadeDB database is destroyed, not superseded. This is irreversible once backups holding it have also rolled off — within 30 days, across every backup layer (see Backups above). Closing your personal account removes your login and personal spaces; it does not remove a shared workspace you do not own.
Export, correction (as supersession), and deletion of your account or workspace, as described above. Contact: [TO CONFIRM: privacy/support contact email].
[TO CONFIRM: operating entity name, registered address and jurisdiction].