AtMem Cloud

Cloud memory privacy.

Prepared 6 November 2026 for the forthcoming ChatGPT integration. Public directory availability remains pending. The website privacy page describes this documentation site's separate analytics and waitlist processing.

Operator and contact

AtMem is maintained by Javad Taghia. Contact hello@atmem.ai for service privacy, access or deletion requests. Do not send passwords, tokens or complete memory databases by email or in public issues.

What the service processes

Firebase processes your account email, password and email-verification or recovery requests. AtMem forwards credentials to Firebase over TLS and does not retain your password. The service keeps short-lived per-account request counters under opaque identifiers to enforce usage limits. The service uses your Firebase identity, requested scopes, search terms, explicitly proposed memories, source and lifecycle information, approvals and receipts to provide memory access.

The service does not capture all conversations in the background. Saves, corrections and deletions need an explicit request and independent approval. A proposed change is not a successful save until durable storage commits.

Where data goes

Google Cloud runs the service and stores encrypted memory in the separate atmem-chatgpt Firestore database in us-central1. Firebase Authentication processes identity; Cloud Run, Secret Manager and Cloud Logging provide runtime, key and operational services. Firebase and Google's services may process identity and operational data according to their own infrastructure and policies; this is not an exclusive-residency guarantee.

Requested memory results are sent to ChatGPT. ChatGPT processes the conversation and returned data under its own terms and controls. AtMem does not call an external language model, embedder or reranker for these cloud memory operations.

Access and encryption

Account identity and scope are enforced by the server. Registered users cannot read the Firestore memory database directly. The memory service's IAM identity is restricted to its separate database and does not have access to the website's default database.

SQLCipher protects the temporary engine database and AES-256-GCM protects retained snapshots and authentication controls. The operator holds the keys and operates the application boundary, so this is not end-to-end or zero-knowledge encryption. Authorized operators with key access can decrypt service data.

Retention and service logs

Memories persist until you delete them or delete the account. Corrections retain prior native versions until an applicable purge. Exact-record forgetting covers the representations named in its receipt, not every historical version or external copy.

Pending proposals expire after ten minutes and their content is removed on completion, cancellation or the next successful account operation after expiry. Browser sign-in and account-deletion proofs expire after five minutes. Plugin access tokens last ten minutes; grants and refresh tokens have a 24-hour bound. Expired control records use asynchronous Firestore TTL deletion, so expiry of access is distinct from physical removal.

The current database has PITR disabled and a 3,600-second provider version-retention window. The default Cloud Logging retention is 30 days. Request logs can contain time, network/status information and URL operation references; application access logging is disabled and memory contents, passwords and tokens are not deliberately logged. This is narrowly scoped operational processing, not behavioral profiling or advertising. Provider processing and deletion are not verified by an AtMem memory receipt.

Your controls and account deletion

You can inspect the source and lifecycle of a memory, approve or cancel a proposal, correct a fact, forget an exact record, and disconnect or revoke the plugin. Disconnecting stops access; it does not erase stored memories.

Account-wide deletion uses a separate service page with fresh password sign-in, a preview identifying the account and an explicit confirmation. It blocks account access, purges the active household including every private scope, stored version, source, audit and pending action, and requests deletion of the Firebase account. Its receipt separately reports storage and Firebase completion. Interrupted deletion remains blocked and can be retried; an error is not a completed deletion.

A non-content, HMAC-addressed deletion fence and encrypted structural receipt are retained to prevent delayed work or old backups from reopening a deleted account. A short-lived encrypted deletion proof can remain for receipt recovery until expiry and TTL cleanup. Legacy unindexed authentication controls can remain until their existing expiry/TTL, with access denied by the fence.

Provider histories, logs and copies already held by ChatGPT are separate. No promise is made that account deletion removes those copies immediately. Contact support for account access, correction, privacy or deletion assistance.