Privacy Policy

1. Information We Collect

Account Information

When you sign in with Google, we receive:

• Your name and email address
• Google account identifier (user ID)
• Profile picture URL (if available)

When you sign in with Microsoft (a work, school, or personal Microsoft account), we receive:

• Your name and your Microsoft sign-in address (email)
• Your Microsoft account identifier

Connected Services (Optional)

You can choose to connect Google services so your AI has real context. If you grant them — every grant is shown on Google's own consent screen, where you decide — we access:

• Gmail — message metadata and content of threads, used to surface priority mail, action items, and the people who matter to you
• Google Calendar — your events, used for scheduling awareness and meeting prep
• Google Drive — files you search for or point the AI at, used to answer your questions

Each connection is a separate OAuth grant that you approve on Google's own consent screen. You can revoke any of them at any time from your Google Account settings, and the connection stops working right away (an access already granted lapses within the hour).

You can also choose to connect Microsoft services. If you grant them — every grant is shown on Microsoft's own consent screen, where you (or your organization's administrator) decide — we access:

• Outlook mail — message metadata and content, used to surface priority mail, action items, and the people who matter to you
• Outlook calendar — your events, used for scheduling awareness and meeting prep

The connection keeps a refresh token so your mail and calendar can sync while you're away. You can revoke it at any time: a work or school account under My Apps (or by your administrator), and a personal account under Microsoft account → Apps and services. The connection stops working right away (an access already granted lapses within the hour). Data from Microsoft services is used only to provide features to you — never for advertising, and never sold.

Browser Extension Captures (Opt-In, With a Ledger)

Our browser extension can save things you choose into your memory. Every capture requires your explicit action — nothing is ever saved silently. Here is what you can capture:

• Chats — on the chat sites the extension supports (they are listed, one by one, in the extension's Settings), it notices a conversation and asks before keeping anything. You see the conversation content before it is saved.
• Highlighted text — select text on any page and click "Make it a Memory." The extension saves the text you selected, the page URL, and a deep-link back to the source.
• Images — right-click any image and choose "Make it a Memory (image)." The extension saves the image and the page it came from.
• Screenshots — right-click and choose "Screenshot to Memory," then drag-select the area you want. The extension saves a cropped image of the region you chose.
• Links and videos — on the video sites the extension supports (currently YouTube and Instagram), keep the video's link, title and channel or author name and, where the site provides them, its captions (otherwise its description). The video itself is never copied. You choose a reason-chip before saving.
• Workflows (Teach Mode) — press Start and record a step-by-step procedure on any site. The recorder captures what you do at a semantic level — which element you clicked, which page you navigated to, what structure appeared — while preserving your privacy: no keystrokes, no typed values, no passwords are captured. The recording stays local on your device: you can review it, edit or redact any step, save it, or copy it yourself. The extension never sends a recording to us.
• Voice memos — click "Record a voice memo" in the extension to record yourself, or a conversation. Chrome asks for your microphone the first time; if you choose, Chrome can also include the sound from one tab you pick (for an online call). While you record, Chrome's built-in speech recognition writes the words out on screen; that service is run by Google, so your microphone audio passes through it to become text. The recording itself stays on your computer — you can download it — and is never uploaded to us. Only when you press "Save to my memory" do we receive the written words, the title you gave, your note, the language, the length, and when it was recorded. Until then the words are kept only on your device as a draft. If you record other people, please tell them first.
• Documents — click "Keep a document" in the extension and choose a PDF, a Word document or a text file (or the PDF open in your tab). The extension reads the file on your own computer and shows you its words. Only when you press "Save to my memory" do we receive those words (up to about 200,000 characters), the title, your note, and the file's name, type and number of pages. The file itself is never uploaded to us. Please keep only documents you're allowed to keep, for your own private use (see our Terms).
• Stigmergize — right-click a page and choose "Stigmergize this page" to keep a short marker of it. The marker records the page's title, URL, main heading, and meta description, plus any text you had selected.
• Pinned sites (Pulse) — right-click a page and choose "Pin this site to Pulse" to appoint a site you rely on (your bank, your clinic, your school). You choose a category, and can add a note and whose site it is; nothing is sent until you press Pin. The pin keeps the site's address only — never the page you were on. After that, each time you visit a site you pinned, the extension sends that site's name and the time to your own account, so Pulse can notice your visit rhythm. It never reads or sends the page itself, and visits to sites you did not pin send nothing.
• "What do I remember here?" — select text on any page and click this button to see what you have already kept about it. Only when you click, the selected text (up to 500 characters) is sent to your own account to look it up. It is used for the lookup, not saved as a new memory. Selecting text on its own sends nothing.

All captures are governed by consent:

• Consent buckets — captures are grouped by category (chats, email, shopping, health, school, any page). Every bucket except chats starts off; nothing in an off bucket is ever sent to our servers. Chats start on, paired with ask-first (below), and can be switched off in one tap.
• Ask-first — buckets can be set to "ask me before keeping." You'll see a prompt in the page before anything is ingested. No answer within 20 seconds means it is not captured — silence never becomes consent.
• The ledger — every capture, skip, and release writes a row you can read in the extension popup: when, what, from where. Transparency isn't a request form; it's a running log.
• Local-first — your consent settings and ledger live in your browser's local storage, on your machine. Once you're logged in, your choices are also mirrored to our servers and enforced there, closing the gap a misbehaving client could otherwise exploit.
• Sites it never keeps from — the extension carries a built-in list of adult websites (and adult web addresses such as .xxx). On those sites it shows nothing and keeps nothing, whatever you click.
• Signed out means silent — until you log in, the extension sends nothing to our servers at all. What you type on AI-chat sites is never sent as you type; the extension does not add your memories to messages you send to other AI platforms.

Chrome Web Store User Data Policy. The use of information received through the Make a Memory browser extension (by MindSpace) adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data the extension collects is used only to provide its single purpose — keeping the things you choose in your own private memory, and showing them back to you. It is not sold, not transferred to third parties except to run the service (our hosting provider, listed below) or where the law requires it, not used for advertising, not used to determine credit-worthiness or for lending, and never used to train AI models for anyone but you. No person reads it except with your permission, for security investigations, to comply with the law, or in aggregated, anonymized form to run the service.

Usage Data

We automatically collect:

• Pages and features you interact with
• Timestamps of your sessions
• Browser type and device information
• IP address (for security and rate limiting)

Your Memories & Content

When you use the platform, we store:

• AI memories — your conversations, context, and the things your AI learns about you
• Your conversation with Vega — the last 200 lines you and Vega exchanged, kept so the conversation is still there when you refresh the page. Only you can read it. It fades 30 days after your last conversation with Vega, and it is deleted at once if you delete your account.
• Canvas artifacts and configurations you create
• Preferences and settings you configure

2. How We Use Your Information

Purpose	Data Used
Authentication & account access	Google profile, email, user ID
Providing personalized AI experiences	Your content, preferences, interactions
Context from connected services (only if you connect them)	Gmail threads, calendar events, Drive files you point at
Improving the platform	Aggregated, anonymized usage data
Security & abuse prevention	IP address, session data
Customer support	Account info, usage context

3. Data Storage & Security

Your data is stored on Amazon Web Services (AWS) infrastructure in Canada (ca-central-1), in PostgreSQL databases, with a Redis cache for speed. Everything travels between your browser and us encrypted (HTTPS, TLS 1.2 or newer), and our servers only accept encrypted connections to the databases. Files we store are encrypted at rest. We are moving our databases and cache to encrypted-at-rest storage; this page will say so the day it is done. Access to the infrastructure is limited to Distilligent's own operators.

How Your Memories Are Stored

Your AI memories flow through a multi-tier architecture designed for both speed and safety:

• Hot layer (Redis) — Active memories cached for fast retrieval during conversations
• Persistent layer (PostgreSQL) — All memories durably stored in PostgreSQL on AWS in Canada
• Per-user isolation — Every user's data is logically isolated. Your memories are never mixed with, accessible to, or visible to other users

Security Measures

• Data between your browser and us is transmitted over TLS/HTTPS
• Files we store are encrypted at rest; database encryption at rest is being rolled out (see above)
• Once you're logged in, captures are tied to your verified login token, so memories are provably yours
• Once you're logged in, consent is also enforced server-side: a capture from a bucket you switched off is rejected at the door
• Secure session management with HTTP-only, Secure cookies
• Role-based access controls at every layer
• Regular security reviews and monitoring

4. Third-Party Services

We integrate with the following third-party services:

• Google OAuth 2.0 — For authentication, and for the optional service connections described above. Google's privacy policy applies to data Google collects.
• Microsoft identity platform (Microsoft Entra ID) — For "Sign in with Microsoft", and for the optional Outlook connections described above. Microsoft's privacy statement applies to data Microsoft collects.
• Amazon Web Services (AWS) — Our hosting infrastructure provider (Canada, ca-central-1 region). Subject to AWS's security and privacy practices.
• AI Model Providers — Amazon Bedrock (run by AWS, in the United States, us-east-1) is the AI service we use today to understand what you keep and to answer you; Anthropic, OpenAI, Google and xAI models are used only where a feature names them. Conversations may be processed by AI model providers to generate responses. We do not send your personal account information to these providers; only conversation content necessary for generating responses. Separately, if you ask the extension to remember a conversation, it reads that conversation from the chat site in your browser and sends it only to your own Distilligent account.

We do not embed third-party tracking pixels, analytics scripts, or advertising networks.

5. Cookies, Session Data & Extension Storage

We use essential cookies only — the bare minimum to keep you signed in and safe:

Cookie	Purpose	Attributes
Session cookie	Keeps you signed in across pages	HttpOnly, Secure, SameSite=None
CSRF token	Prevents cross-site request forgery	Secure

That's it. No tracking cookies. No third-party cookies. No advertising cookies. No persistent cookies that follow you around the internet.

The browser extension keeps your consent settings, login token, and capture ledger in your browser's local extension storage — on your machine, readable by you, removed when you uninstall the extension.

6. Data Retention

We retain your data as follows:

• Account data — Retained while your account is active
• Content you create — Retained until you delete it or close your account
• Released memories — Held in recovery for 10 days after you release them, then permanently deleted
• Usage logs — Retained for up to 90 days, then anonymized or deleted
• Security logs — Retained for up to 12 months for abuse prevention

When you request account deletion, we remove your personal data within 30 days. Some anonymized, aggregated data may be retained for service improvement.

7. Your Rights

Your data is yours. Full stop. Most privacy policies make you file a request and wait; we built the rights into the product, live by default:

• See — View all personal data we hold about you, including your AI memories and the extension's capture ledger. Not by request — by default.
• Release individual memories — Use the Release button in the extension ledger or the Memory Constellation to remove specific memories. Recoverable for 10 days, then gone.
• Change your mind about capture — Flip any consent bucket off at any time. From that moment, nothing in that category is captured.
• Delete your account — Request complete deletion of your account and all associated data
• Export — Request a copy of your data in a machine-readable format; we send it within 30 days
• Correction — Request correction of inaccurate data
• Disconnect services — Revoke Gmail, Calendar, Drive, Outlook, or sign-in access at any time through your Google Account settings or your Microsoft account / My Apps

To exercise any of these rights, use the in-app tools where available, or contact us at the address below.

8. Beta Program

Distilligent is currently in beta. That means features evolve quickly — but the covenant above does not: opt-in capture, the visible ledger, and your right to release are commitments, not features. If a change would materially affect what we collect or how we use it, we will update this policy and tell you before it applies to you. Beta feedback you send us (bug reports, suggestions) may be kept to improve the product.

9. Children's Privacy

Distilligent is for people 17 and older. Someone aged 13 to 16 may use it only with the permission of a parent or guardian. Distilligent is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal data, or that someone under 17 is using Distilligent without a parent’s or guardian’s permission, please contact us and we will promptly delete it.

10. International Data Transfers

Our services are hosted on Amazon Web Services (AWS) in Canada. Distilligent is operated by Distilligent AI Inc., a United States company. If you access the platform from outside Canada, your data may be transferred to and processed in Canada (and, for support and operations, in the United States). We take steps to ensure your data is protected in accordance with this policy regardless of where it is processed.

11. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will update the "Last Updated" date at the top and, where appropriate, notify you via email or through the platform. Continued use of the service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this privacy policy, your data, or anything else — we're real people and we'll answer.