Privacy Policy

Effective Date: April 3, 2026

1. Introduction

Phloem ("the Plugin") is an AI memory plugin developed by Canopy HQ, LLC ("we", "us", "our"). This Privacy Policy explains how we handle information when you use Phloem.

We built Phloem with privacy as a core principle. Your memories and AI context are personal — you should own them completely, and only you should be able to read them.

2. Information We Do NOT Collect

Let's be clear about what we don't do:

• We do not collect your memories. All memories stored by Phloem live in a local SQLite database on your device.
• We do not have access to your data. We cannot read, view, or retrieve your stored memories.
• We do not sell data. We have no data to sell.
• We do not use analytics or telemetry. No tracking, no usage metrics, no crash reports sent to us.
• We do not require an account. Phloem works fully offline with no sign-in.

3. Information Stored Locally

Phloem stores the following information on your device only:

• Memories: Text content you have chosen to remember, along with embeddings for semantic search
• Metadata: Tags, timestamps, and source context for each memory
• Identity: A cryptographic keypair used to encrypt sync files — the private key is stored in your system Keychain and never transmitted to us

This data is stored in a local SQLite database at ~/.phloem/ on your computer. It never leaves your device unless you explicitly enable cloud sync.

4. Cloud Sync (Optional)

Phloem supports optional sync across your devices via your existing cloud storage (iCloud Drive, Google Drive, Dropbox, OneDrive, or Box). If you enable sync:

• Your memories are encrypted end-to-end using your personal X25519 keypair before leaving your device
• We cannot read your synced data — it is encrypted with a key only you hold
• Sync files are stored in your own cloud storage account, not on our servers
• You can disable sync and delete sync files at any time

Cloud sync is entirely optional. Phloem is fully functional without it.

5. Your Private Key

Your sync identity is a cryptographic keypair generated on your device:

• The private key is stored in your system Keychain (macOS) or a protected local file (other platforms)
• On macOS, iCloud Keychain can sync your private key to your other Apple devices automatically
• We never have access to your private key
• If you lose your private key and have no backup, encrypted sync files cannot be recovered — by design

6. Third-Party Services

Phloem integrates with AI tools (Claude Code, Cursor, VS Code, etc.) via the Model Context Protocol (MCP). In this role:

• Phloem receives queries from your AI tool and returns memories from your local store
• No data is sent to Canopy HQ or any third party during this process
• All communication happens locally between the Phloem process and your AI tool

7. Data Security

Your local data is protected by:

• Your operating system's file permissions (database stored at ~/.phloem/)
• Your device's encryption (if enabled)
• End-to-end encryption for any sync files using your personal keypair

We recommend enabling full-disk encryption on your device for maximum security.

8. Your Rights

You have complete control over your data:

• Access: View all stored memories via phloem list or your AI tool
• Export: Export your memories using phloem graft export
• Delete: Delete any memory with phloem forget, or delete ~/.phloem/ entirely
• Portability: Your data is in SQLite — an open format you can read with any SQLite tool

9. Children's Privacy

Phloem is not intended for users under 13 years of age. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this Privacy Policy occasionally. We will notify users of significant changes through:

• GitHub release notes at github.com/CanopyHQ/phloem
• Our website at canopyhq.io

11. Contact Us

Questions about this Privacy Policy? Contact us:

• Email: support@canopyhq.io
• GitHub: github.com/CanopyHQ/phloem
• Website: canopyhq.io