Privacy policy
Last updated: 23 October 2026
This policy explains what personal data Memtru collects, why, and what you can do about it. Memtru is operated by the individual who runs it (the "Operator", "we"), who is responsible for your data. Contact: contact@memtru.com.
The command-line tool
The CLI runs on your computer or CI runner and collects no telemetry. It sends data only to the memory system you configure as a test target and, when you explicitly run memtru upload or memtru auth, to the Memtru server you name. Reports are sanitized before upload, and reports that declare raw memory content are rejected.
What the hosted service stores
- Account: your name, email address, a salted scrypt hash of your password (never the password), whether your email is verified, and when the account was created.
- Sign-in: sessions stored as hashes of a random cookie value; single-use email verification and password reset links stored only as hashes and deleted once used or replaced.
- Your work: organizations, members and roles, projects and settings, API tokens (stored as hashes), and the test reports you upload, which describe tests on synthetic data.
- Security records: an audit log of security-relevant actions (for example sign-ins, uploads, token changes), and short-lived rate-limit counters keyed by a hash of your IP address.
We use this data to provide the service, keep it secure, prevent abuse, and send account emails (verification and password reset). We do not sell personal data and do not use it for advertising. There are no third-party analytics, advertising or tracking scripts; fonts are served from our own domain. The only cookies are the session cookie and a cookie that remembers your selected organization.
Service providers
We use these providers to run the service. They process data on our behalf and may store it outside your country, including in the United States and Asia.
| Provider | Purpose | Data involved |
|---|---|---|
| Vercel | Hosting of the website and dashboard | Request logs, including IP addresses |
| Supabase | Database (region ap-south-1) | Account, organization, project and report data |
| Resend | Sending account emails | Your name and email address, and the email content |
| Cloudflare | Domain name service and forwarding of email sent to @memtru.com | Emails you send us |
Retention
Test runs are kept for the project's retention period (7 to 365 days, default 90); older runs are removed when the project receives its next report, and an owner can delete runs or the whole project at any time. Account data is kept while your account exists. Backups and provider logs may keep copies for a limited time after deletion. Details are in Data handling.
Your rights
You can ask to access, correct or delete your personal data, or to receive a copy of it, by emailing contact@memtru.com. You can update your name in account settings. We answer within 30 days. You may also complain to the data protection authority where you live; in Israel, the Privacy Protection Authority.
Security
Passwords, tokens and sign-in links are stored only as hashes, connections use HTTPS, and the database is not exposed to browsers. No system is perfectly secure; report suspected problems to security@memtru.com.
Children
The service is not intended for anyone under 16.
Changes
We will post changes here and update the date above. For material changes we will notify account holders by email before they take effect.