How Meriq stores data

What Meriq does not store

• Your prompts and AI responses are not retained on our servers unless you enable the optional encrypted vault
• Conversation content is never used for model training
• We never sell your data or share it for advertising or model training
• Search queries from deep research are not stored after the job completes, unless you enable the encrypted vault
• File contents uploaded for analysis are not retained after processing, unless you enable the encrypted vault

What Meriq does store

The following data is stored to operate your account:

• Account information: email address, hashed password (or OAuth identifiers), display name, plan type
• Usage counters: chat usage within rolling cost windows, research job counts, image generation counts (for quota enforcement)
• Preferences: selected model, custom instructions, theme, privacy settings
• Billing records: subscription status, payment method type (card details are held by Stripe, not by Meriq)
• Security events: login timestamps and security-related events (retained for 30 days, then automatically deleted)

Optional cloud vault

If you enable the cloud vault, Meriq stores your conversations in encrypted form so they persist across sessions and devices. This is entirely optional.

How encryption works

• All vault data is encrypted with AES-256-GCM before it leaves the application layer
• The encryption key is derived from your vault password and cached separately from the encrypted conversation records while needed for authorized use
• If you sign in with a social provider, you set a separate vault password the first time you enable the vault — your social login alone can never unlock your data
• The service caches the working key while unlocked or needed for an authorized task, and processes decrypted content to provide features. This is encryption at rest, not end-to-end encryption against Meriq

What vault encryption covers

• All conversation message content
• Research job queries, plans, and reports
• Generated artifact content
• Extracted text from uploaded files
• User memory entries

Retention and deletion

• Non-vault conversations exist only in your browser session and are gone when you close the tab
• Vault conversations are kept for the retention window you choose (60 days by default), then automatically deleted — sooner if you delete them or disable the vault
• Disabling the vault deletes all encrypted data from cloud storage
• Deleting your account removes all stored data, including vault contents, preferences, and billing records
• Security logs are automatically purged after 30 days

Account boundaries

• Each user's data is isolated. There is no shared conversation state between accounts
• Account access controls limit ordinary access to conversations. They do not cryptographically prevent the service operator from accessing content while the working key is available
• API keys are scoped per user and cannot access another user's data

Summary

For the formal legal version of these practices, see our Privacy Policy. For questions about capabilities and access, see the FAQ.