Plain summary
Cairn is a memory layer for your work history. We store what you put in, derive structured events from it, and answer only from those records. This page describes what the product actually does today — not a wishlist.
What we store
- Account data: your name, email, password hash (not the plaintext password), plan preference, and when you accepted these terms and this policy (timestamp plus document versions).
- Messages: content you submit (chat remember, imports, email ingest, and similar paths). Message rows are immutable — corrections do not erase the prior text; the history of what was said is preserved.
- Events: structured records derived from messages (title, type, status, event time, recorded time, confidence, links, and related metadata). One message may produce many events, or none.
- Your model API key, if you provide one: on the Free plan you may paste your own Anthropic API key so that model features work. We store it encrypted, never in plaintext, and alongside it a short fingerprint (so you can tell which key it is), its status, and when it was last used. We never store the key in a log, a request URL, or an error message. You can revoke it in one click, which takes effect immediately, and it is destroyed with your account.
- Operational data: things needed to run the product — for example verification tokens, email-ingest allowlists and drop tallies, login failure counters for rate limiting, and optional feedback you send.
What we do not collect at signup
We do not ask for age, sex, or other demographic fields. We collect only what has a current use for operating your account and timeline.
Who processes data, and when
- LLM providers (via Cairn’s single LLM client): text you record is sent when the product extracts events or generates a grounded answer. For an uploaded document this means the document’s full extracted text, not just the line you see in your timeline. An upload appears in your archive as a short placeholder — for example [Uploaded document: report.pdf] — and it would be misleading to let that stand for what was sent: the prose read out of the file is what the extractor works from, and that is what goes to the provider. Retrieval is filtered first; the model is instructed not to invent history when records are empty. Provider choice and keys are configured by the operators running your deployment.
- Resend: outbound transactional email only (account verification, ingest sender-confirmation). Content is the email body we send you — not your full timeline dump.
- Fly.io + Postgres: hosting and the primary database for production. Your data at rest lives in that database under our application controls.
Isolation
Per-user isolation is enforced in the database with row-level security (RLS). Application queries run in a tenant context tied to your authenticated session or bearer token. Other users’ rows are not readable through normal product paths.
Model training
We do not use your timeline content to train foundation models. We do not sell your data for advertising. If that ever changed, it would require an explicit opt-in — not a buried toggle.
How long we keep it
Indefinitely, until you delete it. There is no retention period, no automatic expiry, and no background job that ages records out. That is a deliberate position rather than an omission: a memory layer whose contents quietly vanished after a year would not be one, and a record you can no longer produce is the failure this product exists to prevent.
The consequence is worth stating plainly, because it cuts both ways. Nothing you record leaves on its own, so an archive keeps growing and old material stays retrievable — including material you may later wish you had removed. Removal is yours to trigger, at two granularities described below, and both are immediate rather than scheduled. If your organisation requires a fixed retention schedule, Cairn does not enforce one today; you would be applying it yourself.
Export and deletion — what works today
Working now:
- Per-message forget (preview + delete) removes a message, its derived events, and any resolve suggestions or stored answers derived from them — an answer row that cited the forgotten events survives with its timestamp and integrity hash, but its question and answer text are redacted. Two bounded residues, stated plainly rather than hidden: an answer that cited nothing (a “no record” reply) currently keeps its question text, and internal telemetry that scores answer quality also keeps question text — both are known work, and both are destroyed entirely by full account deletion below. Per-account tombstoning keeps the same content from being casually re-ingested for you (another account is not affected). The preview tells you the counts before you confirm.
- Self-serve timeline export from Settings → “Export all data”, which downloads a portable TIF (JSON) file scoped to your account (
GET /export). - Self-serve account deletion from Settings → “Delete account” (password re-authentication required). Access is revoked immediately; you have a 7-day grace period to cancel via the link in the receipt email. After grace, destruction is operator-confirmed with a hard automatic backstop at 21 days from the request — your data is guaranteed gone within that ceiling.
What the export covers: your messages (the raw text you recorded), the events derived from them, and their projects, links, and corrections — with original and recorded timestamps preserved — plus your Ask answer history: the answers you were given, each carrying the citations it was based on. It does not include your email-ingest settings (forwarding address and allowed senders), or pending resolve suggestions — a suggestion is a proposal you have not accepted, and once you do accept one its effect becomes a link or correction, which does export. It also excludes operational records that are not your content: verification and deletion audit entries, the queue, telemetry, and search indexes.
Documents you upload: the file itself is not stored. What is stored is the text read out of it, the file name, and the events derived from them — and that text is not incidental: it is what later answers quote and cite back to you, and you will see it on a citation’s receipt alongside the file name it came from. All of it exports with your events. A page with no text layer is read by optical character recognition running on our own servers (open-source Tesseract); no third party sees the file for that.
Email attachments are different: mail sent to your ingest address is read for its body text only. Attachments are dropped at ingest and nothing is kept from them, so there is nothing of theirs to export. (A forwarded ZIP of messages is the one exception, and its messages are stored as messages.)
You can check the export is complete: every export carries a manifest inside document.manifest — a count of each collection and a SHA-256 digest of the contents — so you, or anyone you hand the file to, can confirm nothing was lost or altered in transit using the file alone, without asking us. To be exact about what that proves: it detects truncation, missing records, and changed content. It is not a signature — it does not prove the file came from us — and it attests the collections listed above, not the parts of your account the export does not yet cover.
What deletion retains: a contentless audit entry that a deletion occurred, when, which account id, and whether destruction was operator-confirmed or backstop-triggered — never what was deleted. Integrity-chain rows (event_hashes) keep their hash and chain position with content payloads redacted; for those redacted entries, payload-against-hash verification is no longer possible, but chain linkage still verifies.
Questions: support@cairn-ai.com.
Your verified account email receives security mail (verify your account; confirm that a sender may add events to your timeline). Inbound email you forward to your Cairn ingest address is processed only from senders you have confirmed.
Contact
Privacy questions: support@cairn-ai.com.