By default, your memories stay on your computer. Your account details come to us.
This policy covers enovari.ai, your Enovari account, and the few things the desktop app sends to us. Effective 2026-09-21.
Who we are Enovari is made by Silicon Harbor Technologies LLC, of Charleston, South Carolina, USA (“we”, “us”). We are responsible for the personal information described here. To reach us about privacy, use our support form; a person reads it. Our guiding principle is to collect only what we need.
Your memories The desktop app keeps what it remembers in SQLite files on
your own computer. In normal use those files are not sent to us. Two optional
features change that, and only if you turn them on. Relay: if you switch
on the relay so an assistant on another device can reach your computer, each
request and its answer pass through our server on the way; we do not store their
content. Hosted endpoint: if you connect an assistant to
enovari.ai/mcp instead of the desktop app, what it saves is stored
on our server under your account until you ask us to delete it. For both, we log
which tool ran, when, whether it failed and the size of the reply. If you lose
the files on your own computer, we cannot recover them.
AI assistants you connect Enovari gives memory to assistants made by other companies. Whatever an assistant reads from your memory is sent to that assistant’s provider, under that provider’s own privacy policy, not this one. If you connect an assistant by signing in through it (OAuth), we store the assistant’s registration with the IP address it registered from, a hashed connection token tied to your account, and a record of each connection with your IP address. Connection records are deleted after 90 days.
What an account stores Your name, email address, an organisation name if you give one, and a one-way (bcrypt) hash of your password — not the password itself. Also whether your email is verified, whether the account is active, when it was created, and any optional profile details you add, such as a username, phone number, job title or time zone. We use these to run your account, let you sign in and download the app, and reply to you.
Your API key We store a hash of it, its first four characters (so the account page can show which key you have) and when it was created. The full key is shown to you once and we cannot show it again.
When you write to us The support form sends us your name, email address, phone number if you give one, and your message. We store them, and email a copy to our support inbox so we can reply.
Chatting with Quinn The chat bubble on this site is Quinn, an automated AI assistant for Silicon Harbor. We store what you type and Quinn’s replies, and any name, phone number or email address you give it, so the team can follow up; a new request can also be emailed to us. Your browser keeps a random chat id in local storage (not a cookie) so a return visit continues the same conversation. To write its replies, the conversation is sent to Anthropic, whose Claude model powers Quinn. Chats are kept until you ask us to delete them.
Logs and your IP address Like most websites, our server records your IP address, the time, the page requested and your browser type when you visit. We also record your IP address with sign-in, sign-out, password-change and failed sign-in events, and use it to rate-limit sign-in and form requests. We use this to keep the service running and to protect accounts, not to profile you. The desktop app’s update check asks our server for the newest version number and sends no account details; your IP address reaches our logs as with any visit.
Cookies Two cookies, set only when you log in. sh_session
holds your session and is HttpOnly, Secure and SameSite=Lax, so scripts on the
page cannot read it. sh_logged_in only says yes or no, so the page
can show the right header. Both expire after 24 hours and logging out clears
them. We use no advertising or analytics cookies.
Who we share it with Only service providers that help us run the service: Oracle Cloud hosts our server; Resend delivers our email (verification codes, password resets, and support-form copies); Google hosts the inbox those support copies arrive in; Anthropic generates the chat assistant’s replies. If we ever charge, Stripe will take the payment on its own form, so card details go to Stripe and not to us; nothing is sent to Stripe today. We may also disclose information if the law requires it, or to protect our users, the public or ourselves from harm or fraud. If the company is sold or merged, we will tell you before your information becomes subject to a different privacy policy.
What we do not do We do not sell your personal information and we do not share it for advertising, including “selling” or “sharing” as California law defines them. There are no third-party analytics, trackers or ad networks on this site, and every font and file here is served from this site. Because we do not track you across other sites, we do not change anything in response to a browser’s Do Not Track signal.
How long we keep it Account details: until your account is deleted. Support messages: until you ask us to delete them. Verification codes last 15 minutes and reset links 60 minutes, then are deleted. Rate-limit records last minutes. Web server logs are rotated out after about 14 days; application and security logs are kept longer, for as long as they are useful for protecting accounts. When we delete an account we keep a record that the deletion happened, including the account’s name and email address. We may keep information longer where the law requires it.
Your rights You can ask to see the personal information we hold about you, get a copy, correct it, delete it, or object to or limit how we use it. On your account page you can change your password and manage your API key; for anything else, use our support form. We may need to confirm the request comes from the email address on the account. If we decline, you can ask us to reconsider, and depending on where you live you can complain to your data protection authority. We will not treat you differently for using these rights. Deleting your account does not touch the memory files on your computer.
Children Enovari is for adults. You must be 18 or older to create an account, and we do not knowingly collect personal information from children under 13. If you believe a child has given us information, tell us and we will delete it.
Security Passwords and API keys are stored only as hashes, the site is served over HTTPS, and sign-in is rate-limited. No method of sending or storing data is completely secure, so we cannot guarantee absolute security. If a breach affects your information, we will notify you as the law requires.
International users We are a US company. Information you send us is processed in the United States, and wherever our service providers operate, where privacy laws may differ from those where you live.
Changes When this policy changes we update the effective date on this page, and for significant changes we will take reasonable steps to let account holders know.