Security

Your memories are encrypted on disk, and so is everything Zaaheen builds from them: the index it uses to search them and the summaries it writes when tidying up. Someone who copied the folder would see only scrambled data.

The key that unlocks your memories is created on your computer and kept in Windows' own secure store for your user account. It is never uploaded, never sent to us, and never written into the memory folder itself.

Your AI apps talk to Zaaheen through a private channel inside your computer. Zaaheen refuses connections from other computers and opens nothing to the internet, and each app has to introduce itself before Zaaheen answers.

This also means Zaaheen cannot protect your memories from harmful software already running on your computer, or from someone who can sign in to your Windows account. Keep Windows up to date and your account protected with a password or PIN.

Delete everything destroys the key first, then the memory files. Without the key, any encrypted copy of those files left on the disk or in a backup of your computer can never be unlocked again. Files you saved with Download my memories are readable copies that are not affected, so delete them yourself.

You sign in through your own web browser, so the app never sees your password. It receives a sign-in token, kept in Windows' secure store, which it uses only to check your subscription. Signing in has nothing to do with the key to your memories.

Our account service knows who you are, when your trial started, whether you have paid and the choices you made at sign-up. It never receives your memories, so there is nothing there to leak. Everything between the app, our websites and our service travels encrypted.

While Zaaheen is in beta, its Windows installer is not yet code-signed, which is why Windows says the publisher is unknown when you install it. Signing comes before the full launch.

If you think you have found a security problem in Zaaheen or our websites, email customerservice@zaaheen.com with "Security" in the subject and tell us how to reproduce it. We reply within 5 working days and keep you updated until it is fixed.

Please give us 90 days to fix it before telling anyone else, do not access or change other people's data, and do not disrupt our services. If you follow these rules, we will not take legal action against you for your research, and we will thank you publicly if you would like.