Privacy and deletion

• Who sees what: a record’s acl lists its readers. A viewer (or user token) sees only what they may see, and a hidden record is never confirmed to exist.
• Deleting: POST /v1/memories/delete and POST /v1/users/delete (the delete scope) remove the record at once from the store, its indexes, derived facts, usage signals and caches (freed pages are zeroed). Backups keep deleted data only until they expire. Deleting the whole account destroys its data key, so every backup of it becomes unreadable at once.
• Export: POST /v1/users/export returns a signed, short-lived download link.
• Secrets and PII are masked in every output: secrets always, PII by your policy.