your memory, held like it matters.

This policy covers innernet.live, innernet's hosted MCP server, and the innernet plugin used from ChatGPT, Codex, Claude, Cursor, and other AI clients. It explains what innernet itself receives and stores. A connected AI client also processes the information you send to it and the tool results it receives under that provider's own privacy policy.

• Account and contact data. Your email address, sign-in provider, name or profile details you choose to provide, account settings, email preferences, how innernet appears in your AI conversations (the window, the source line, or neither), and messages you send to support. We use these to create and secure your account, communicate with you, and provide support.
• Your memory and work. Projects, dimensions, pages, nodes, captures, personal facts and their privacy class, evidence, tasks, artifacts and fragments, handoffs, branches, commits, project narratives, and capture rules. We store and process these to retrieve, version, search, consolidate, and return the memory you ask innernet to keep.
• Agents and their memory. The agents you register (their name, what they do, whether they work for you or for other people, their settings, keys, webhook address, and status), the memories each agent keeps, which subject each memory is about (the agent itself, one of the agent's users identified by an id you supply, or you), and a ledger of what each agent did, kept as counts and identifiers without the words. We use these to keep each agent's memory, return it to that agent, and show you what every agent keeps and has learned about you.
• Collaboration and sharing data. Shared spaces, membership, invitations, tasks, activity, and share links. We use these to show shared work to the people you invite and to enforce their permissions.
• Connections and credentials. Connected-client details, approved OAuth scopes, hashed access and refresh tokens, authorization state, and API-key metadata. We use these to authenticate the AI clients and developer tools you choose to connect. Secret credentials are hashed or encrypted at rest; we never ask you to paste an innernet API key into an AI conversation.
• Tool and service metadata. Which tool or resource was called, whether it succeeded, duration, time, IP address, user agent, rate-limit events, connection activity, and short session signals derived from innernet tool use. We use these to operate the MCP service, keep a working session, prevent abuse, diagnose failures, and maintain a 90-day security audit trail. Audit records do not contain the body of your memory.
• Website analytics and diagnostics. Page and feature use, referral and campaign source, device/browser information, account identifier after sign-in, masked session-replay interactions, and technical error and performance reports. We use these to understand whether the product works and where it fails. We do not send memory bodies, prompts, tool arguments, or tool outputs to analytics providers.
• Community skill data. If you ask to publish a skill, we process its title, description, markdown, tags, licence, source URL, author name/profile, your identity as the person who posted it, and an author email only when the author made it public or it was explicitly supplied for a one-time notice. We use these details to publish and attribute the skill, prevent duplicates, notify its author, and handle withdrawal or attribution disputes.

The innernet plugin currently exposes 42 tools. They fall into the following data flows:

• Read and search tools receive a project, page, artifact, task, branch, skill, or search selector and may receive a short task-specific intent. They return only the matching project memory, personal facts permitted by their privacy class, tasks, artifacts, handoffs, branches, or public skills, plus links needed to open the result.
• Write tools receive the text and metadata you or your AI client explicitly supply for a capture, page, personal fact, task, artifact, handoff, branch action, capture rule, or saved community skill. They return the saved result or a receipt, including stable item identifiers when the client needs them to continue the workflow.
• The export tool receives an optional project and, when asked, the names of particular files. It returns an index of your archive (file names, sizes and counts) and where you can download it, plus the full text of only the files named, within a size limit. Personal facts appear only as far as your privacy settings let that client read them; anything held back is a count, never its content.
• Delete tools receive the specific project or item identifier and a confirmation. They first return a preview, then return the deletion result after the confirmation step.
• Session tools receive pause/resume commands or no content at all. They return the current innernet session and view state: what innernet read and saved in this conversation, counts, the newest commit it holds for a code project, and links into your own dashboard. Session state is derived from innernet tool use, not from a copy of the surrounding conversation.
• The source line. Reads and saves can also return one short line naming where the answer came from or where something was saved, with links into your dashboard, and how many private facts were held back. It carries a count, never the content of anything private. Your AI client may show it at the end of a reply; you can turn it off, or the window, in Settings under “in your chats”.
• Community tools receive a skill query or, only when you ask to publish, the skill content and attribution described above. Finding a skill returns public results. Publishing makes the skill content, attribution, licence, and source link public at innernet.live; author contact details are never published.
• Room tools receive an optional room name. They return the rooms you stand in (name, your role, how many people, the plan), who stands in a room you name (display names and roles, never an email), and what you yourself added to it. What you add to a room is shared with its members. What a room keeps back is never stored: only a short reason, which only you can read.

innernet does not receive your full ChatGPT or other AI conversation. It receives only the arguments the AI client sends in a tool call and the resources you select. Do not send passwords, payment-card details, government identifiers, health records, or other information that is not needed for the memory task. Tool results go back to the AI client that made the call, so that provider may retain them as part of your conversation.

• Every agent belongs to a person. An agent's memory is part of its owner's account. It is kept apart from every other agent and is reachable only by the owner and by keys made for that agent; a key made for one agent cannot read another agent or the owner's projects, and reaches the owner's personal memory only as deeply as the owner allows that agent to read it.
• What an agent learns about you. When an agent keeps something about the person who owns it, that memory is offered to their personal memory only as their settings allow: held for their approval (the default), filed automatically, or not offered at all. Anything filed is marked as an agent's note, never as the person's own words, and is given the most private disclosure level the settings require.
• The people an agent serves. If you build an agent that works for other people, you decide what it sends us about them and under which id. For that data you are responsible for having a lawful basis and for informing those people, and innernet processes it on your behalf to provide the memory you configured. It is never added to your own personal memory, and you can delete everything an agent keeps about one person in a single request.
• What an agent may read of you. An agent can be allowed to read part of its owner's personal memory, at the depth the owner chooses (by default, the same as any app connected to innernet). A key or connected app can narrow that depth, never widen it. Every read of the owner's memory is counted in the agent's ledger, and what is released to a key is recorded against that key.
• Before anything is stored. Depending on an agent's settings, email addresses, phone numbers, keys and passwords, and payment-card numbers are replaced with markers before a memory is stored or sent to a model.

Retrieval can work without a model call. When a model helps rank which saved sections answer an ask, it is one of those described in this section. When you ask innernet to consolidate captures, derive facts, triage memory, fold an artifact, extract an agent's memories from what it was told, or run another AI-assisted feature, the relevant task text is sent to Anthropic (Claude) under innernet's API account. If Anthropic cannot answer, the same task may instead be sent to DeepInfra or Fireworks, which serve as the failover. We use whichever supported model and failover route is configured for that feature; model names may change without changing this purpose. Anthropic does not use inputs or outputs from its commercial API to train its models by default, and keeps them only for a limited period under its commercial terms. DeepInfra and Fireworks state that their hosted open-model inference has zero data retention by default. We do not use your memory or inference inputs and outputs to train third-party models, and we do not train our own model on identifiable memory content.

To find the sections that answer an ask even when they use different words, innernet may turn the text of your sections and of the ask into embeddings (numbers that stand for what a passage means) with an open embedding model served by DeepInfra, or the same model through Vercel's AI Gateway. Embeddings are held only in server memory, briefly, and are never written to our database.

Some quick decisions, such as which saved sections answer an ask, how a new capture is sorted, and what kind of request a message to netti is, are made by TypeSafe's System One decision model, reached through OpenRouter. These calls carry the ask or the capture being sorted, short section text, and, when your settings let the asking app see them, the personal facts that may bear on the ask. They return choices and scores, never written text. Zero data retention is requested on every call through OpenRouter, and OpenRouter enforces it when it routes the request. If OpenRouter cannot answer, the call is not sent anywhere else, and innernet carries on without it. A deployment of innernet without OpenRouter would send the same calls to TypeSafe directly or through Vercel's AI Gateway instead, without that request.

We do not sell or rent personal data. Data is disclosed only as needed for the service:

• Your connected AI provider — including OpenAI when you use the ChatGPT or Codex plugin — receives the tool output it requested. Its own policy applies after the result enters that service.
• Supabase — database, authentication, and account storage.
• Vercel — application hosting, delivery, and request logs.
• Anthropic — server-side model inference (Claude) when an AI-assisted innernet feature runs.
• DeepInfra and Fireworks — server-side model inference as the failover, only when Anthropic cannot answer.
• DeepInfra also computes the embeddings retrieval uses, from section text and the ask. They stay in server memory and are never stored.
• TypeSafe makes System One decisions: it picks which saved sections answer an ask, sorts captures, and reads what kind of request a message to netti is. It sees the ask and short section text, and zero data retention is requested on every call through OpenRouter.
• OpenRouter routes those decision calls to TypeSafe, with zero data retention enforced per request.
• PostHog — product analytics and the screened recordings described below.
• Google Analytics — cookieless, consent-mode aggregate website analytics.
• Sentry — technical error and performance diagnostics when configured.
• Resend — transactional email and community-author notices.
• Your agents and their webhooks — an agent you build, and any webhook address you set for it, receive that agent's memories and the events you choose (for example a memory created or forgotten). Signed deliveries go only to the https address you set.
• Optional services you connect — for example Notion or a third-party sign-in provider — receive only the data needed for the action you request.
• People you choose receive content through a shared space or share link. Anyone can receive content you deliberately publish to the public skill community. Public copies and search-engine caches may remain outside our control after you withdraw a publication.
• Authorities or transaction parties may receive data if law requires it, to protect people and the service, or as part of a merger, financing, or sale, subject to appropriate confidentiality and notice where legally permitted.

• Account, memory, collaboration, and session data: while your account or the relevant project/item remains active. Version history is intentionally kept with the project until you delete the item, project, or account.
• Shared links and invitations: until you revoke them, they expire, or the underlying content/account is deleted.
• Public skills: while published. You can withdraw a skill you posted. We may keep a restricted provenance, notice, and moderation record after withdrawal for as long as needed to resolve attribution, licence, safety, or abuse disputes.
• OAuth and API credentials: authorization codes expire after 10 minutes, access tokens after 1 hour, and refresh tokens after 30 days. API keys last until their chosen expiry or until you revoke them. Expired and revoked credentials are removed or rendered unusable.
• Temporary MCP work: asynchronous tool-task records expire after 1 hour. Read results are not stored as a second permanent copy, although the underlying memory, short session state, and audit record may remain under the periods listed here.
• Agent memory: until it expires under the agent's retention settings or an expiry set on the memory (expired memories are deleted, not hidden), until you or the agent forgets it, or until the agent is removed, which deletes its memory, keys, webhook, and ledger. Memories you kept from an agent become part of your personal memory and follow its periods. An agent's ledger is kept for up to 400 days.
• Security audit events: 90 days.
• Raw analytics: up to 14 months. Masked session replays and technical error events are kept for up to 90 days. Anonymous aggregate statistics may be kept longer because they no longer identify an account.
• Transactional email and support records: up to 24 months after the communication, unless a longer period is required for a dispute or legal obligation.
• Account deletion: active account data is deleted immediately and encrypted content keys are destroyed where available. Backups age out within 30 days. Content already sent to an AI client, collaborator, public visitor, or another service must be removed through that recipient where applicable. Content-free usage and audit rows may remain in de-identified form.

• Review the requested read/write scopes before connecting an AI client, and revoke a connection or API key from your account at any time.
• Read, edit, version, or delete memory in innernet. Destructive plugin tools require a specific target and confirmation. You can also pause ambient session capture.
• Choose a disclosure level for personal facts. innernet enforces that level when a connected client asks for personal memory.
• See every agent you own in your agents space: what each keeps, what it learned about you, and what it read of you. Keep or let go of anything an agent offers, change how each agent remembers, pause it, end its keys, forget one of its users, export it, or remove it.
• Control collaborators, shared links, and invitations. Publishing to the skill community is a separate deliberate action, and you can withdraw a skill you posted.
• Download everything innernet holds for you as one archive in an open format (markdown and JSON): every project map with its full history, your personal memory with its sources and earlier versions, handoffs, tasks, documents, and connection metadata, from Settings under “data” at /dashboard/settings, or through the API at GET /api/v1/export. Contact us for a complete access or portability request, or to correct, restrict, object to, or delete personal data where applicable.
• Delete your account from the same page. You can also block analytics scripts through browser controls; analytics are not required to use your stored memory.

• Access controls. User data is protected by row-level access rules and server-side authorization checks. Connected tools receive only the OAuth scopes you approve.
• Credential protection. API keys and OAuth tokens are hashed or encrypted at rest. Session cookies are HttpOnly and Secure.
• Content encryption. Current memory supports server-managed envelope encryption at rest, with separate data keys for each project and personal-memory scope. This is not end-to-end encryption: innernet's server can decrypt authorized content so retrieval, search, and memory-agent features work.
• Data minimisation. Tool responses omit internal account identifiers, credentials, and diagnostics unless an identifier is necessary to continue the task.

We use PostHog to understand where people get stuck on innernet.live. A replay can reconstruct clicks, scrolling, navigation, and the shape of a page. It does not follow you to other sites. Only 20% of eligible sessions are sampled.

Before a recording leaves your browser, all page text and form inputs are masked. Surfaces containing projects, dimensions, nodes, captures, artifacts, Netti conversations, search results, files, and folders are blocked entirely and replaced by blank shapes. We disable console capture and do not record network request bodies or headers. Sensitive authentication parameters are stripped from captured URLs.

PostHog uses local storage rather than cookies. Anonymous visitors receive an analytics identifier; after sign-in, product events are linked to your account identifier and email. Google Analytics runs in consent mode with analytics storage denied by default. We do not use advertising cookies or sell analytics data.

innernet is free today, and we hold no card or payment details. If paid plans open, checkout will happen on innernet.live through a PCI-compliant payment processor. Card details will go directly to that processor, not to innernet. Before the first charge, this policy will name the processor and explain the billing data and retention involved. Nothing is sold inside a connected AI tool.

For privacy requests or questions, email yours@innernet.live. For a suspected security issue, use the same address with the subject “security” or see our security policy.