Privacy Policy

invubu is a personal memory layer for AI assistants. We store the things you choose to remember between chats, and recall them when they are relevant. This policy explains what we collect, why, and the controls you have over it.

We treat your memories as private by default. They exist to serve your chats — nothing else.

Account information. An email address used to sign in, and minimal account metadata (created-at timestamp, sign-in events).

Memory content. Text that you, or your AI assistant on your behalf, send through the memory tools — for example, facts about your projects, preferences, people in your life, or context you want carried forward. Each memory is associated with your account.

Technical and log data. Request logs, tool invocations, IP address, and user-agent strings. We use these for security, abuse prevention, and to keep the service running reliably.

We use the information we collect to:

• Run the memory pipeline — extract, embed, recall, reinforce, and consolidate memories so your AI can use them in your chats.
• Authenticate you and authorize AI clients to access your memories.
• Operate, secure, and improve the service, including diagnosing errors and detecting abuse.
• Communicate service updates that affect your account.

Memories are stored with row-level security at the database layer, so your data is only ever readable by your own account. Traffic is encrypted in transit (HTTPS), and stored data is encrypted at rest.

Access from AI clients is authenticated via OAuth, and we apply the principle of least privilege to internal access. No system is ever fully invulnerable, but we work to keep the surface small and the controls strong.

We rely on a small set of third-party providers, described here by category rather than by name:

• A cloud hosting provider, which runs the application and serves traffic.
• A managed Postgres database provider, which stores account data and memories.
• An AI gateway, which routes requests to large language model and embedding providers used by the memory pipeline.

Each of these processors handles your data under their own published terms and security commitments.

To extract, embed, and consolidate memories, content is sent to third-party large language model and embedding providers via an AI gateway. They process the content only to fulfil the request and return a response.

Your memories are not used to train models. Not by us, not by the providers we route to.

Your dashboard at app.invubu.ai gives you full control over your data. You can:

• View every memory we hold for you, with timestamp and source.
• Edit any memory.
• Delete any memory, individually or in bulk.
• Export your memories.
• Delete your account, which removes all of your memories.

Memories are retained until you delete them or close your account. When you delete a memory, it is removed from our active database immediately and purged from backups within 30 days.

Account closure triggers full deletion of your memories within 30 days. Limited log data may be retained longer where needed for security or legal compliance.

invubu is not directed at children under 13 and we do not knowingly collect data from them. If you believe a child has signed up, contact us and we will remove the account.

invubu is operated from Australia, but our sub-processors may process data in other regions, including the United States and the European Union. By using the service you consent to your information being transferred to and processed in those regions.

We only set cookies necessary to keep you signed in to the dashboard and to protect against cross-site request forgery. We do not use advertising cookies and we do not sell tracking data.

We may update this policy from time to time. When we do, we will revise the “last updated” date above. Material changes will be called out in the dashboard or by email.

Questions, requests, or concerns about your data: write to hello@invubu.ai.