Privacy
Local-first by default. What we handle, who the subprocessors are, and what we never do.
Beta draft. This policy is written to match the actual data flow. Legal entity, jurisdiction, and the final subprocessor list will be confirmed before the design-partner beta. Last updated: 2026-07-21.
Core principle: local-first
Corsoul is a local-first memory system. The free tier sends no memory to our servers by default — data lives on your machine (local PGLite). We cannot see and do not collect your memory content.
What data we handle
- Memory content (you hold it) — stored on your machine. We do not receive or retain it.
- Embedding / vectorization (optional third party) — if you choose a cloud embedding model (e.g. OpenAI) at setup, the memory text needed to create vectors is sent from your machine directly to that provider, handled under their privacy policy. Local Ollama or keyword-only involves no such transfer.
- Paid cloud consolidation (transient) — when you trigger a remote Sleep, the working set for that run is transiently uploaded to our consolidation service and computed in a throwaway temporary database; during that run, memory text is sent to our configured LLM provider for extraction/consolidation. The working set and its results are not retained on the server.
- Operational metadata (we retain) — a metering ledger, license↔scope bindings, device bindings, quota counters. No memory content.
- Website — the site stores only a language preference in your browser's
localStorage(corsoul.language); no ad tracking, no third-party analytics pixels.
Subprocessors
- Your chosen embedding provider (only if you choose cloud embeddings).
- LLM provider (during paid Sleep, for memory extraction/consolidation).
- Cloudflare (TLS, CDN, cloud service hosting).
A formal subprocessor list with locations will be published at terms finalization.
What we do not do
- We do not sell your data.
- We do not train our own models on your memory content.
- We do not send memory to any third party without an action you take.
Your rights
You fully control local data (backup and deletion: see Data deletion & retention). For the operational metadata we retain, you may request access and deletion; a self-service DSAR interface is on the roadmap — for now, via support@corsoul.com.
Children
The service is not designed for, and does not knowingly collect data from, children under 16.
Contact
For privacy matters, contact support@corsoul.com (interim during beta; a dedicated privacy contact lands at terms finalization).