Privacy Policy

1. The Short Version

Conare ("we", "us", "our") operates conare.ai. We provide persistent memory for AI coding agents.

In plain English:

• Your memories live in their own isolated database — one per user, not a shared table.
• We do not train AI models on your content. We do not sell or share it.
• You can export everything via the API and delete your account at any time.
• The only places your content touches outside Conare are the third-party services listed in section 5, used strictly to deliver the product.

The rest of this document is the specific, legally complete version of that.

2. Data We Collect

2.1 Account Data

When you create an account or sign in with OAuth, we receive and store:

• Name — your provided name or OAuth profile name
• Email address — used as your account identifier
• Profile picture URL — displayed in the dashboard when provided by an OAuth provider
• Password hash — stored only if you use email/password sign-in

We never receive your Google or GitHub password. OAuth scopes are limited to basic profile and email. We do not retain OAuth refresh tokens beyond what is required to maintain your session.

2.2 User Content

Content you submit to Conare via the dashboard, CLI, MCP server, or API:

• Conversation summaries — context indexed from your AI coding sessions
• Memories — text you save explicitly for retrieval by your AI tools
• Connector data — content you choose to index from connected services (e.g., Notion pages, via OAuth scopes you grant)

Your content is stored in a per-user isolated Cloudflare Durable Object — effectively a separate SQLite database scoped to your account. Cross-user queries are not supported by the storage layer. We use your content only to provide the service to you: to index it, search it, and return it on your own retrieval calls.

2.3 Usage Analytics

We use DataFast (datafa.st) for website analytics. The DataFast script sets a first-party datafast_visitor_id cookie to recognize returning visitors and attribute conversions, and collects:

• Page views and navigation patterns
• Custom events: button clicks, feature usage, authentication flow completion
• Browser type, device type, and approximate geographic region

For signed-in users, analytics events are associated with your account email and name. For visitors in the EU/EEA and UK, the analytics script loads only after you choose Accept in the cookie banner, and you can decline or withdraw at any time via Cookie settings (see section 6).

2.4 Infrastructure Metadata

Conare runs on Cloudflare Workers, which are stateless by design. Cloudflare processes request metadata (IP addresses, headers, TLS handshakes) transiently to route and secure traffic, subject to Cloudflare's privacy policy. We do not configure long-lived server access logs.

3. How We Use Your Data

• Provide the service — store, index, search, rank, and return your memories on your retrieval calls
• Authenticate you — verify your identity and manage sessions
• Improve the product — understand usage patterns via website analytics (see section 2.3)
• Communicate with you — send service-related emails (e.g., security alerts, billing if applicable)

What we explicitly do not do:

• Sell your data to third parties — ever
• Use your content to train, fine-tune, or evaluate AI models — ours or anyone else's
• Share your content with other Conare users or unrelated services
• Build advertising profiles or track you across the web
• Read your content for any purpose other than serving it back to you

4. Storage & Security

Your data is stored on Cloudflare's global network, distributed across:

• Durable Objects (SQLite) — per-user isolated storage for memories and chunks. Each account is provisioned its own database instance, not a tenant row in a shared table.
• D1 (SQLite) — account metadata (name, email, account creation timestamp)
• KV — API key records and short-lived session data
• Vectorize — vector embeddings derived from your content, used for semantic search
• R2 — large object storage for connector content where applicable

All data is encrypted in transit (TLS 1.3) and encrypted at rest by Cloudflare's infrastructure. Admin endpoints are gated by HMAC-based authentication. Rate limits and per-user quotas are enforced to prevent abuse. All database queries are parameterized — we do not accept raw SQL from user input.

5. Third-Party Sub-processors

These are the only third parties that touch your data, what they do with it, and where to find their data-handling commitments:

We do not use third-party AI services (OpenAI, Anthropic, Google Gemini, etc.) to process your stored memories. Embedding, reranking, and everything else run on Conare's own infrastructure.

6. Cookies

We use a small number of cookies. Strictly necessary cookies (authentication session, security, and your consent record) are required for the site to function and do not require consent. One analytics cookie (datafast_visitor_id, set for our analytics provider DataFast) helps us understand site usage and conversion; for visitors in the EU/EEA and UK it is set only after you choose Accept in the cookie banner, and you can decline or withdraw at any time via Cookie settings below.

Cloudflare, our hosting provider, may set strictly necessary security cookies (such as bot management), and a theme preference cookie remembers your light/dark choice on the platform console. We do not use advertising cookies or cross-site tracking.

Cookie settings — review or change your cookie choice at any time.

7. Your Rights

Regardless of jurisdiction, you have the right to:

• Access — request a copy of all data we hold about you
• Export — download your memories at any time via the Conare API
• Correct — update your account information through your sign-in provider or by contacting us
• Delete — request deletion of your account and all associated content
• Restrict — ask us to limit how we process your data
• Object — object to specific processing activities

To exercise any of these rights, email artem@conare.ai. Account deletion requests are honored within 30 days, and in practice are typically completed within 24 hours of receipt.

8. Data Retention

• Account data — retained while your account is active; removed on account deletion
• User content (memories & chunks) — retained while your account is active; removed on account deletion
• Vector embeddings — derived from your content; removed alongside the source content
• Connector data — retained while the connector is active and your account is active; removed when you disconnect the integration or delete your account
• Analytics data — retained by DataFast; for signed-in users it is associated with your account email and name (see sections 2.3 and 6)

Cloudflare's infrastructure may retain encrypted backups for short, technical-recovery windows as part of its standard operations, subject to its own data-handling commitments. We do not maintain separate user-content backups outside of Cloudflare's storage layer.

9. International Data Transfers

Your data is processed on Cloudflare's global edge network, which spans multiple countries. By using Conare, you consent to your data being processed in jurisdictions outside your country of residence. Cloudflare maintains appropriate safeguards for international transfers, including Standard Contractual Clauses where applicable.

10. Children's Privacy

Conare is not intended for, and is not knowingly used by, children under 18. We do not knowingly collect data from children. If you believe a minor has provided us with personal information, contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy over time. Material changes will be communicated by email or in-app notification. The "Last updated" date at the top of this page always reflects the most recent revision. Continued use of Conare after a change constitutes acceptance of the updated policy.

12. Contact

For privacy questions, data requests, or anything security-related, email artem@conare.ai. A real human (the founder) reads every message.