private by design

Your memory, your machine. Clear controls for what connects.

Memo's security model is not an afterthought — it is the foundation. Every layer is built with the assumption that no server can be trusted.

AES-256-GCM

API keys encrypted on disk. Cloud data encrypted with PBKDF2 (600K iterations) before upload. Only your passphrase unlocks it.

End-to-end sync

Google Drive backups are encrypted before leaving your machine. Google cannot read your data — even if compromised.

Transparent sharing

Official builds enable content-free daily usage sharing by default. Switch it off in Settings → Privacy. A separate one-time install count is sent without an ID.

Sandboxed agent

Files, commands and external actions run through permission controls. Project boundaries, path checks and tool policies limit access.