Privacy Policy

Context Box ("we", "us", or "our") operates the Context Box service at contextbox.net. This policy explains what data we collect, how we use it, and your rights over it.

We built Context Box around a simple principle: your memory is yours. We collect the minimum data necessary to run the service, encrypt your personal memories at rest, and never use your data to train AI models.

Account information: Your email address and a bcrypt hash of your password. We never store your password in plaintext.

Conversation exports: When you upload a ChatGPT, Claude, or Gemini export file, we process it to extract memory chunks and then permanently delete the source file from our servers. We do not retain your raw export files.

Memory chunks: The extracted text fragments from your conversations, stored encrypted at rest using AES-256-GCM with a unique per-user key. The key itself is protected by AWS Key Management Service (KMS) — we cannot read your memories without your account being active.

Activity timestamps: When our MCP server is queried, we log only the timestamp and result count — never the query text itself. This is a hard architectural constraint, not just a policy.

Billing information: Payment card details are handled entirely by Stripe. We store only a Stripe customer ID and subscription status — never your card number or CVV.

We are explicit about what we deliberately avoid storing:

• Raw MCP query text (memory search queries)
• Plaintext encryption keys — your data encryption key (DEK) is never persisted beyond a single request lifecycle
• Raw IP addresses — if we log IP data for fraud or consent purposes, it is hashed with SHA-256 first
• Your raw export files after processing

We use your data solely to provide the Context Box service:

• To authenticate you and maintain your session
• To index your conversation history into searchable memory chunks
• To serve memory results when your AI tools query the MCP endpoint
• To process subscription payments via Stripe
• To send transactional emails (account verification, password resets) via Resend

We do not sell your data. We do not use your data to train any AI model. We do not share your data with third parties except as required to operate the service (AWS for infrastructure, Stripe for billing, Resend for email).

We rely on service providers to operate Context Box, including AWS for hosting and storage, Stripe for payments, Resend for transactional email, and infrastructure monitoring providers for reliability and security. These providers may process limited data only as needed to provide their services to us.

Your memory chunks are encrypted at rest using AES-256-GCM. Each user has a unique Data Encryption Key (DEK) generated at account creation. That DEK is itself encrypted using AWS KMS (a hardware-backed key management service) and stored alongside your account — so even if our database were compromised, your memories would be unreadable without the corresponding KMS key.

All traffic between your devices and our servers is encrypted in transit using TLS.

No internet service can guarantee perfect security. If we learn of a security incident affecting your personal data, we will investigate and notify affected users or regulators when required by applicable law.

All data is stored and processed in AWS us-east-1 (Northern Virginia, USA). We do not transfer your data outside the United States at this time.

Export: You can download all your memory chunks as a portable JSON file at any time from your dashboard or via the API (GET /user/export).

Deletion: You can permanently delete your account and all associated data from the Settings page. This triggers a hard delete of your memory chunks, activity logs, and account information. Your email address is blocked from re-registration for 30 days as a fraud prevention measure.

Pause writes: You can pause all new memory writes from your Settings page without deleting existing data.

We retain your data for as long as your account is active. If you delete your account, all personal data is permanently deleted within 24 hours. Aggregate, non-identifying usage metrics (e.g. total active users) may be retained for business analytics.

We use a single httpOnly cookie to store your session refresh token. We do not use tracking cookies or third-party analytics cookies.

Context Box is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal data, contact us and we will delete it where required.

We may update this Privacy Policy from time to time. For material changes, we will provide notice by email, in the dashboard, or both before the updated policy takes effect where required by law.

For privacy questions or data requests, contact us at hello@contextbox.net.