Privacy

Privacy policy

Kept Mems is a private collection of memories.

Describes the product as of 17 October 2026. This is a plain account of how it works, not a lawyer’s review.

Who to write to

The contact already published for Kept Mems is karna.jani@gmail.com.

Signing in

Sign-in is Google. Signing in lets you read your private collection in the browser. Signing in does not, by itself, connect ChatGPT.

The sign-in request asks Google for openid, email, and profile. From Google’s reply, Kept Mems keeps two fields:

• the email address
• the Google account subject (sub), stored as google_sub

Kept Mems checks that Google marks the email verified, and refuses the sign-in when Google says it is not. The verified flag itself is not stored. Google’s name and picture are not stored. The Google access token used for that one read is not stored.

The first sign-in opens an empty private collection for that Google account. Nothing is copied in from another account. The account row stores an id, a short name taken from the part of the email before the @ sign, the email, the Google subject, the time it was created, and a status value set to trial. A payment-customer field is on that row and starts empty. Subscribing opens Stripe Checkout for a free subscription: US$0 per month, in US dollars. No card is required while the price stays at US$0. Kept Mems stores the Stripe customer id, the subscription id, the subscription status, the current period end, whether cancellation is scheduled at the end of that period, and the times a renewal invoice was paid or a payment failed. Card numbers are not stored here. A missing or failed payment does not delete memories. Kept Mems does not take a card number inside ChatGPT or another assistant.

After sign-in, the browser gets a cookie named cw_session. It lasts 7 days, is HttpOnly, and is SameSite=Lax. It holds the Kept Mems account id, the email, an expiry, and a signature. It is not a Google token. Sign out clears that cookie. Signing out leaves the collection, keys, and any connected assistant in place.

While Google’s page is open, a second cookie named cw_oauth_state lasts 10 minutes. It holds a random value, the page to open after sign-in, an expiry, and a signature.

What stays in your account

Each account’s memories have a separate SQLite database, backed by its own Cloudflare Durable Object. Memory versions, links, file records, and publication records stay in that account’s database. This keeps one collection out of database queries for another account and reduces the risk that a mistaken query could mix or expose accounts’ memories.

A memory can hold a title, the prose, an attribution, an event date, whether it is marked as fiction, a status such as active or archived, and the times it was saved or changed. Earlier wording is kept as versions, with the reason recorded for a change. A stable idempotency key can be stored with a save so a retry does not create a second copy.

A file attached to a memory stores its file name, content type, size, and caption in that account’s database. The file itself is in shared Cloudflare R2 object storage under an account-specific path. A link between two memories stores which memories, a written explanation, and an optional short label.

Archiving hides a memory and keeps it stored. Permanent deletion, when you ask for it, removes that memory’s prose, earlier versions, files, links, and published copy. A short deletion record can remain: the memory id, the title, and the time. Removing one file or one link can leave a similar short record (the id, the file name or the explanation, and the time) so a repeated request is not treated as a missing item.

Publishing

Publishing is optional. A published copy is separate from the private memory. The assistant writes that copy as a telling for other people, in the language of the memory. Names can stay. Other personal details stay out. The private prose is not what is published. The copy stores that title and prose, whether it is marked as fiction, an event date, an adaptation note, and the files and captions selected for that copy. Later edits to the private memory do not change the published copy until it is published again. Withdrawing the copy hides it. The private memory stays.

Published copies from one account are listed on that account’s shelf, at their public name or at /u/ and their account id. Anyone with that shelf address can open the list and each copy. The shelf has its own search. It does not list any other account. The shelf and each copy ask search engines not to index them.

ChatGPT, Cursor, and Claude

Signing in on Kept Mems does not add ChatGPT. ChatGPT connects by adding the Kept Mems plugin: https://chatgpt.com/plugins/plugin_asdk_app_6acaef56653081918397a71fdea75984.

Cursor uses a personal access key against https://keptmems.com/mcp. You make that key on the account page after you sign in. The key is shown once. Kept Mems stores a hash of the key, the first characters, an optional name you give it, and the times it was made or revoked. The key itself is not stored again. Revoking a key stops that assistant from connecting with it.

Claude adds a custom connector for https://keptmems.com/mcp and signs in with the same Google account.

An assistant you connect can read and change that same private collection, within the tools that connection has. A Cursor key can use the full set, including archive and earlier versions. The ChatGPT connection can list, search, read, save, correct, and permanently delete memories, link and unlink them, attach and remove files, and publish or unpublish. Archive and the version-history tools are not on that ChatGPT connection. A connected assistant can also see the account id, the email, and the short account name. The name sent to that assistant is the email address.

Connecting through that assistant door stores the client’s name and redirect addresses, and hashed access and refresh tokens for the connection. An access token lasts one hour. A refresh token lasts 30 days and is replaced when it is used. Those tokens are created when the assistant connects. Google sign-in alone does not create them.

Where it runs

Kept Mems runs as a Cloudflare Worker. Account and control records — including account details, key hashes, assistant connection records, and billing state — use shared Cloudflare D1 infrastructure. Each account’s memory collection uses its own SQLite-backed Durable Object database. Attached files use shared R2 object storage under account-specific paths.

These boundaries keep memory databases separate, but they do not give every kind of data separate physical infrastructure, make breaches impossible, or prevent access needed to operate the service by its administrator or providers. Cloudflare’s own Worker logs are turned on. These pages do not set an analytics cookie.