security

Security

This page says what Memo reads, what it writes and what can leave your computer, so you can decide what to point it at. Imports leave your sources unchanged; separate Gmail cleanup commands can move mail when you run them with --yes. Memo keeps its records on your computer and sends text to an AI provider only when you configure one and allow it.

Imports leave your sources unchanged

• Note folders are only read. Hidden folders such as .obsidian are skipped. Memo writes files only when you export notes, into the folder you name, and never overwrites a file you edited.
• Mail imports open your mailbox read-only and do not mark mail as read. Memo never sends mail.
• Gmail cleanup is separate: memo mail trash and memo mail restore show a preview unless you pass --yes. Trash moves selected mail into Gmail's Trash; Gmail deletes it permanently after 30 days. Restore returns a logged run's mail while it remains in Trash. Cleanup requires a recent store backup and never runs from the sync timer. See Gmail cleanup.
• Tags leave your files, Gmail labels and mailbox flags as they are.

What Memo adds stays on your computer

Your notes, links, tags, tasks, reminders, memories, facts and proposed actions are kept in the local store, a file on your computer shared with tg and max. Search by meaning uses a model that runs on your computer. Reminders go to a program on your computer that asks for them, never to a messenger or a mailbox.

Deletions are respected

When you delete a note file or an email, its text leaves the local store on the next import. If an import finds that an unusually large part of a folder or mailbox is missing at once, it deletes nothing and tells you.

Agents suggest, you decide

• Proposed actions, and memories and facts added through the MCP server, wait for your review. Through the MCP server, an agent cannot confirm, accept, approve or reject.
• A fact, memory, relationship or proposed action added with the memo command records who wrote it. When an agent's terminal runs it (AI_AGENT or CLAUDECODE is set), the agent is the author and the fact, memory or relationship waits for you like one added through MCP. Yours is confirmed at once; in an agent's terminal, add --as-owner. --as-owner is a label, not a lock: an agent can pass it too, so tell your agent never to.
• Approving an action makes it a task for you. Memo never sends a message or an email.
• The agent log records the agent, the tool, the result and the time, never what the agent sent.
• Two accounts are treated as one person only after you link them. A matching name or email domain is never enough.

What can leave your computer

• memo ask gives the sources to your own agent by default. It sends them to an AI provider only with --analyze, and to a provider outside your computer only with --allow-remote as well. The provider's answer is generated text: check it against the sources.
• What your agent does with the text it reads is up to that agent and its provider. Memo cannot control it. Point your agent only at the sources you are willing to share with it.
• memo mail inspect --domain-age asks domain registries when a sender's domain was registered. Each question tells one registry one domain name; it is asked once and the answer is kept on your computer. Without the flag, inspect asks no one.