This policy explains what the hosted Commonplace service at cmmn.dev and app.cmmn.dev ("cmmn", "we") collects, why, and what you can do about it. It covers only the hosted service. If you run Commonplace yourself, you are the operator of your own copy and this policy does not apply to it.
Who is responsible
The controller under the EU General Data Protection Regulation (GDPR) is:
Controller: Jeffrey Endeman
Write to privacy@cmmn.dev for any question or request about your data.
What we collect
Your account
When you sign in, we store:
- your email address
- your display name, if the sign-in provider gives one
- an internal user id and the date your account was created
- a record of which sign-in provider you used, with that provider's account id for you and the dates you first and last signed in with it
- your plan (free) and, if you use it, a daily usage counter for features with limits
We create a personal workspace for you when your account is created.
Signing in with Google, GitHub, Discord, Apple or X
We only use these providers to confirm who you are. We ask for the smallest permissions that give us a verified email address:
| Provider | What we ask for | What we keep |
|---|---|---|
openid email profile | account id, verified email, name | |
| GitHub | read:user user:email | account id, primary verified email, name or username |
| Discord | identify email | account id, verified email, display name or username |
| Apple | name email | account id, email (this can be an Apple relay address if you chose "Hide My Email"), name (Apple only sends it the first time) |
| X | tweet.read users.read users.email | account id, confirmed email, name |
X requires tweet.read before it lets us read your profile. We do not read, store or post your posts.
The access token a provider gives us is used once, during sign-in, to read the profile above. We do not store it and we do not act on your behalf at the provider. We do not keep profile pictures, follower lists, repositories, servers or any other provider data.
If a provider gives us more than one verified email (GitHub can), we use them only to find an existing cmmn account with the same address. We store one address.
We link a new provider to an existing account only through a verified email address that matches.
Email sign-in links
We can send a one-time sign-in link to your email address. The link works once and expires after 15 minutes. These emails are sent from our own mail server.
What you and your agents put in
Commonplace stores what you and the AI agents you connect choose to save:
- memories (text, notes, facts, and their links and labels)
- boards, cards, comments and space messages
- rules and settings
- conversation threads, if you enable session capture or context handoff for an agent; capture is off by default
You decide what goes in. Please do not store other people's sensitive data, or secrets such as passwords and API keys. Commonplace flags text that looks like a secret or health information so you can review it, but it does not remove it.
We do not use your content to train AI models, we do not sell it, and we do not show ads. Search over your memories runs on our server with a local model. The agents you connect (for example Claude, Codex, Cursor or Grok) do read and write your content: what they do with it is covered by their own terms and privacy policies.
Agent connections and tokens
When you connect an agent, we store the connection: its name, the client type, its permissions, who created it, when it was created, last used, expires and is revoked. Access tokens are shown once and we keep only a one-way hash of each one. Personal access tokens expire after 365 days by default. Agent sign-in through OAuth uses access tokens that last one hour and refresh tokens that last 90 days. For OAuth we also store the name and redirect addresses that the agent app registers.
Webhooks
If you set up a webhook, we store its address and send it signed notifications that contain ids and a fixed set of metadata, not your memory text.
Cookies and browser storage
We use only the cookies needed to run the service. No analytics, advertising or tracking cookies.
| Name | Purpose | Lifetime |
|---|---|---|
cmmn_session | keeps you signed in (shared between cmmn.dev and app.cmmn.dev) | 30 days |
cmmn_signin | protects a sign-in in progress against forgery | 10 minutes |
cmmn_via | remembers which sign-in button you used last | 400 days |
We store only a one-way hash of your session id. Signing out ends the session on our side.
The app also uses your browser's local storage for small interface preferences (for example which hints you have already seen and voice input settings). That data stays in your browser.
Logs and security records
- App request logs: the app does not log request addresses, URLs or headers.
- Rate limiting: your IP address is held briefly in memory to limit abuse. It is not written to disk.
- Audit log: we record security events such as account creation, sign-ins, provider links, token changes and refused actions. Entries contain ids, the action, the outcome and the provider name. They do not contain your memory text or your email address. The audit log is append-only.
- Error logs: operational errors may be logged to diagnose and fix service problems.
- Mail logs: our mail server logs the recipient address and delivery status of emails it sends. No fixed mail-log retention period is currently set.
Where your data is stored
The service runs on a dedicated server rented from Hetzner Online GmbH in a data center in Falkenstein, Germany (EU). The service’s persistent data volume is encrypted. We keep backups separately under our control. Signing in with a provider and connecting agents or webhooks involves those parties, which may process data outside the European Economic Area (see "Third parties").
The server can read the data in your account so it can search it for you.
Third parties
We do not sell your data. Data reaches these parties only as described:
- Hetzner Online GmbH (Germany): provides the server infrastructure.
- Google, GitHub, Discord, Apple, X: only when you choose to sign in with them. They learn that you signed in to cmmn, and we receive the data listed above. Their own privacy policies apply to your account with them. Some of these companies are based outside the EU.
- Your email provider: receives the emails we send you.
- The agents and webhook addresses you connect: receive the content you let them access.
Google user data
cmmn's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice: we use your Google account id, email address and name only to sign you in and show your name in the app. We do not use Google data for ads, we do not sell it, we do not let people read it, and we do not use it to train AI models.
Sign in with Apple
If you choose "Hide My Email", we receive an Apple relay address and never see your real address. You can stop using Sign in with Apple for cmmn at any time in your Apple Account settings.
Sign in with X
We use data from X only to sign you in, as listed above. We do not post, read your posts, or share X data with anyone. If you remove cmmn from your connected apps at X, you can no longer sign in with X, and you can ask us to delete the X link from your account.
Why we may use your data (legal basis)
- To provide the service you signed up for (account, sign-in, storing and serving your content, agent connections): performance of a contract, GDPR Art. 6(1)(b).
- To keep the service secure and working (audit log, rate limiting, backups, error logs, sign-in limits): our legitimate interest in a safe and reliable service, Art. 6(1)(f).
- To meet legal obligations where they apply: Art. 6(1)(c).
How long we keep it
- Account data and content: for as long as your account exists. Deleting a memory removes it from the live memory store and search index. This does not erase independent copies in other content, history or backups.
- Sign-in validity: sessions work for 30 days, sign-in links for 15 minutes, and sign-in attempts for 10 minutes. These are validity periods, not guarantees that every expired database record is immediately erased. Expired session and legacy link records are not yet automatically purged; expired email challenges and provider sign-in attempts are cleaned up during later sign-ins.
- Daily provider sign-in counters: counters more than 40 days old are removed during later sign-ins. These counters are per provider and day, not per person. Feature usage counters may be linked to your account.
- Backups: our backup retention policy is 30 days. Deleted data can remain in backups until those backups expire.
- Audit log: kept for security. Identifiers in these records may still be linked to a person; account deletion does not guarantee that the remaining records are anonymous.
- Account deletion: we delete your account and personal workspace within 30 days of your request. There is no self-service account deletion; the operator handles requests.
Your rights
Under the GDPR you can ask us to:
- give you a copy of your data (access and portability)
- correct it
- delete it
- restrict or object to how we use it
Email privacy@cmmn.dev from the address on your account. We answer within one month. You can also delete individual memories, cards and connections yourself in the app or through your agents. We provide account data exports on request.
You have the right to complain to a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
Age
cmmn is not meant for children. You must be at least 16 to use it.
Security
We use HTTPS everywhere, store only hashes of tokens and session ids, encrypt the persistent data volume, and limit what each agent connection can do. No system is perfectly secure. If we learn of a breach that affects your data, we will tell you and the authorities as the law requires.
Changes
We may update this policy. We will change the date at the top, and for important changes we will tell signed-in users in the app or by email before they take effect.