Sibyl Labs, LLC
Privacy Policy
This policy explains what Sibyl Labs, LLC collects when you use Sibyl Memory and the account service behind it, why we collect it, who else handles it, and what you can do about it. It is the companion to the Terms of Service. It is written in plain English on purpose. If anything here is unclear, write to us.
Who we are and what this policy covers
Sibyl Labs, LLC ("Sibyl Labs", "we", "us") is a Delaware limited liability company operating from California, United States. Postal address: 8 The Green, Suite B, Dover, DE 19901. Privacy contact: [email protected].
This policy covers sibyllabs.org, account.sibyllabs.org, api.sibyllabs.org, docs.sibyllabs.org, auth.sibyllabs.org (the page that activates a computer), the Sibyl Memory plugin and command line tool, and every plan, free or paid (together, the "Service"). The Terms of Service govern your use of the Service; this policy describes how personal data is handled.
We have not appointed a representative in the European Union or the United Kingdom, or a data protection officer. If the law comes to require either, we will name them here. Until then, the privacy contact above handles every request.
The short version
- Your memory content never leaves your computer. We do not receive it, store it, read it or back it up.
- What does reach us is the account and plan information needed to run your account, charge for Pro and enforce plan limits. Section 5 lists all of it.
- We do not sell personal data. We do not run advertising. We run no analytics scripts on our websites or in the account area.
- Card payments are handled by Stripe. We never see or store your card number.
- A connected wallet address is public on the blockchain. Signing in with it sends no transaction, and we never hold your keys or your funds.
What stays on your computer
Your memory content is stored in a local database on your own computer. Saving and recalling memory happen on that computer. We do not receive your memory content, store it, read it or back it up.
Because we never have a copy, we cannot restore a local memory store, and a request to us about your personal data does not reach it. You control that store directly: you can open, copy, back up or delete the local database at any time.
What the plugin sends
The Service handles three things: your account, the license to use the plugin, and the check that tells the plugin which plan your account is on. The plugin's network calls are limited to:
- signing a computer in to your account, and renewing that sign-in,
- a periodic plan check (about once a day on Pro, about once an hour on Free),
- a storage check when a Free account writes near its cap, which sends the size of your local store in bytes, never its contents, and
- a usage heartbeat carrying your account identifier, an operation count and the plugin version. You can
switch the heartbeat off with the environment variable
SIBYL_MEMORY_TELEMETRY=0.
None of these calls carries memory content. Memory operations make no network calls beyond the ones listed above, and no memory content is sent in any of them.
What each call carries
- Signing a computer in (
sibyl init): a random session identifier, a hash of the pairing code (never the code itself), and a description of the computer: operating system family and version, processor architecture, whether it runs under WSL, how the plugin was installed, and the plugin version. The activation page in your browser adds the page it was opened from and any campaign tags in its address. - Plan check and sign-in renewal: your account identifier, the computer's sign-in token, and the plugin package name, version and operating system family.
- Storage check: your account identifier, the computer's sign-in token, the current size of the local store in bytes and the size of the write about to happen, plus the signed plan claim the server issued to that computer. For older plugin versions that claim includes the email address and wallet address the server signed at activation.
- Heartbeat: your account identifier, the event type, and a count of memory operations since the last beat. No query text, no entity names, no error reports.
- Update check: the command line tool asks pypi.org for the latest published version of the plugin. That request goes to PyPI, not to us, and carries no account data.
Every call to our API also reaches us with the ordinary connection details a web request carries: your network address and the client's user agent string. What we keep from those is described in section 5.
What we collect, and why
The table lists every category of personal data the Service stores, what it is for, where it lives and how long it is kept. "Our database" means the production database at our database provider, hosted in the United States (section 10). "Hashed" means a one way value we can compare but not reverse.
| What | Why | Where | How long | |
|---|---|---|---|---|
| Account identity | Account identifier; email address, and any extra addresses you link; wallet address, if you connect one; a display name and billing email, if you set them; how and when the account was created and activated. | To run your account, sign you in and send the notices the Terms require. | Our database. | While the account exists. After deletion, your email and wallet stay reserved to you for at least 30 days, and the identity fields stay on the deleted record until the purge removes them (section 15). |
| Plan state | Current plan and how it was obtained (card, USDC, staking, grant), its end date, a history of plan changes, and a flag if the account is under review for tampering with plan limits. | To enforce plan limits and bill correctly. | Our database. | While the account exists, then as part of the billing record (at least seven years, below). |
| Plugin sign-in sessions | Session identifier, your network address and user agent string as sent (not hashed), when the session was created, bound and last used. | To pair a computer with your account and to detect abuse. | Our database. | While the account exists, then with the deleted account record until the purge (section 15). |
| Computers | One record per computer signed in: a label (set from the browser or the activation page, for example "browser-macos"), install method, operating system family, the user agent string as sent, and issued and last used times. | To count computers per plan, show them on your Security page and let you sign any of them out. | Our database. | Marked revoked when you sign the computer out. The row is kept while the account exists, then with the deleted account record until the purge (section 15). |
| Activation log | Events such as activating a computer, signing one out, linking or unlinking an email or wallet, and deleting the account, with your network address and user agent string as sent. | Security audit trail. | Our database. | While the account exists, then with the deleted account record until the purge (section 15). |
| Browser sessions on account.sibyllabs.org | A hashed session token, a hashed network address, a coarse browser class and operating system class (no versions), sign-in method, and timestamps. | To keep you signed in and to notice a sign-in from a new device. | Our database. | Deleted 90 days after the session ends. |
| Sign-in codes and links | Hashes of each one time code and sign-in link, a hashed network address, and attempt counts. The code and link themselves are never stored. | To sign you in by email and to confirm an address. | Our database. | Deleted 30 days after they expire. |
| Account security events | Event type and time (sign-ins, re-authentication, identity changes, plan changes, support actions), a hashed network address and coarse browser class. Never an address, token or code. | The activity list on your Security page, and our audit trail. | Our database. | While the account exists, then with the deleted account record until the purge (section 15). |
| Consent records | Which version of the Terms, this policy and the renewal notice you accepted, when, on which surface, with a hashed network address and coarse browser class. | To prove acceptance. | Our database (a copy of the checkout consent also sits in the Stripe session metadata). | Kept as a legal record for at least seven years, including after deletion. |
| API usage log | One row per API call: endpoint, method, status, duration, outcome category, a network address hash salted with your account identifier (so it cannot be matched across accounts), coarse client class and operating system class, and the byte figures from a storage check. | To prevent abuse, enforce the computer limit and debug the Service. | Our database. | 30 days is the intended window. The job that enforces it is not running yet, so today these rows are kept while the account exists, then with the deleted account record until the purge (section 15). |
| Heartbeat and telemetry events | Event type, time, the operation count from the heartbeat, and security signals the plugin reports (for example a local database that would not decrypt). Also the last time the account was seen and the largest local store size reported. | To understand usage of the product and to detect tampering with plan limits. | Our database. | While the account exists, then with the deleted account record until the purge (section 15). |
| Staking check | The connected wallet, its staked and liquid $SIBYL balance as read from the public chain, the threshold, the result and when it was checked. | To grant Pro through staking. | Our database. | Refreshed on each check; removed when the account is deleted. |
| Card billing records | Stripe customer identifier, subscription identifier, status, period end, the email address Stripe had when the customer was linked, and the plan. Never a card number. | To run your subscription and reconcile it with Stripe. | Our database and Stripe. | At least seven years after the last transaction, including after deletion, as tax and accounting law requires. |
| USDC payment records | The paying wallet address, the transaction hash, the amount and the period bought. Both the address and the transaction are already public on Base. | To grant the period paid for and keep a revenue ledger. | Our database. | As above. |
| Purchases not yet on an account | The email address typed at checkout, the plan, the checkout session identifier and the subscription identifier. | To attach a purchase to the right account when you sign in. | Our database and Stripe. | Until the purchase is attached to an account or is cancelled at the end of its period, then as a billing record (at least seven years). |
| Email log | For every message we send: a hashed recipient address, its domain, the template, delivery status and the provider's message identifier. Never the body, and never the address in clear. | To deliver mail once, enforce sending budgets and honor suppressions. | Our database. | Kept, so that each message is sent once and a suppression stays in force. It holds no address in clear. |
| Email preferences | Your reminder and product news choices, and a hashed address on a suppression list if a message bounced or you unsubscribed. | To respect your choices. | Our database. | Kept, so an unsubscribe stays in force. |
| Rate limit counters | Short lived counters keyed by account, by hashed network address on the account site, and by network address as sent on the API. | To stop automated abuse. | Our database. | Each counter covers a window of minutes to an hour. Expired counters hold only a key and a count; they are not swept today. |
| Support correspondence | What you send us by email, and our replies. | To help you. | Our Google Workspace mailbox. | Three years after the last message in the thread, unless a dispute or the law requires longer. |
| Staff actions | An append only record of every action our staff take on an account through the internal dashboard, with the staff member's identity and a hashed network address. | So that access to your account by us is accountable. | Our database. | Kept. |
Two fields on the account record deserve a note. A country and region field exists but the current plugin and activation page do not fill it, so it is empty for accounts created today. A password field exists for a future sign-in method; today there is no password sign-in, so nothing is stored there.
We analyze the hashed or coarse sign-in and usage metadata above (a hash of your network address, a rough operating system class, timestamps) to prevent abuse and enforce plan limits, including the one computer limit on Free and the ten computer limit on Pro.
Payments
Card
Card payments are handled by Stripe. When you start a checkout we send Stripe the email address you typed (or the one on your account), the plan, your account identifier where one is bound, and the versions of the Terms and renewal notice you accepted. Stripe collects your card details on its own pages, under its own privacy policy. We never see or store your card number. Stripe sends us the subscription's status, period and the identifiers listed in section 5.
Stripe may show and charge the price in your local currency. When the checkout page shows an estimate in your currency before you reach Stripe, the country comes from the request's country header set by our hosting provider, and we ask Stripe for the current exchange rate for that currency. The rate is cached per currency, not per person. Neither the country nor your network address is logged by that estimate.
Stripe collects a billing address at checkout to work out the tax that applies, and keeps it under its own policy.
USDC
A USDC payment from the command line tool is settled on Base through a payment facilitator (section 10). We store the paying wallet address, the transaction hash, the amount and the period bought. All of it is already public on the chain.
Wallets and the blockchain
- A wallet address is public on the blockchain. Connecting it to your account tells us which public address is yours.
- Signing in with a wallet means signing a short message. Signing sends no transaction and costs nothing. We never take custody of your funds or your keys, and we never ask for a seed phrase.
- The staking check reads the public chain. To do it, your wallet address is sent to a Base RPC provider (section 10) in a read only call. Nothing is written to the chain.
- A USDC payment and the wallet that made it are visible to anyone, forever.
Transactional and security mail (sign-in codes, confirmations, receipts and plan notices, security notices about sign-ins and account changes) is delivered through Resend and comes from [email protected]. Security notices are always sent and cannot be turned off. Plan reminders can be turned off on your Settings page.
Our messages carry no open or click tracking: no tracking pixels, and every link is printed in full.
We do not send marketing email unless you opt in to product news on your Settings page. If you do, every such message carries a one click unsubscribe link and our postal address (8 The Green, Suite B, Dover, DE 19901), and you can opt out at any time without losing transactional mail.
Service providers
These companies process personal data for us, only to provide the Service, and only on our instructions.
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Vercel | Hosts the websites, the account area and the API. | Every request, including your network address and the data you send us; it also derives the country used for the currency estimate. | United States |
| Neon | Our Postgres database. | Everything in section 5. | United States |
| Cloudflare | DNS and network edge in front of every domain. | Your network address and the requests it proxies. | Global network |
| Stripe | Card payments, subscriptions, the customer portal and exchange rates. | Your email address, card details (entered on Stripe's page), plan, consent versions and account identifier. | United States |
| Resend | Delivers our email. | Recipient address and the message content. | United States |
| Base RPC providers | Read the public chain for wallet verification and the staking check. | Your wallet address, in read only calls. We use a configured provider and, if it fails, public endpoints run by PublicNode, 1RPC, LlamaNodes and Base. | Varies |
| x402 payment facilitator (x402.org) | Settles USDC payments on Base. | The signed payment and the paying wallet address. | Varies |
| Discord | Our internal operations alerts. | Alerts can carry your account identifier, never your address or content. | United States |
| Google Workspace | Our support mailbox. | What you email us. | United States |
GitHub hosts our open source code and PyPI distributes the plugin. Neither holds account data.
Security
- Every domain we run is served over HTTPS with strict transport security.
- Our database provider encrypts stored data at rest with AES-256 and requires TLS for every connection.
- Sign-in tokens, one time codes, session cookies and email addresses in the mail log are stored only as keyed hashes. Where a network address is hashed, the key or salt is kept apart from the data.
- The account area sends a strict content security policy, accepts changes only from its own origin, and asks you to confirm sensitive changes with a fresh sign-in or a wallet signature.
- Staff access to accounts goes through an internal dashboard that records every action.
No system is perfectly secure. If a breach affects your personal data, we will tell you without undue delay, and we will notify the relevant regulator where the law requires it, within the time the law sets (for example, 72 hours to the supervisory authority where the GDPR applies).
International transfers
We are a United States company and our providers process personal data in the United States. If you are in the European Economic Area, the United Kingdom or another place with data transfer rules, your personal data is transferred to the United States when you use the Service. Our providers process it under their data processing terms, which include the European Commission's standard contractual clauses and the UK addendum where they apply. Where we transfer personal data ourselves, we rely on those clauses or on the fact that the transfer is necessary to perform our contract with you. We are not certified under the EU-US Data Privacy Framework. You can ask the privacy contact for a copy of the safeguards that apply.
How long we keep things
This section states what the system does today. Where nothing deletes a category yet, section 5 says so instead of promising a window.
- Deleted automatically: sign-in codes and links 30 days after expiry, browser sessions 90 days after they end, and internal replay and nonce records within a day, by a daily job.
- Deleted with your account: the staking check record, at once. Everything else is revoked or marked deleted and kept (section 15).
- Kept while the account exists: plugin sign-in sessions, computer records, the activation log, the API usage log, heartbeat and telemetry events, account security events, the email log and rate limit counters. No shorter window applies to these yet. After an account is deleted they stay with the deleted account record until the purge in section 15 runs. When we set a window and the job that enforces it, we will update this policy with notice under section 20.
- Kept as the law requires: billing, tax and consent records, for at least seven years, including after deletion.
Deleting your account
You can delete your account from the Settings page of account.sibyllabs.org. You type DELETE and confirm with the wallet on the account (the wallet step is how the account area proves it is you; signing sends no transaction). If your account has no wallet, write to [email protected] from the account's email address and we will delete it for you. An account with an active card subscription cannot be deleted until billing is cancelled. An account under review for tampering, or frozen after a "this was not me" report, cannot be deleted until the review ends.
When you delete, this is what happens at once:
- the account is marked deleted and no sign-in works any more,
- every computer and every browser signed in to it is signed out,
- the staking check record is removed,
- your email and wallet links are tombstoned: they stay reserved to you for 30 days so a mistaken delete can be undone by contacting support within that time, and cannot be claimed by another account,
- a deletion event is written to the activation log and your security events, and we send one confirmation email,
- any plan time paid in USDC is forfeited,
- the memory files on your computers are left untouched. They are yours, and we never had them.
What is kept:
- billing and tax records, including Stripe invoices and the USDC ledger, for as long as the law requires,
- consent records,
- the logs listed in section 14 under "kept while the account exists", until the purge below.
What the purge does:
After the 30 day window, the purge removes your email address, wallet address, display name and billing email from the deleted account record and releases the email and wallet so they can be used again. What stays is the account identifier, the plan and billing history, the consent records, and the logs above with no identity fields attached to them. Where this stands today: the purge is built into our database, but it does not yet run on a schedule. Until it does, a deleted account's identity fields stay on the record and its email and wallet stay reserved. If you want them removed sooner, write to [email protected] from the account's email address and we will run the purge for your account by hand.
Your rights
Depending on where you live, you may have the right to access, export, correct or delete your personal data, to object to or restrict some uses of it, and to withdraw consent where consent is the basis.
- Access and correction: your account's email addresses, wallet, computers, plan, billing and security events are shown on account.sibyllabs.org, and the addresses and preferences can be changed there.
- Deletion: section 15.
- Export: write to us and we will send you a copy of the personal data we hold about your account in a common machine readable format.
- Anything else: write to [email protected] from the email address on your account. We may ask you to confirm the request from that address or with the account's wallet before we act on it. We respond within the time the law requires.
Your memory content is on your own computer and never reaches us, so a request to us does not cover it. You control that store directly.
If you live in California
This section is our notice under the California Consumer Privacy Act as amended by the California Privacy Rights Act. In the past twelve months we have collected these categories of personal information, each described in section 5: identifiers (account identifier, email address, wallet address, network address); commercial information (plan and payment records); internet or network activity (API usage, sign-in and security logs, heartbeat events); and inferences limited to whether an account is over a plan limit or appears to be tampering with one. We do not collect sensitive personal information beyond what is needed to sign you in and bill you, and we do not use it to infer characteristics about you.
We collect this information from you, from your computer and browser, and from Stripe and the public blockchain. We use it for the purposes in section 5 and share it only with the providers in section 10. We do not sell personal information and we do not share it for cross context behavioral advertising, so there is no "Do Not Sell or Share" choice to make.
You have the right to know what we collect and how we use it, to delete it, to correct it, to opt out of sale or sharing (we do neither), to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. To exercise them, use the account area or write to us as described in section 16. You may use an authorized agent; we will ask the agent for proof of your permission.
We do not show a "Do Not Sell or Share My Personal Information" link, because we do not sell or share personal information. This policy, linked at sign-up and at checkout, is our notice at collection.
If you are in the EU or the UK
Sibyl Labs, LLC is the controller of the personal data described here. We rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Creating and running your account, signing you in, sending required notices | Performance of a contract (the Terms) |
| Taking payment and reconciling it with Stripe | Performance of a contract, and legal obligation for billing and tax records |
| Enforcing plan and computer limits, preventing abuse and payment fraud | Legitimate interests: running the Service fairly and keeping it secure |
| Security logging and staff audit | Legitimate interests, and legal obligation where it applies |
| Product usage heartbeat | Legitimate interests in understanding use of the product; you can object by switching it off |
| Marketing email | Consent, which you can withdraw at any time |
Where we rely on legitimate interests you can object, and we will stop unless we have compelling grounds. You also have the right to lodge a complaint with your data protection supervisory authority; in the United Kingdom that is the Information Commissioner's Office.
Section 13 covers transfers of your personal data to the United States. Section 1 says that we have not appointed a representative under Article 27.
Children
The Service is not for children under 13 years old, and we do not knowingly collect personal data from them. If we learn that a user is under 13, we delete the account. If you believe a child under 13 has given us personal data, write to us and we will delete it. Users between 13 and 17 may use the Service; the Terms, section 2, say which features need a parent's or guardian's permission.
Changes to this policy
We may update this policy. When we make a material change, we will post the new version here with a new version number and effective date, and tell account holders by email at least 30 days before it takes effect. The account area will ask you to accept the new version the next time you sign in. The current version is always at sibyllabs.org/privacy.
Contact
Privacy questions and requests: [email protected]
General support: [email protected]
Sibyl Labs, LLC, 8 The Green, Suite B, Dover, DE 19901