StructMemo Privacy Policy

StructMemo is a local-first structured note application. This policy explains how the production release handles information when you use local note features, create a backup, sign in, make a purchase, explicitly request an AI feature, or expressly publish content through Signals.

The controller is Theorisis LLC. For privacy questions, email donggyu@theorisis.com.

StructMemo does not sell personal information and does not use information for cross-company advertising tracking.

The complete StructMemo note library is not automatically synchronized through StructMemo cloud storage. Basic local note features do not require an account.

Local persistent content may include:

• workspaces, Thoughts, Code notes, folders, and hierarchy;
• Version History, Upper Structures, and Saved Views;
• Smart Gravity drafts and structure snapshots; and
• visible AI Response blocks saved in the library.

Deleting the app removes this local app data unless you created an external backup. Deleting a StructMemo account does not automatically delete local Thoughts.

Settings → Data & Backup provides Back Up Entire Library and Restore Library Backup. An account is not required to use these local-library tools.

A .structmemo-backup file contains readable note content and the relationships needed to reconstruct the library. It may include all local content categories listed above. Store it securely. After you export it, the file is controlled by you and by the Files, iCloud Drive, or other document provider you selected.

The backup excludes:

• authentication credentials, Apple tokens, and Keychain sessions;
• StoreKit JWS values, transactions, and subscription state;
• shared-credit wallets, grants, reservations, and ledgers;
• API keys, server secrets, and transient backend request IDs; and
• hidden reasoning and other provider-internal information.

Restore validates the selected backup and, after confirmation, replaces the current local library. It does not sign you in, restore or cancel a subscription, or grant AI Credits. StructMemo does not currently provide automatic iCloud synchronization.

Sign in with Apple is used for account authentication, subscription reconciliation, shared AI Credits, AI Response, Smart Gravity, Smart Naming, Restore Purchases, and account deletion. Core local note features remain available without signing in.

StructMemo receives Apple’s stable account subject identifier and, only when Apple supplies them, an email address and email-status fields. The current app does not send your Apple display name to the StructMemo service. Apple may provide a private relay email if you choose Hide My Email.

The service stores an internal user ID, a protected account-lineage value used to prevent account or promotional-credit relinking abuse, hashed StructMemo session credentials, login and session timestamps, and an encrypted Apple refresh token when Apple returns one. Raw Apple identity tokens and authorization codes are not stored as account records.

StructMemo Pro and StructMemo Pro Plus are purchased and billed through Apple StoreKit. Apple processes payment-card information. StructMemo does not receive or store payment-card numbers.

StructMemo verifies purchase and subscription information needed to determine entitlement and ownership. Records may include product and transaction identifiers, purchase, expiration, revocation, environment, verification, and account-ownership information. StructMemo stores a hash of the signed transaction payload rather than the StoreKit JWS value itself.

Shared AI Credit records include the plan and period, granted, reserved, settled, released, or refunded credits, feature, request and reservation identifiers, provider cost, model, token totals, status, and timestamps. These records operate and reconcile the service and may be linked to your StructMemo account.

AI processing begins only after an explicit user action. Depending on the feature, StructMemo may send the content necessary to perform your request through the StructMemo backend to OpenAI:

• Smart Gravity: eligible selected Thought or Code content, titles, your organization instruction, and structural context after you request generation;
• AI Response: the source Thought and an optional instruction after you confirm generation;
• Smart Naming: the current title and a bounded text preview when the feature is enabled and you perform the applicable save or naming action; and
• Living Layer generation (Studio): the text prompt you enter and a bounded structural schema after you ask the app to generate a Living Layer. The result is a procedural recipe that is rendered on your device.

Generated AI Response text returns to the app and may be saved as a visible local response block. The StructMemo backend is not general cloud synchronization for the full note library.

Every plan receives one included Living Layer generation per account per UTC day. On paid plans, further generations use monthly AI Credits only after you explicitly confirm the request. StructMemo keeps usage and cost records for these requests (provider work claims and the credit ledger) as operational records; StructMemo does not log the prompt text itself.

StructMemo uses OpenAI’s Responses API. Every current StructMemo Responses API request explicitly sets store: false, so StructMemo requests do not intentionally create persistent response objects through that API setting. This includes Living Layer generation requests. Signals public-content safety screening (Section 16) uses OpenAI’s moderation endpoint; see the same OpenAI documentation linked below for that endpoint’s data controls.

OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer explicitly opts in. Under OpenAI’s default controls, abuse-monitoring logs may contain prompts and responses and may be retained for up to 30 days, or longer where legally required. Theorisis does not represent that its OpenAI project has Zero Data Retention or Modified Abuse Monitoring enabled.

For current details, see OpenAI’s API data controls.

Voice Capture starts only when you use the microphone control and grant microphone and speech-recognition permission. Raw audio is passed through Apple’s iOS speech-recognition framework for transcription. It is not sent to the StructMemo backend or OpenAI, and StructMemo does not store raw audio. Recognized text becomes local Thought content if you save it.

Read Aloud uses Apple’s on-device/system speech-synthesis framework to speak a transient copy of selected local text. StructMemo does not send Read Aloud text to its backend for speech generation and does not create an audio recording.

Apple’s processing of system speech services is governed by Apple’s settings and privacy terms.

StructMemo retains the minimum account, subscription, transaction-verification, ownership, shared-credit, usage, and safety records needed to operate the service. Operational records may include a pseudonymous app-install identifier or its hash, internal user ID, request ID, feature and route, plan and entitlement path, status, model and provider, character or token totals, credit and cost totals, safe failure category, duration, and timestamps.

Ordinary operational diagnostics are designed not to log:

• raw Thought titles, bodies, or note identifiers;
• raw AI responses, full provider prompts, Living Layer prompt text, or backup contents;
• authentication tokens or Apple authorization values; or
• StoreKit signed JWS values, API keys, or server secrets.

Usage and accounting records may be associated with your account when you are signed in. StructMemo does not intentionally store raw IP addresses in its application records. Hosting, edge-network, and security providers may transiently process IP addresses and connection metadata to deliver and protect network requests.

• Apple: Sign in with Apple, StoreKit billing and subscription management, purchase verification, system document providers, speech recognition, and speech synthesis.
• OpenAI: processing the selected text, instructions, and context needed to provide requested AI features.
• Render: hosting the StructMemo application backend and processing request and operational connection information.
• Neon: managed database processing for the minimum account, entitlement, transaction, credit, usage, and safety records described in this policy.
• Cloudflare, Inc.: R2 object storage for image bytes you expressly publish through Signals (public appearance or Vision images, Photo Note public image revisions, and shared layer-package rendered states) and for moderation evidence copies of those images. The bucket is private: the StructMemo backend reads each object on request, with no public bucket URLs and no CDN cache. Private library content is never stored there.

These providers process information for Theorisis under their applicable service terms and data controls. A document provider you choose for an exported backup acts under your relationship with that provider.

Apple, OpenAI, Render, Neon, and Cloudflare operate internationally. Information sent to these providers may therefore be processed outside the country where you live. Categories are limited to the account, purchase, selected AI content, expressly published public content, usage, security, and connection information described above and are transferred electronically when you use the relevant service.

Theorisis does not claim that all processing occurs in a particular country or infrastructure region. Provider routing and the live service configuration may change; provider retention and safeguards are governed by their applicable terms and configured controls.

• Local library content remains on the device until you delete it, the app removes it through a feature, you replace the library during restore, or you delete the app.
• External backups remain until you delete them from the destination you selected.
• Account email and active Apple account fields remain while the account is active and are cleared from the user record through the implemented account-deletion flow.
• StructMemo sessions have a 30-day expiry and may be revoked sooner by sign-out, account deletion, or security controls.
• Transaction, entitlement, ownership, accounting, shared-credit, usage, security, fraud-prevention, and account-lineage records are kept as needed to reconcile purchases and credits, protect the service, meet accounting or legal obligations, and prevent duplicate or abusive claims. No shorter fixed period is promised where the required period depends on those purposes.
• Image objects for content you expressly published through Signals, and their moderation evidence copies, remain in private object storage while the content is public or under review. When you unpublish or delete the content or delete your account, the stored object is queued for deletion and is removed from object storage when StructMemo processes the deletion queue.
• Report and moderation audit records are retained for as long as needed for safety, dispute, and legal purposes.
• OpenAI’s default abuse-monitoring retention is described in Section 7.

You can:

• delete or edit local content using available app controls;
• delete an external backup from the provider where you saved it;
• unpublish or delete content you published through Signals using the app’s controls;
• sign out, revoke Sign in with Apple access through Apple, or use Settings → Delete Account; and
• manage or cancel a subscription through Apple’s subscription-management page.

Account deletion revokes available Apple authorization and StructMemo sessions, marks the StructMemo account deleted, clears email and other optional profile fields from the active user record, and expires active service entitlements in the implemented backend flow. Limited transaction, entitlement, ownership, accounting, credit, usage, security, fraud-prevention, and account-lineage records may remain for the purposes described above.

Unpublishing or deleting content you published through Signals, or deleting your account, immediately makes that content non-public in the StructMemo database and queues the stored image object for deletion as described in Section 12. Report and moderation audit records may be retained for safety, dispute, and legal purposes.

Deleting a StructMemo account does not cancel an Apple subscription, delete local Thoughts, or delete external backup files. Deleting the app removes local app data but does not delete an external backup or cancel an Apple subscription.

To request access, correction, or deletion assistance for service-side information, contact donggyu@theorisis.com. Theorisis may need to verify the request and may preserve records where necessary for the purposes described in this policy.

StructMemo uses HTTPS for service requests, iOS Keychain for the local StructMemo session credential, hashed server-side session tokens, and encryption for stored Apple OAuth refresh tokens. Access to service data is limited to operating and protecting StructMemo.

No system is completely secure. Keep your device protected and store readable .structmemo-backup files securely. Do not share credentials, transaction payloads, or private notes in support messages unless strictly necessary and intentionally provided.

StructMemo is not directed to children under 13. Theorisis does not knowingly seek personal information from children under 13. If you believe a child supplied service-side personal information, contact Theorisis so the matter can be reviewed.

When you expressly choose content for publication through Signals, StructMemo may send only the candidate public content needed for safety screening to OpenAI: candidate public text, sanitized candidate public images, and server-rendered Layers Included or Process View candidate public images. This processing occurs before the content becomes publicly readable.

When you expressly publish a photo-bearing Signal (a Photo Note public image), the server re-encodes the image as a JPEG of at most 2048 pixels on its longest side and at most 5 MiB. Embedded EXIF, orientation, and ICC metadata is not retained: the upload is rejected or the metadata is stripped during re-encoding. The sanitized image is screened by OpenAI’s moderation endpoint together with the Signal text and is then stored in the private object storage described in Section 10. Image-bearing Signals are subject to a monthly allowance by plan: 1 on Free, 12 on Pro, and 30 on Pro Plus.

StructMemo does not send your private Thought, private Vision, complete private library, content you did not select for publication, email, Apple ID, StructMemo internal user or content ID, authentication secret or token, or original EXIF or location information for this screening.

Automated moderation may permit safe content to become public, reject violating content before publication, or keep uncertain content private for human review. See the proposed bilingual StructMemo Public Content Terms.

This policy may be updated when StructMemo’s features, providers, or data practices change. The current version and effective date will be published at this URL. Material changes will be communicated through an appropriate notice where required.

Changes in version 2026-09-10.1: added Cloudflare R2 private object storage for expressly published Signals images and moderation evidence copies (Sections 10–12); described Photo Note public image re-encoding, screening, and monthly allowances (Section 16); described Living Layer generation in Studio, its included daily generation, AI Credit use, and operational records (Sections 6, 7, and 9); and described how unpublishing, deleting content, or deleting an account affects stored public images and moderation records (Sections 12 and 13).

Controller: Theorisis LLC
Email: donggyu@theorisis.com
Support: https://www.theorisis.com/structmemo/support
Privacy Policy: https://www.theorisis.com/structmemo/privacy