Security

Your memories are encrypted on disk, and so is everything Zaaheen builds from them: the index it uses to search them and the summaries it writes when tidying up. Someone who copied the folder would see only scrambled data.

The key that unlocks your memories is created on your computer and kept in its own secure store for your user account: Windows Credential Manager on Windows, and your login keychain on a Mac. It is never uploaded, never sent to us, and never written into the memory folder itself.

Your AI apps talk to Zaaheen through a private channel inside your computer. Zaaheen refuses connections from other computers and opens nothing to the internet, and each app has to introduce itself before Zaaheen answers.

This also means Zaaheen cannot protect your memories from harmful software already running on your computer, or from someone who can sign in to your user account on it. Keep Windows or macOS up to date and your account protected with a password or PIN.

Delete everything destroys the key first, then the memory files. Without the key, any encrypted copy of those files left on the disk or in a backup of your computer can never be unlocked again. Files you saved with Download my memories are readable copies that are not affected, so delete them yourself.

Zaaheen's code is public at github.com/shahbaz242630/zaaheen, so anyone can read exactly how your memories are encrypted and check that nothing sends them anywhere. It is published to be read and checked, including by security researchers, not copied: its licence does not allow running or sharing your own version.

You sign in through your own web browser, so the app never sees your password. It receives a sign-in token, kept in your computer's secure store, which it uses only to check your subscription. Signing in has nothing to do with the key to your memories.

Our account service knows who you are, when your trial started, whether you have paid and the choices you made at sign-up. It never receives your memories, so there is nothing there to leak. Everything between the app, our websites and our service travels encrypted.

The Mac app is signed by us and checked by Apple, so your Mac can confirm it came from us and has not been changed. The Windows installer is not code-signed yet, which is why Windows says the publisher is unknown when you install it. Signing the Windows installer comes later.

If you think you have found a security problem in Zaaheen or our websites, email customerservice@zaaheen.com with "Security" in the subject and tell us how to reproduce it. We reply within 5 working days and keep you updated until it is fixed.

Please give us 90 days to fix it before telling anyone else, do not access or change other people's data, and do not disrupt our services. If you follow these rules, we will not take legal action against you for your research, and we will thank you publicly if you would like.