# Spaces and privacy

## Memory spaces

Every save and read names a memory space in `user`: one per person, team or agent. A space belongs to your account only. Another account's space with the same name is a different space.

## Who may read a record

A record's `acl` lists its readers. Send a `viewer` on a read and the answer holds only what that person may see. A hidden record is never confirmed to exist.

## Keys and tokens

- **API keys** (`prism_...`) are for your servers. A key has scopes (`read`, `write`, `delete`, `admin`, `import`), can stop on a date and can be limited to the spaces you choose.
- **User tokens** (`pt_...`) are for code on a user's device. A token lasts at most 1 hour, may use only the spaces named in it, and is always its own viewer. Your server issues them with `POST /v1/admin/tokens`.

## Delete and export

- `POST /v1/memories/delete` and `POST /v1/users/delete` remove a record, or a whole space, at once from the store, its indexes, derived facts and caches.
- `POST /v1/users/export` returns a signed, short-lived download link.
- Secrets are masked in every output, personal data by your policy.

All the rules: [Privacy and deletion](/docs/privacy/) and [Basics](/docs/basics/).