Can AI memory
actually be private?
Every memory product claims privacy, so the claim by itself carries no information. The useful version of the question is narrower: for one specific system, what crosses the network, who receives it, and can an ordinary user confirm the answer without trusting the person who wrote the software.
The architectural answer, and why it only gets you half way
Memrith stores everything in plain files on the user's own disk. There is no account, no sync, and no server holding user content, and that last one was never built rather than switched off. This removes the single largest category of privacy risk by construction, because a corpus that does not exist cannot be breached.
While "local-first" sounds like a complete answer, it is a claim about where data sits still, and privacy failures almost always happen while data is moving. The question I actually had to answer was what leaves the machine during ordinary use.
| Outbound call | Carries | When |
|---|---|---|
| Your AI provider (Anthropic, OpenAI, OpenRouter) |
Your prompt, and the memory selected for it | Every AI request you start |
| Hugging Face | Nothing but the request itself, for a one-time 128 MB model download | First run of semantic search |
| GitHub | Nothing identifying, for an update check | Roughly daily, and skippable |
| Removed | ||
| Removed |
The first row is the honest answer and it does not go away. If you use a hosted model your words reach that company, because that is what using a hosted model means, and no amount of local-first architecture changes it. What a system can do is be precise about which words and at what moment, and let you move the destination or remove it completely by running a model on your own machine.
The finding I did not expect
Semantic search needs an embedding model, which turns text into a vector so that similar meanings land near each other. The obvious way to build this is to call an embedding API, and most products do, which means every piece of text you ever stored gets shipped to a vendor for indexing, separately from and in addition to your actual conversations.
I audited the embedding path expecting to find a cloud dependency I had forgotten about. The audit found the opposite.
Embedding and retrieval are fully independent of the AI provider. Setting the provider to anything at all, including a model running locally, has zero effect on embedding generation, vector dimensions, or ranking; there is no cloud embedding dependency anywhere in the path and no model in the loop re-ranking results.
The one fallback that exists is the correct one. If the local embedder is unavailable, retrieval degrades to keyword matching, and it never falls back to a cloud service.
- Code audit of the full embedding path, written up as
LOCAL_EMBEDDING_AUDIT.mdin the repository. - Embedding runs
BAAI/bge-small-en-v1.5locally, throughsentence-transformerswhere it is available and an ONNX runtime backend everywhere else (brainbox/local_embeddings.py). - Model weights are fetched once from the official repository at a pinned revision and verified against a sha256 checksum before they are installed.
This matters more than I expected, because it creates a privacy property that is structural instead of promised. Indexing is the step that touches everything you have ever written rather than just the prompt in front of you, and here it runs on your own processor and provably cannot quietly start running somewhere else. That is a fact you can confirm by reading one file, which is a different kind of thing from a policy you have to believe.
Two things I removed, and what removing them showed
While Memrith was a commercial product it did 2 things that an honest privacy claim has to disclose. It validated a licence key against a payment provider, sending that key along with a hash of the machine's hostname, and it offered opt-in crash reporting through Sentry. Neither was hidden, both were disclosed, and both were defensible.
They are both gone now, and what removing them showed was more interesting than either feature.
The licence check was the only mechanism in the entire system capable of denying a user access to their own stored memory, and it depended on a server that no longer exists. Had that gate been left in place, a server going dark would have locked people out of files sitting on their own disks.
This is a general property of any memory system with a commercial gate on it, and it stays invisible until somebody tries to switch the business off. The data was always local; the permission to read it was not. A system is only as durable as the least durable thing standing between a user and their own files, and for a while that was a payment provider's uptime.
Crash reporting taught a smaller lesson. It was opt-in, it scrubbed API keys before transmission, and it disabled PII collection, which is careful by any reasonable standard. While all of that is true, a site claiming to collect nothing while shipping a telemetry SDK is making a claim with an asterisk on it, and removing the dependency completely was the only version of the sentence that survives inspection.
The crash-reporting SDK was still being installed into the macOS application bundle months after the feature itself had been switched off in code. Catching that required reading the build script rather than the application source, which shows where privacy claims actually need auditing.
What I conclude
Private AI memory is achievable, though not by making a promise about it. It requires 3 structural properties, and the first 2 are the ones usually missing:
- Indexing has to run locally. Retrieval touches your whole corpus rather than one prompt, so if that step runs in somebody's cloud, very little else you do about privacy matters.
- Nothing may gate access to local data on a remote service. Otherwise your memory carries an expiry date set by somebody else's business.
- The claim has to be checkable. Open source, a published inventory of outbound calls, and a provider dashboard the user can read independently to confirm what was actually sent.
What is not achievable, as long as you use a hosted model, is privacy from the model provider, and I would rather state that plainly than engineer around the edges of it. The only complete answer is a local model, which is why that path exists in the apparatus, and it is also why question 3 turned out to be mostly about what breaks when you take it.