# Privacy policy Effective 2026-10-28. This policy covers Querymemo: the website at querymemo.com, the Querymemo account, and the Querymemo command-line tool and MCP server ("the CLI"). **The short version.** The CLI runs on your computer. Google sends your Search Console data straight to it, and your AI tool reads it there. Our server never receives that data. Our server keeps your account: your Google account ID and email, your plan, and the hostnames of the websites on your plan. ## Who we are Querymemo is run by ACEFINA LLC, a Wyoming limited liability company. Mailing address: 9550 Ploof Rd SE, Unit 2B, Leland, NC 28451, USA. Contact: [hello@querymemo.com](mailto:hello@querymemo.com). ACEFINA LLC is the data controller for the account data described below. ## What the CLI does on your computer When you run `npx querymemo init` or `npx querymemo login`, the CLI opens Google's sign-in page in your browser and asks for these permissions: - `openid` and `email`: your Google account ID and email address, to identify your Querymemo account; - `https://www.googleapis.com/auth/webmasters.readonly`: "View Search Console data for your verified sites". This is read-only. Querymemo never asks for the write scope. Google returns a refresh token to the CLI on your computer. The CLI stores it in your operating system's keychain (macOS Keychain, Windows Credential Manager or the Linux Secret Service). If no keychain is available, it stores it in a file readable only by your user account, in Querymemo's settings folder, and tells you so. When your AI tool (Claude Code, Codex, Grok or another MCP client) calls a Querymemo tool, the CLI asks Google's Search Console API for the rows it needs, computes the answer on your computer, and returns the answer to your AI tool. The CLI keeps Search Console data only in memory while it is running. It doesn't write it to disk. Its settings file holds your email, your Google account ID, the sites you picked and the last plan answer from our server. **Your AI tool and its provider.** Your AI tool sends tool answers to its model provider (for example Anthropic for Claude Code, OpenAI for Codex, xAI for Grok), as it does with any tool you run. That transfer is the feature you ask for when you ask the question, and it is governed by your agreement with that provider. We have no access to your conversations. The CLI also reads public web pages on your own sites (the title, H1, meta description, canonical and robots tags) when a tool checks a page, and Google's public Search Status Dashboard feed to name Google incidents. Those requests go from your computer to those sites. ## What our server receives and keeps The CLI proves who you are to querymemo.com with a short-lived Google ID token. It sends nothing else about you, except the hostname of each website a tool is asked about (once per session of your AI tool), so your plan's site count can be kept. | Data | Why | How long | |---|---|---| | Google account ID and email address | To identify your account and contact you about it | Until you delete the account, or 180 days after it was last used | | Plan | To know how many sites your account covers | Same as above | | Hostnames of the websites on your plan (for example example.com) and when each was added | To count sites against your plan and show them on your account page | Until you remove the site or delete the account | | Waitlist email address and the plan you asked about | To email you the day Querymemo goes public and the day paid plans open (two emails at most) | Until you ask us to remove it, and at most 12 months after you joined | | A keyed one-way hash of the Google account ID of a deleted account, and when it was deleted | So deleting and re-creating an account can't skip the 7-day site-swap rule. It can't be turned back into your ID | 7 days after deletion | | Error logs our code writes (time, path, error message) and request traces Cloudflare samples (time, URL, status, country, and the IP address and user agent Cloudflare records) | Security and fixing errors | 7 days (Cloudflare Workers Logs) | Our server does **not** receive or store Search Console queries, pages, clicks, impressions, positions, URL Inspection results, sitemaps, any token that can read Search Console, or your conversations. It stores no Google tokens at all. **The account page.** On querymemo.com/account you sign in with Google using only `openid` and `email`. Google sends our server a token for that sign-in; we read your account ID and email from it and discard it. A signed session cookie keeps you signed in for 12 hours, and signing out ends it everywhere. If you use the site picker there, your browser asks Google for the list of your Search Console properties with read-only access and shows it to you. That list and that access token stay in your browser, and the page revokes the token at Google as soon as the list has loaded. Only the hostnames you choose are sent to our server. ## Cookies querymemo.com sets only these cookies, all first-party and strictly necessary: a session cookie on the account page (12 hours), a sign-in state cookie (10 minutes) while you sign in with Google, and nothing else. There are no advertising cookies, no third-party trackers and no analytics cookies. ## Google API Services User Data Policy Querymemo's use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. The Limited Use requirements, as Google states them, are: > Limit your use of data to providing or improving user-facing features that are prominent in the requesting application's user interface; > Transfers of data are not allowed, except: To provide or improve your appropriate access or user-facing features that are visible and prominent in the requesting application's user interface and only with the user's consent; For security purposes (for example, investigating abuse); To comply with applicable laws; or, As part of a merger, acquisition, or sale of assets of the developer after obtaining explicit prior consent from the user. > Don't allow humans to read the data, unless: You first obtained the user's affirmative agreement to view specific messages, files, or other data, with the limited exception of use cases approved by Google under additional terms applicable to the Nest Device Access program; It is necessary for security purposes (for example, investigating a bug or abuse); It is necessary to comply with applicable law; or The data (including derivations) is aggregated and used for internal operations in accordance with applicable privacy and other jurisdictional legal requirements. > All other transfers, uses, or sales of user data are prohibited, including: Transferring or selling user data to third parties like advertising platforms, data brokers, or any information resellers. Transferring, selling, or using user data for serving ads, including retargeting, personalized or interest-based advertising. Transferring, selling, or using user data to determine credit-worthiness or for lending purposes. In practice, for Querymemo: - Search Console data is used only to answer the questions you ask your AI tool, on your computer. - The only transfer is the one you start: the answer goes to the AI tool you connected, which you choose and control. - We don't sell data, use it for advertising, or use it to train AI models. - Nobody at Acefina reads your Search Console data. It never reaches our systems. ## Security - The CLI talks to Google and to querymemo.com over HTTPS only. - Google tokens stay in your system keychain. Querymemo's code allows only four read calls to Google (the property list, search analytics, sitemaps and URL Inspection) and refuses any other request before it is sent. - Our server stores no Google tokens, so there are none to leak from it. Account data is stored in Cloudflare D1, encrypted at rest by Cloudflare, and sent over TLS. - Details and how to report a vulnerability: [querymemo.com/security](https://querymemo.com/security). ## Your choices - **Remove Querymemo from a computer:** run `npx querymemo logout`. It revokes the Google token at Google and deletes it from the keychain. - **Remove Google access everywhere:** remove Querymemo at [myaccount.google.com/permissions](https://myaccount.google.com/permissions). - **Delete your account:** use "Delete my account" on [querymemo.com/account](https://querymemo.com/account). We delete your account and its sites immediately (only the 7-day hash described above remains). Or email [hello@querymemo.com](mailto:hello@querymemo.com) and we delete it within 7 days. - **Access or correct your data:** email us. You can see everything we hold on your account page. Depending on where you live (for example the EU, the UK or California), you have rights to access, correct, delete and port your data, and to object to processing. Email us to use them; we answer within 30 days. You may also complain to your data protection authority. ## Service providers - **Cloudflare, Inc.** hosts querymemo.com and stores the account database and logs (in the United States and other countries where Cloudflare operates). - **Google LLC** provides sign-in and the Search Console API you connect. - Email to querymemo.com addresses is forwarded by Cloudflare Email Routing to our team inbox. - **Paddle** sells paid plans as our merchant of record. Paid plans open after the beta. When you buy one, Paddle collects your name, email address, billing address and payment details under [its own privacy notice](https://www.paddle.com/legal/privacy). We receive from Paddle your email address, the plan you bought, and the subscription and transaction IDs and their status. We never receive your full card number. ## Children Querymemo is not meant for anyone under 16, and we don't knowingly collect their data. ## Changes We'll post changes here with a new effective date. If we ever want to use Google user data in a new way, we'll ask for your consent first.