Privacy Policy

Last updated: October 14, 2026

Linking app analytics to your account (see "Analytics") takes effect on November 11, 2026. Until then, app analytics stay pseudonymous and are not linked to your email or name.

This Privacy Policy covers the personal data we process across Engram: both the marketing site at engram.page and the application at app.engram.page, including your account data and the notes and attachments you sync.

Controller

For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and equivalent laws, the data controller responsible for your personal data is:

Rasbandit Software Solutions LLC, d/b/a Engram 7533 S Center View Ct, Ste N #6048 West Jordan, UT 84084, USA Privacy contact: privacy@engram.page

We have not appointed a Data Protection Officer because our processing does not meet the threshold criteria under GDPR Art. 37 (we do not engage in large-scale systematic monitoring or large-scale processing of special categories of data).

Analytics

We use PostHog for analytics, on both the marketing site and the app.

On the marketing site, PostHog runs without tracking cookies and does not record sessions. Browsing data (page views, scroll depth, button clicks) is anonymous and kept in memory only until you close the tab.

In the app, once you sign in, we link product usage to your account so we can understand how Engram is used, find where people get stuck, and decide what to build next. This includes:

• Your account details: email address, display name, sign-up date, and how you found us (referral or campaign source);
• Your plan and subscription status;
• Usage events, such as signing in, connecting the Obsidian plugin or an AI assistant, running a search, creating a note, or hitting a plan limit;
• Account-level counts, such as how many notes and vaults you have and how much storage you use;

We never send the contents of your notes, their titles, file or folder names, vault names, or the text of your searches to PostHog.

You can object to app analytics at any time by emailing privacy@engram.page; we will stop sending analytics for your account. Self-hosted installations of Engram send nothing to PostHog.

Referral and campaign attribution

If someone referred you via a link like engram.page/?via=alice, or you arrived via a campaign with utm_* parameters, we may remember that source in your browser's tab-scoped session storage so we can credit the referrer if you sign up before closing the tab. The data clears automatically when you close the tab. We do not set a tracking cookie and we do not write to persistent or third-party storage.

EU/EEA/UK visitors. Storing referral information on your device is not strictly necessary for the operation of the site. If you visit from the European Economic Area, the United Kingdom, or Switzerland, attribution storage applies only where you have consented (for example, by clicking a referral link with knowledge of these terms). If you do not wish attribution to be recorded, do not click referral links or use private/incognito browsing.

Payments and Paddle

When you purchase a paid plan, the transaction is processed by Paddle.com, acting as the Merchant of Record and the legal seller of the Service. Paddle is PCI-DSS Level 1 certified and handles all cardholder data directly. Paddle collects your payment method, billing address, and any tax identifiers required for invoicing. We never see or store your payment card number or any other primary account number.

From Paddle we receive: your email, the country and state used for tax determination, the plan you bought, the amount, and the transaction ID. We use this information to provision your account, recognise renewals and cancellations, and to handle support and refunds. Paddle's own data practices are described in the Paddle Privacy Notice.

To exercise privacy rights over payment data held by Paddle (for example, deletion or access requests under GDPR or CCPA), contact us at privacy@engram.page and we will coordinate with Paddle on your behalf.

AI assistants and connectors

You can connect an AI assistant (such as Claude, ChatGPT or Meta Muse) to Engram through MCP or an API key. When you do:

• The assistant receives only the note content and metadata that its tool calls request, and only from the vaults you approved when you connected it (or the vaults an API key is limited to).
• Once we deliver that content to the assistant, the assistant's provider handles it under its own privacy policy.
• We do not use your notes, or anything an assistant sends us, to train AI models. We do not sell it, and we do not use it for advertising or for profiling unrelated to providing Engram.
• You can revoke any connection at any time in Settings → Connections in the app. A revoked API key stops working immediately. A revoked OAuth connection can no longer renew its access, and the access token it already holds expires within 15 minutes. After that, it cannot access your data.
• Notes an assistant reads or writes follow the same retention rules as any other note (see "Data retention").

Legal basis for processing (GDPR Art. 6)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data only where one of the following legal bases applies:

Where we rely on legitimate interests, you have the right to object (see "Your rights" below). Where we rely on consent, you may withdraw it at any time without affecting prior lawful processing.

Sub-processors

A sub-processor is a third-party service that processes personal data on our behalf to operate Engram. The full current list:

Operational logs and metrics (which may include user ID, IP address, and request metadata) are processed on infrastructure we operate ourselves, not by a sub-processor.

Each sub-processor acts under a written data processing agreement with us. We do not share your data with any third parties beyond those listed here. Material additions to this list will be announced with reasonable notice via this page and email to active customers.

International data transfers

Several sub-processors above are based in the United States. If you access the Service from the European Economic Area, the United Kingdom, or Switzerland, your personal data is transferred to the US for processing.

We rely on the Standard Contractual Clauses issued by the European Commission under Implementing Decision (EU) 2021/914 (and the UK International Data Transfer Addendum where applicable) as the primary legal mechanism for these transfers. Where a sub-processor additionally self-certifies under the EU-US Data Privacy Framework (DPF) or the UK extension to the DPF, we may rely on that adequacy mechanism in addition to the SCCs. Specific safeguards in place for each sub-processor are available on request to privacy@engram.page.

Data retention

We retain personal data only as long as necessary for the purposes described above:

• Analytics data: retained for up to 2 years, then deleted. Deleting your account deletes your analytics profile and its events.
• Account records and Engram's own copy of subscription data: retained for the life of your account, then deleted within 30 days of account deletion.
• Billing records held by Paddle as Merchant of Record: retained per Paddle's own retention schedule (typically up to 10 years for tax compliance under applicable law).
• Your notes and attachments: retained until you delete them or your account; deleted from primary storage within 30 days and from all backups within 90 days of deletion.
• Support correspondence: retained for 2 years from the date of the last message, then deleted.

Security

We implement administrative, technical, and physical safeguards designed to protect personal data:

• Encryption in transit (TLS 1.2 or higher) for all connections;
• Encryption at rest using AES-256 for note content and attachments;
• Least-privilege access controls; administrative access is logged and reviewed;
• Continuous monitoring (Sentry error tracking) and incident-response procedures;
• Regular review of sub-processor security postures;
• Network isolation between the marketing site (Cloudflare Workers) and the application (AWS).

No method of transmission or storage is perfectly secure; we cannot guarantee absolute security. If you believe you have discovered a security vulnerability, please email security@engram.page.

Breach notification

If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Art. 33. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay, as required by GDPR Art. 34. Notification will be by email to the address on your account.

Requests from governments and third parties

We disclose your personal data to a government or other third party only when we are legally compelled to by valid legal process. We review each request for legal validity and scope, and we narrow or challenge requests that are overbroad. Before disclosing anything, we notify the affected user unless the law prohibits us from doing so. Questions about this go to privacy@engram.page.

Your rights

Depending on where you live, you have some or all of the following rights regarding the personal data we hold about you. To exercise any of them, email privacy@engram.page from the address on your Engram account. We will respond within 30 days (60 days for complex requests, with notice).

• Access: request a copy of the personal data we hold about you (GDPR Art. 15; CCPA right to know).
• Rectification: ask us to correct inaccurate or incomplete data (GDPR Art. 16; CCPA/CPRA right to correct).
• Erasure: ask us to delete your personal data (GDPR Art. 17 "right to be forgotten"; CCPA right to delete). Some records required by tax law are retained per the schedule above.
• Restriction: ask us to limit processing while a dispute is resolved (GDPR Art. 18).
• Portability: receive your data in a structured, machine-readable format (GDPR Art. 20). Your notes are already plain Markdown; you can export them at any time from the app.
• Objection: object to processing based on our legitimate interests (GDPR Art. 21).
• No automated decision-making: we do not subject you to decisions based solely on automated processing (including profiling) that produce legal effects concerning you or significantly affect you (GDPR Art. 22).
• Withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting prior lawful processing.
• Opt out of sale or sharing: we do not sell personal data and do not share it for cross-context behavioral advertising (CCPA/CPRA). No action required on your part.
• Non-discrimination: we will not deny service, charge different prices, or provide a different quality of service because you exercised any of these rights.
• Lodge a complaint: EU/EEA residents may complain to their national data-protection supervisory authority (GDPR Art. 77; see EDPB list of members); UK residents may contact the Information Commissioner's Office; California residents may contact the California Privacy Protection Agency.

Authorised agents may submit requests on your behalf with signed proof of authorisation. We will verify your identity before fulfilling any access or deletion request.

Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has provided personal data to Engram, contact privacy@engram.page and we will delete it promptly. For residents of the EU/EEA, where the applicable age of digital consent is higher (typically 16, varying by member state down to 13), parental consent is required for users under that age.

What we do not do

• We do not use Google Analytics or any third-party tracking pixel.
• We do not share data with advertising networks.
• We do not fingerprint your browser or device.
• We do not track you across other websites.
• We honor browser-level Global Privacy Control (GPC) signals as required by CCPA/CPRA: a GPC signal is treated as a valid opt-out of any sale or sharing of personal information. Our analytics scripts also do not fire when we detect a Do Not Track (DNT) signal.

Changes to this Policy

We may update this Privacy Policy from time to time. If we make a material change, we will give reasonable notice by email or by posting a notice on the site before the change takes effect. The "Last updated" date at the top of this page reflects the most recent change.

Contact

Privacy-specific questions: privacy@engram.page. Security reports: security@engram.page. General support: support@engram.page.

Rasbandit Software Solutions LLC, d/b/a Engram 7533 S Center View Ct, Ste N #6048 West Jordan, UT 84084 USA