Where your memory lives.

Mnemo is local by default for local workflows. If you choose a route that leaves the iPhone, that choice is explicit, inspectable and blocked by Privacy Mode.

On-devicePrivate nodeBYOK

The short answer

Local is a rule, not a slogan.

The network boundary asks the policy before it asks the network.

01 / Data map

What stays on the iPhone.

The local path includes the capture files, transcripts, search index, derived memory objects, corrections and provider keys stored for your chosen integrations.

Audio

Local first.Notebook audio is retained for 24 hours, then deleted automatically. A promoted Session follows its chosen retention policy.

Words

Transcripts and corrections remain in your library until you delete them.Raw transcript is not silently overwritten by cleaned text.

Memory

People, decisions, commitments and embeddings are derived locally where the chosen route allows.Derived objects keep source references and are removed when their source is forgotten.

Keys

BYOK credentials are kept in the iPhone Keychain.They are not written to the library database or routine logs.

02 / What can leave

Only a route you chose.

Transcription always runs on the iPhone; recordings are never sent to a speech service. Out of the box Mnemo processes on the device only. Four routes can reach the network, and only when you choose them: model downloads you confirm, which send no recording or text; an AI key you connect, or a private computer, which receives transcript text when you run Ask or a Skill by hand; optional iCloud sync of transcripts and metadata, never audio; and webhooks you configure. The selected privacy policy is checked again at the network boundary for every request.

Privacy Mode blocks those off-device routes. It applies to work already queued, not only to the next action. There is no Mnemo account and no analytics SDK.

03 / BYOK, without the euphemism

Your key. Your provider. Your decision.

BYOK is an escape hatch for precision or a workflow you already operate. It is not the local path. When enabled, the provider receives the data required for the selected operation, under the provider’s own terms.

Network boundary
A provider cannot bypass the privacy policy by being called from a different screen.

04 / Deletion

Forget means forget.

Forgetting a moment removes its audio, transcript-derived data, embeddings and index entries. An expired Notebook moment stays visible as text history but does not pretend that its audio can still be played.

Read the security model

05 / Direct answer

Where does audio go? Audio is written to the iPhone first. Notebook audio is automatically deleted after 24 hours unless you promote it to a Session. Audio stays on the iPhone: it is never sent to a speech service, and optional iCloud sync never includes it. Transcript text can go to an AI provider with your own key, or to a private computer, only when you run Ask or a Skill by hand and the route allows it.

Mnemo is operated by COBI Management SRL. For privacy questions or data requests, email privacy@highroadsoftware.com.