Privacy Policy

Every section opens with a one-line plain-English summary. The summary is part of the promise, not decoration.

• alaMem is a memory product, so privacy is the product. Your content is private by default. No other member or organization can see it unless you share it, and the database itself enforces that.
• This is a private beta. Accounts come only from an invitation, from an organization's membership form, or from us directly.
• What we collect: who you are when you sign in; what you put in, including details stored inside your photos; what others put in about you; what you send through a form or the box on our front page; and the records any online service needs to run.
• We never sell your data, and we never use your content to train AI models. Anthropic, our AI provider, may not train on it either. Our engineering assistant's working sessions aren't used for training: a setting on the operator's plan turns that off (§3.4). One limit: our email service may train its own anti-abuse tools on email data (§4).
• AI is an optional upgrade. Without it, nothing you do in alaMem sends your content to an AI provider or a speech service. During the beta, AI is off for every account but the operator's own. (If you share something with a person who has AI, their AI can read it — §3.1.)
• An AI assistant helps us run alaMem. During the beta, Claude, an AI engineering assistant made by Anthropic, helps the operator build and run alaMem with the operator's own access. While it works, it can see account data, including messages sent to us. It changes no one's data without the operator's approval (§3.4).
• You control sharing. You share by granting access to people or groups. You can see your grants and remove them.
• Export and deletion are on request today. Write to us and we'll send you a copy within 30 days, or erase what you name, one item or everything, within 7 days (§7, §8).
• Every copy has a lifetime. Our backups are kept 14 days. Something deleted from alaMem is gone from every copy we keep within about three weeks, inside a 30-day promise. §6 lists the copies that promise doesn't reach yet.

Plain English: This policy explains what data alaMem handles, why, and who else touches it.

alaMem is operated by TimeShaker, Inc., a California corporation based in Portland, Oregon, USA ("alaMem," "we," "us"). Our website is alamem.com. In this policy, as in our Terms of Service, "the operator" means the person who builds and runs alaMem for TimeShaker, Inc.

This policy covers the alaMem service: the website, the app, the voice and AI features, and related tools. It also covers the websites and forms alaMem runs for organizations. When you send something to an organization through its form, that organization's own rules also govern what it does with it.

alaMem is in a private beta. Accounts come only from an invitation, from an organization's membership form, or from us directly. Features change often. When a change affects this policy, we update it (§12).

Please read this policy together with our Terms of Service.

Plain English: Who you are when you sign in, what you put in, what others put in about you, what you send us through a form, and the records any online service needs to run.

Your sign-in

• You sign in on alaMem's own sign-in page, with Google or with an email address and a password. Google runs the sign-in for us (Google Identity Platform).
• If you use a password, the page sends it straight to Google. alaMem's servers never receive it. Google stores only a scrambled (hashed) form of it.
• If you sign in with Google, we never see your Google password.
• Google's sign-in service keeps your sign-in record for alaMem: your email address, a permanent sign-in ID, when you signed up and last signed in, whether your email is verified, and — if you sign in with Google — the name and photo Google provides.
• alaMem itself keeps your permanent sign-in ID, your email address, and which sign-in service you used, and connects them to your alaMem account. Signing in never creates an account.
• Emails that verify your address or reset your password are sent by Google's sign-in service for us.

Your content

• Everything you deliberately put into alaMem: text, records, notes, stories, photos and other media, structured data (people, places, events, accounts, opportunities), and the connections between them. If your account includes AI, it also includes what you type or say to the AI.
• Photos. When you upload a photo, we read the date, camera, and location stored inside the file, and keep them with the photo's record. If the photo has a location, we look up the place's name (Google Maps Platform, §3). Where a photo was taken is shown only to whoever manages it: you, or for an organization's photo, the people who manage it. Everyone else who can see the photo gets a copy of the image with that hidden data removed, and never sees its location. Videos are shown only to their owner for now, because we can't yet remove a video's location.
• Addresses. When you save a street address, we send its street line and city to the US Census Bureau's address service, to place it on the map (§3).
• Voice. Voice conversations are part of the AI upgrade (§3.1). When you talk to alaMem, your speech streams to Google Cloud Speech-to-Text, which turns it into text. Spoken replies are made by Google Cloud Text-to-Speech. alaMem never keeps a recording. It keeps only what you ask it to save, and our service logs don't keep your words.

What others put in about you

Other people can put in things about you: an invitation sent to your email address, a family member's record of you, or an organization's directory that lists you. These belong to the person or organization that made them, under their sharing choices. If you think something about you is wrong or shouldn't be there, write to privacy@alamem.com.

The box on our front page

• The box asks only for your email address. When you send it, we keep your address and a one-time code, and we email you a link — through SendGrid, our email service (§3) — to check that the address is yours.
• If you click the link, the temporary copy of your address and code is deleted at once. We then save your message as a record in alaMem's own company records: your email address, the day, and any note you added. We also send a note to our company inbox, so a person can reply.
• We don't add you to a mailing list, and no alaMem account is created for you.
• If you don't click the link, your address and the code are deleted after about three days (72 hours).
• As with any visit, our service logs record your device's internet address and your browser type (kept 30 days). To stop abuse, our server counts how often each internet address uses the box. That count lives only in the running server's memory and is never saved. The address it counts is the one Google's network recorded for your visit. The page's fonts come from Google Fonts, which sees your internet address too.

Forms on an organization's site

• If you fill in a form on an organization's site — a membership application, for example — you are sending your answers to that organization, and alaMem keeps them for it.
• We email you a link to confirm your address. If you don't click it, your answers are deleted after about three days (72 hours).
• When you click it, the temporary copy is deleted, and we create an alaMem account for you that holds your application. The organization's reviewers can read it. Emails about it are sent in the organization's name through our email service.
• The organization decides what happens with your application. You can ask it, or us, to delete it.

The records any online service needs

• Service logs. Our servers log each request: your device's internet address, your browser type, the page address asked for, the time, and any error. This covers every visitor, not only members. A page address can include words typed into a search box, because some searches travel in the address. Our logs are written so they don't record your content: not what you say to alaMem, not the details the AI works with, and not the addresses you enter. Logs are deleted after 30 days (§6).
• A few things kept with your account: which records you've opened (so the app can show what's new), what you've starred, how much AI your account has used (if it has AI), and your notification devices.
• Notifications. If you turn on notifications, we keep your device's push address and keys, and your browser's name and version. Notifications travel through your browser maker's push service (Google, Apple, or Mozilla), encrypted so that service can't read them.
• Being online. People you share with may see a small "online" dot while you're active in the app.

Cookies and browser storage

• Signing in uses Google's cookies for our sign-in service: a short-lived one while you sign in, and one that keeps you signed in (Google renews it about every hour). The sign-in page's software, which is Google's, also remembers your sign-in in your browser until you sign out.
• alaMem's own cookies are three small settings, never used for advertising or tracking: which of your spaces you're working in (kept 30 days), whether an organization's administrator is previewing a member's view (8 hours), and whether you've seen your invitation's welcome (1 year).
• Browser storage. The app keeps a few conveniences in your browser's own storage — for example, the last 20 records you opened — so it can offer them again.
• We run no analytics or advertising trackers of our own.
• YouTube. Our music player and video blocks play from YouTube. Nothing loads from YouTube until you press play. When you press play, your browser fetches YouTube's player software, and the video plays in YouTube's privacy-enhanced player (youtube-nocookie.com). From then on, YouTube (Google) receives your device's internet address and may store its own cookies or similar data in your browser, under Google's privacy policy.

Outside services your browser contacts

Some pages load fonts, software, or pictures from outside services. Your browser then tells each one your device's internet address, basic browser information, and which site you're on:

• Google Fonts — most pages, including our front page;
• TMDb — film posters;
• Google's sign-in service — the sign-in page;
• YouTube — only after you press play.

Google Fonts sets no cookies, and says it doesn't use this to profile or track visitors. Our maps' software comes from alaMem itself.

What we don't collect

We don't buy data about you from anyone. alaMem doesn't track you across other websites.

Plain English: We run on Google Cloud. A few outside services each do one job, and each one is listed here with what it touches. AI is an optional upgrade, and an AI assistant helps us run alaMem.

3.1 AI is an optional upgrade

• AI features — conversation, voice, the ask box, the tutor, agents, AI help writing pages, and capture suggestions — are an optional upgrade.
• If your account doesn't include it, AI is switched off for you. You won't see AI features at all, and nothing you do in alaMem sends what you store, type, or say to an AI provider or a speech service. One exception during the beta: the engineering assistant that helps us run alaMem (§3.4).
• During the beta, the upgrade is not offered to members. AI is switched off for every account but the operator's own.
• Something to know if you share. If you share something with a person whose account includes AI, their AI features can read what you shared when they use them — just as they can read it themselves. Some AI features run when a page opens, like a project's catch-up summary.
• If your account includes AI, you can still switch your agent off.
• The AI in alaMem works as the person or organization it serves. It reaches only what they can see, through the same permission checks.

3.2 The services we use

3.3 What the main providers may do with data

• Anthropic (AI upgrade only). When someone whose account includes AI uses an AI feature, alaMem sends the records that request needs to Anthropic's API. Under Anthropic's Commercial Terms of Service, Anthropic may not train its models on that content, and it handles it as our service provider. Anthropic deletes API inputs and outputs within 30 days. The exceptions: content its automated systems flag as breaking its usage policy, which it keeps up to 2 years, and content the law requires it to keep. We confirmed in Anthropic's Console that alaMem's organization has the standard 30-day retention. Two things we keep true: no AI feature uses a model Anthropic keeps data from for longer, and alaMem never sends anyone's content to Anthropic as feedback or a bug report.
• Google speech (AI upgrade only). Google processes your speech in memory and does not store the audio. Text-to-Speech logs none of the text or audio. Speech-to-Text's "data logging" option, which would let Google use the audio to train its models, has never been turned on for alaMem.
• Google Cloud, including sign-in. Under its Google Cloud terms, Google processes our data only to provide its services, and it does not use it to train AI models without our permission.
• Twilio SendGrid. SendGrid holds a message only as long as it takes to deliver it (up to 72 hours if delivery is retried). It keeps delivery records for about 37 days, and some delivery events, without the message, for up to a year, to prevent fraud and abuse. Under its own terms, Twilio may also use email data as an independent controller: for security, to prevent abuse (including training its own anti-abuse tools), for its legal duties, and to improve its services. Twilio says it does not sell personal data. Our emails are plain text, with no tracking images. Click tracking and open tracking are turned off, so SendGrid does not rewrite our links or record who clicks them.

3.4 How we build and run alaMem: an AI engineering assistant (beta)

• alaMem is built and run by its operator with help from an AI engineering assistant: Claude, made by Anthropic.
• During the beta, the assistant works with the operator's own access: the operator's keys to our cloud account and to the database. alaMem's privacy walls don't limit it. So while it builds, checks, or fixes something, it can see any account's data, including messages sent through our front page and organizations' forms. It can also read our service logs and backups. What it reads goes to Anthropic as part of its working session.
• Our rule: the assistant changes nothing in anyone's data, and puts out no new version of alaMem, without the operator's approval of that change. It keeps its own working notes in alaMem, under its own account. Today the rule is a working practice, not a technical lock.
• The assistant runs on the operator's personal Claude plan with Anthropic's model-training setting turned off, so Anthropic does not use those sessions to train its models. Anthropic keeps them under its consumer terms.
• Records of its working sessions are kept on the operator's computer and deleted 14 days after their last use.

3.5 No other recipients

We don't share your data with advertisers, data brokers, or anyone outside this section, except:

• people and organizations you share with (§5);
• when the law requires it, through valid legal process — we'll tell you unless the law forbids it;
• if TimeShaker, Inc. merges or is sold — this policy's promises follow your data, and we'll tell you.

3.6 Changes to this list

If we add or change a service that touches your content, we'll update this section first.

Plain English: The two promises that define alaMem.

• We never sell your personal data. No sale, no rental, no sharing for advertising. We have no advertising business.
• We never use your content to train AI models. Not our own; we have none. Anthropic's Commercial Terms forbid it from training on content sent by alaMem's AI features, and Google Cloud's terms forbid Google from training on our data without our permission. One provider limit to know: our email service, Twilio SendGrid, may use email data to train its own anti-abuse tools (§3.3). The engineering assistant's sessions are covered too: its plan's training setting is off (§3.4).

Plain English: Private by default. Others see your content only when you share it, and you can take a share back.

• Private by default. New content is visible only to you — or, for work you create while working for an organization, to that organization. Which one depends on the "hat" you're wearing when you create it: working as yourself, or for an organization. The app shows which hat you're wearing (see Terms §5).
• Sharing. You share by granting access to specific people or to rights groups (a family, a team, an organization's members). You can see your grants and remove them. Removing a grant removes access from then on. A photo someone already opened may stay in their browser's cache for up to a day.
• Organization records. Work records owned by an organization you belong to are managed by that organization's administrators, within the organization. They can preview what a member sees inside the organization. Your personal and family content is off-limits to them.
• Every look is checked. Whenever anyone opens a record, alaMem checks at that moment whether they may see it. Our servers never keep a shared copy of private content.
• Publishing. You can publish a record, or a whole site, to everyone. Publishing goes through a "Public Group": one switch that publishes or unpublishes everything on it. While something is public, anyone can see it, copy it, or index it, including search engines.
• Sharing can't be fully undone. Anyone who already saw something may remember it or have kept a copy.
• If you share with a person whose account includes AI, see §3.1.

Plain English: Your data stays while you keep it. Every copy we make has a set lifetime, kept by a setting or a script. Something deleted is gone from every copy we keep within about three weeks.

Every copy, and how long it lives

We keep no hand-made database snapshots.

Together: something deleted from alaMem is gone from every backup copy above within about three weeks — 14 days, plus a day, plus the 7 days cloud storage keeps a deleted file recoverable. Our logs don't hold your content (§2), and they are gone in 30 days. So our promise: within 30 days of being deleted from the live service, it is gone from every copy we keep — except where the list below says otherwise.

Where that promise doesn't reach yet

• The operator's computer, while it is switched off. Its cleanups run every day. On a day it is off they wait, and run the day it is next switched on, so a long stretch off can carry a copy there past the 30 days.
• Google's record of administrative changes is kept 400 days. Google locks that setting. It can hold an email address when we give someone access to our cloud setup.
• Our engineering records. A few contact details, mostly public business listings and our own test sign-ups, sit in our software's change history. Write to us and we'll remove yours.
• Older versions of our software. Copies made before 2026-10-16 also carried some of our working files, including a few people's details. They leave under the rule above, once five newer versions have replaced them.
• Outside services keep copies on their own schedules: Anthropic deletes within 30 days (longer if flagged, §3.3); SendGrid keeps a message up to 72 hours, delivery records about 37 days, and some delivery events up to a year; Google Cloud's terms give Google up to 180 days to finish erasing deleted data from its own systems.
• Legal exceptions: we may keep narrow records where the law requires it, to resolve disputes, or to enforce our terms.

Plain English: You can take your data with you. That's a design principle, not a favor.

You can get a portable copy of your content: the records, the media, and the structure connecting them. Today export is on request: write to privacy@alamem.com. We'll confirm it's you by writing back to the address you sign in with, then prepare a copy by hand and send it to you within 30 days of confirming. For records an organization owns, the organization holds the export rights.

Plain English: Ask us to delete your data, and we will: everything you own, and your account itself. Here is exactly how.

• How to ask. Write to privacy@alamem.com. We'll confirm it's you by writing back to the address you sign in with. During the beta we do the deletion by hand, within 7 days of confirming. A "Delete my account" button will come later.
• What we delete:
  • Everything you own: your records, photos and files (the stored files themselves too), lessons, notes, and your AI's memory if you have the AI upgrade.
  • Your account: your sign-in addresses and your profile in the system.
  • What you published. Where a published page of yours stood, visitors see only "This page was removed at its author's request" — no title, no name.
  • Our history of your records. We keep one note that a deletion happened: the dates, your account number, and how many items were removed. Nothing you wrote, and not your name or email.
  • Records we kept to undo a change, if any name you.
• Other people's notes and tags. If someone pointed at something of yours — a note about it, a tag, a favorite — their note stays theirs, but it no longer links to yours; it says only that it once pointed at something its owner deleted. Their tag or favorite on your item goes with your item.
• What stays, and why:
  • Records someone else owns — an organization's records (its business records, Terms §5), or a family member's record that mentions you — belong to them. We'll tell you who holds what, and they decide.
  • Copies leave on the schedule in §6: within about three weeks of the deletion, and within 30 days except where §6 says otherwise.
  • Copies held by outside services leave on their own schedules (§3.3, §6).
  • Legal holds, where the law requires us to keep something.
• Removing something in the app is different. It hides the item from everyone at once, but doesn't erase it. To erase, ask us.
• If we close your account (Terms §9), we'll email you and give you 30 days to ask for a copy of what you own; then we delete it exactly as above. If we ever shut alaMem down, everyone gets at least 30 days' notice and the same chance. The only exception is where the law forbids it or someone's safety is at stake.

Plain English: The member app checks who you are before anything else, and the database itself keeps each person's data apart. Two layers, which must agree.

• Signing in to the member app. The member app sits behind Google's Identity-Aware Proxy. A request reaches it only after you've signed in. alaMem then checks Google's signed statement of who you are — never a bare header — and admits only sign-ins connected to an alaMem account.
• Public pages — our front page, published websites, the sign-in page, and organizations' public forms — are served by a separate public service that needs no sign-in. It treats every visitor as an anonymous stranger and can show only what has been published to everyone.
• Isolation in the database itself. Row-level security in the database keeps each person's and each organization's data apart, beneath the app's own permission checks. The app connects as a restricted role that cannot bypass it.
• Encryption. Inside Google Cloud, data is encrypted at rest, and our app's connections to the database are encrypted. Some backup copies are also kept on the operator's computer (§6). That computer is password-protected, but its disk is not yet encrypted.
• The AI in alaMem works as the person or organization it serves, through the same permission checks, and cannot bypass them.
• Our engineering assistant works with the operator's access during the beta and is not bounded by these walls (§3.4).
• No security is perfect. If a breach affects your data, we'll tell you within 72 hours of confirming it: what happened, what it touched, and what you can do. We'll tell the authorities too, where the law requires.

Plain English: alaMem is for adults. You must be 18 or older.

alaMem is for people 18 and older and is not directed to anyone under 18. We don't knowingly collect personal data from anyone under 18. If you believe someone under 18 has an account, write to us and we'll delete it. Adults may keep content about their own children in their own accounts — family photos and stories, for example. That content belongs to the adult and is under the adult's control.

Plain English: Depending on where you live, the law may give you formal rights over your data. We honor the spirit of those rights for everyone.

• For everyone. We give every member access, export, correction, and deletion (§§6–8), wherever they live. Today we do these by hand, on request.
• Formal rights. If you live where specific privacy laws apply — for example, Europe's GDPR or the UK's, or California's CCPA/CPRA — you may have more formal rights and ways to complain.
• Where your data lives. Your data is stored in the United States. Our database, our stored files, and our backup copies in cloud storage are kept in Google Cloud's Iowa region. The database's automatic backups are kept in Google's United States multi-region. The operator also keeps backup copies on a computer in Oregon (§6).
• Where it may be processed. Some services we use aren't tied to one region and may process data outside the US: Google's sign-in and logging services, Google's speech services and our AI provider (both AI upgrade only), and our email provider.

Plain English: If this policy changes in a way that matters, we'll tell you before it takes effect.

We'll update this policy as alaMem changes. We'll announce material changes by email or in the app before they take effect, and update the version and date at the top. We will never weaken the §4 promises — no training on your content, no sale of your data — without telling you at least 30 days before the change takes effect, so you can take your data and leave first.

Plain English: A real person answers.

Privacy questions, requests, or concerns: privacy@alamem.com · TimeShaker, Inc. (alaMem), 9181 NW Germantown Road, Portland, OR 97231, USA. Questions about our Terms of Service: legal@alamem.com.