---
title: "Privacy"
description: "What the site and the API store, who can see it, and how to have it deleted."
canonical: https://past.dev/privacy
last-updated: 2026-08-26
---
# Privacy

> What this site stores, what the API stores, who can see it, and how to have it deleted.

Source: https://past.dev/privacy · Last updated 2026-08-19

## Who we are

The company behind past.dev is Revo Inc. Its DBA, the name it presents everywhere, is Past Corp. Everything this page describes is controlled by that one company.

## This website

The site sets no cookies. The only thing stored in your browser is your light or dark theme choice, held in local storage so the page does not flash the wrong colours on your next visit. It never leaves your device.

Page views are counted in aggregate by Vercel Analytics, which does not use cookies and does not build a profile of you. If that ever changes, a consent banner appears before anything is recorded, and a Global Privacy Control or Do Not Track signal is treated as a refusal without asking.

The site is hosted by Vercel, which processes request logs including IP addresses to serve and protect it.

## What the API stores

The Memory API stores what you send it: the text of each data point, its timestamp, and the label and project you attach to it. From that it derives entities, facts and the relationships between them, and it keeps the source text so every answer can cite the line it came from.

It also stores an API key per project and per call usage records, which is what lets each response report its own cost.

It does not ask for, and should not be sent, information about your end users beyond what the content itself contains. The people using your software never hold an account with us.

## Who can see it

A key resolves to one project on the server. A project cannot read another project's memory, and the project is not a parameter you can pass, so nothing in a prompt can redirect a call to someone else's data.

A data point can be scoped to an audience: `/api/v1/ingest` takes an `audience` list and retrieval filters by it inside the engine. A point sent without one is visible to everything reading that project, so keep content with different authorization boundaries in separate projects or scope it explicitly. Audiences are configured with past.dev during early access.

## Training

Your content is not used to train models. It is stored to answer your questions and for nothing else.

## Deletion and retention

Deleting a source deletes what was derived from it: the facts drawn from that text and the sentences that produced them go with it.

Retention terms for the paid tiers are set in your agreement. During early access, ask and we will delete a project and everything derived from it.

## Subprocessors and where it runs

The API runs on infrastructure operated on our behalf, and answering a question involves a language model provider. The current subprocessor list, the hosting regions and a DPA are available on request rather than published here, because they change and a stale list is worse than none.

## Contact

To ask what we hold, to have it deleted, or to request the subprocessor list and a DPA, book a call: https://cal.com/team/revo/30min