Where your memory lives.

Mnemo is local by default for local workflows. If you choose a route that leaves the iPhone, that choice is explicit, inspectable and blocked by Privacy Mode.

On-devicePrivate nodeBYOK

The short answer

Local is a rule, not a slogan.

The network boundary asks the policy before it asks the network.

01 / Data map

What stays on the iPhone.

The local path includes the capture files, transcripts, search index, derived memory objects, corrections and provider keys stored for your chosen integrations.

Audio

Local first.Notebook audio is normally deleted 24 hours after the moment ends. If transcription has not completed, Mnemo may keep that audio for up to seven additional days and deletes it sooner when transcription succeeds. A promoted Session follows its chosen retention policy.

Words

Transcripts and corrections remain in your library until you delete them.Raw transcript is not silently overwritten by cleaned text.

Memory

People, decisions, commitments and embeddings are derived locally where the chosen route allows.Derived objects keep source references and are removed when their source is forgotten.

Keys

BYOK credentials are kept in the iPhone Keychain.They are not written to the library database or routine logs.

02 / What can leave

Only a route you chose.

Transcription always runs on the iPhone; recordings are never sent to a speech service. Out of the box Mnemo processes on the device only. Five routes can reach the network, and only when you choose them: model downloads you confirm, which send no recording or text; an AI key you connect, or a private computer, which receives transcript text when you run Ask or a Skill by hand; optional iCloud sync of transcripts and metadata, never audio; optional device sync of transcripts and metadata, never audio, over the local network or a folder you choose; and webhooks you configure. The selected privacy policy is checked again at the network boundary for every request.

Privacy Mode blocks those off-device routes, including iCloud and device sync. It applies to work already queued, not only to the next action. There is no Mnemo account and no analytics SDK.

03 / BYOK, without the euphemism

Your key. Your provider. Your decision.

BYOK is an escape hatch for precision or a workflow you already operate. It is not the local path. When enabled, the provider receives the data required for the selected operation, under the provider’s own terms.

Network boundary
A provider cannot bypass the privacy policy by being called from a different screen.

04 / Deletion

Forget means forget.

Forgetting a moment removes its audio, transcript-derived data, embeddings and index entries. An expired Notebook moment stays visible as text history but does not pretend that its audio can still be played.

Read the security model

05 / Direct answer

Where does audio go? Audio is written to the iPhone first. Notebook audio is normally deleted 24 hours after a moment ends. If transcription is still pending or has failed, Mnemo may keep the audio for up to seven additional days so the only copy is not deleted before transcription can finish; it is deleted sooner when transcription succeeds. Promoting the moment to a Session applies the Session retention choice. Audio stays on the iPhone: neither optional iCloud sync nor optional device sync includes it. Transcript text can sync when the user enables one of those routes, or go to an AI provider with the user’s own key or to a private computer only when the user runs Ask or a Skill by hand and policy allows it.

Mnemo is operated by COBI Management SRL. For privacy questions or data requests, email privacy@highroadsoftware.com.