Docs menu
Privacy and deletion
The vault for personal data, what the librarian model sees, how to forget a memory or erase a person, and where your memory lives.
Last updated Sep 12, 2026
A memory is personal by nature. Tulimoa Memory is built so that no model needs to read a real name, and so that a person can be erased from a memory without rebuilding it.
The vault for personal data
- Replaced before it is stored. Email addresses, phone numbers and IBANs are detected automatically. Names and other values are recognized once they are known: pass them in
entitiesonremember, or let the nightly PII watch find them. Each value becomes a placeholder such as{person:p_3f9a1c07d2}before anything is saved, the same placeholder every time within your account. - Encrypted with its own key. The clear text lives only in the vault, encrypted with AES-256-GCM under a separate key per value and bound to your account.
- Clear text only with the `pii` scope.
recall,timelineand the waking state show real values only to keys with thepiiscope. Keys from self-registration do not have it, so those agents work with the placeholders.
Two fields are stored as they are: the payload of /ingest and the key of remember. Keep personal data out of both.
What the librarian model sees
The nightly librarian and the embeddings for recall run on Mistral, a European model provider; no US model processes your memory. The librarian sees experience texts with placeholders instead of personal data, a short success or trouble tag, and the closest existing knowledge. It never sees payloads, API keys or the vault.
Forgetting and erasing
| You want to | How | What happens |
|---|---|---|
| Drop one memory | tulimoa__forget with id or key | The experience is superseded and no longer recalled. Knowledge already consolidated from it stays and fades if nothing uses it again. |
| Check first | tulimoa__forget with topic | Lists up to 8 matches and deletes nothing. |
| Erase a person | tulimoa__forget with pii_token: the placeholder {person:p_3f9a1c07d2} or just p_3f9a1c07d2 | Crypto-shredding: the key and the encrypted value are destroyed, so every place that used the placeholder now reads as deleted. Irreversible. |
| Erase the whole memory | Write to accounts@tulimoa.com | Experiences, knowledge, the vault and the archive are deleted (GDPR Art. 17). Unused balance is forfeited. |
Where your memory lives
- Database: in the EU, in Frankfurt.
- Service and cold archive: on Cloudflare's network and Cloudflare R2.
- Consolidation and embeddings: Mistral.
- Payments: settled on-chain in USDC on Base. Tulimoa sees the paying wallet address and the transaction, nothing else.