Your memories stay under your control.
Who we are
Gnosys and gnosys.ai are operated by:
JAMAEDGE Group LLC (doing business as Proticom)
16835 Algonquin St, Suite 205
Huntington Beach, CA 92649, United States
Privacy contact: privacy@gnosys.ai
EU/UK Representative (Art. 27 GDPR / UK GDPR): not currently appointed. Contact us at privacy@gnosys.ai; we will appoint a representative if and when applicable law requires one.
The one-paragraph version
Gnosys is local-first, open-source software. In the normal OSS setup, your memories live in a SQLite database on your own computer (~/.gnosys/gnosys.db); gnosys.ai does not host that database, a memory API, or an MCP endpoint. Content leaves your machine only when you choose a feature or provider that requires a network request. This website runs no advertising or behavioral analytics; the optional Agent Profile claim flow uses one short-lived security cookie, and its hosting, third-party assets, and limited OAuth service process the operational data described below. If you use the Ask Gnosys chat on this site, the text you type is sent to OpenAI to generate the answer. We do not store your chat messages.
1. The gnosys.ai website
| What | Details |
|---|---|
| Website use | No end-user account, advertising, or behavioral analytics. The site serves documentation, agent-discovery files, a read-only project-metadata API, and a limited Agent Profile OAuth service. It does not host Gnosys memories or an MCP server. |
| Cookies and local preferences | We use no advertising, analytics, or cross-site tracking cookies. Theme and page-view preferences may be stored in your browser's localStorage. The chat conversation is kept only in the open page and is cleared when you reload or leave it. After a successful optional Agent Profile claim, we set one Secure, HttpOnly, SameSite=Lax consent cookie for 30 minutes so that browser can complete PKCE authorization (see the Cookie Policy). |
| Hosting and request logs | Cloudflare serves the site and Worker endpoints. Cloudflare processes standard request data such as IP address, request URL, user agent, timestamps, and security signals in its infrastructure and logs. We may use limited operational logs to secure and troubleshoot the service; we do not use them for advertising. |
| Third-party assets | Pages request fonts from Google Fonts. Google receives standard connection data, including your IP address and user agent, under their own privacy terms. No advertising pixels or social-media embeds are used. |
| Ask Gnosys chat | The optional chat on this site answers questions about Gnosys. When you send a message, your text and the earlier messages of the same conversation (up to the last 10 messages, each up to 2,000 characters) are sent through our Cloudflare Worker to OpenAI, together with excerpts from the public Gnosys documentation, so that an OpenAI model can generate the answer. Do not type personal or confidential information. We do not log, store, or reuse the content of your messages or the answers. To prevent abuse, Cloudflare counts requests per IP address for one minute to enforce a rate limit. OpenAI processes the text under its API terms: per OpenAI's API data policy, API data is not used to train OpenAI models by default, and OpenAI may keep abuse-monitoring logs for up to 30 days unless the law requires longer. Answers are generated by AI and may be wrong; check them against the documentation. |
| Agent Profile OAuth service | When this optional service is used, we process the agent-supplied display name and redirect URIs, an anonymous registration identifier and status, issue/expiry timestamps, requested scope, and claim/revocation/security state. Claim tokens, user codes, authorization codes, and network-derived rate-limit identifiers are stored only as keyed hashes where persistence is required. Unclaimed registrations expire after 24 hours; claimed registrations after at most 30 days; shorter-lived credential and security records are removed after their operational window. The service never accepts or stores Gnosys memory content. |
Legal basis (where GDPR-type laws apply): our legitimate interests in delivering and securing the website and preventing abuse (Art. 6(1)(f)); when you request an Agent Profile registration or send a message in the Ask Gnosys chat, processing is also necessary to provide that requested function (Art. 6(1)(b), where applicable). We do not sell this data or use it for targeted advertising.
2. The Gnosys open-source software (what happens on your machine)
When you run Gnosys, you are the data controller of everything you store in it. We are not a controller or processor for that data — it never reaches us.
Data the software stores locally, under your control:
| Category | Where | Retention |
|---|---|---|
| Memories you write (free text — may include any personal data you choose to record) | ~/.gnosys/gnosys.db on your device | Until you archive or supersede them, remove individual records with your own database tools, or remove the database. Gnosys does not currently advertise a general-purpose memory-delete command. |
| Tags, project names, file paths | Local database | Same |
| Attachments (images/small files ≤10 MB) | Local database | Same |
| Search embeddings | Stored locally or in static output. Local embeddings are computed on-device; OpenAI or Voyage embedding modes send the applicable source or query text to that provider. | Same |
| Audit log of tool operations | Local database | Same |
| Hostname / machine ID (for your own multi-machine sync) | Local database + local config | Same |
Network connections the software may make, depending on the features and configuration you choose:
- Optional providers and endpoints you configure. Cloud options include Anthropic, OpenAI, Groq, xAI, Mistral, OpenRouter, Voyage embeddings, and custom OpenAI-compatible endpoints. Applicable prompts, retrieved context, documents, images, audio, or queries are sent under your own account and the provider's terms, only for the features you invoke. Ollama, LM Studio, local Whisper, and local embeddings provide local alternatives for supported workflows, but not every AI-specific feature has a provider-free equivalent.
- Local model downloads. A local embedding or transcription mode may download model weights from a package or model CDN such as Hugging Face. User content is not uploaded as part of the model download; the downloaded model then runs locally.
- Package installation/updates via the npm registry (standard npm behavior).
- Web Knowledge Base requests. Gnosys crawls the sites you direct it to. OpenAI or Voyage build/runtime embedding modes also send applicable document or query text to the selected provider; callers of
gnosys/webcontrol runtime query embedding and fallback behavior.
There is no telemetry, analytics, crash reporting, or any other "phone home" in the software.
Web Knowledge Base: if you use gnosys web to index a website, the software crawls the site you point it at and writes static files into your project. You are responsible for the content of sites you crawl and for configuring any remote embedding provider used during builds or runtime queries.
3. Sub-processors and international transfers
gnosys.ai does not process the memories in your local OSS database. The following parties may process website operational data, asset requests, or content you deliberately route to a provider:
| Party | Role | Personal data | Safeguard |
|---|---|---|---|
| Cloudflare, Inc. (US/global network) | Website/Worker and D1 hosting, security, limited Agent Profile state | Request metadata and IP addresses; agent-supplied display name and redirect URIs; limited registration/security state; hashed claim, authorization-code, and rate-limit identifiers | Cloudflare's contractual, privacy, and security controls |
| OpenAI, L.L.C. (US) | Generates answers for the Ask Gnosys chat | The chat text you send and excerpts of public documentation; standard request data from our Worker (not your IP address) | OpenAI's API terms and data-usage policy (no training on API data by default; abuse-monitoring logs up to 30 days) |
| Google LLC (US/global network) | Google Fonts delivery | Standard asset-request data such as IP address and user agent | Google's privacy and security controls |
| GitHub, Inc. (US) | Code, issue, and release distribution when you follow repository links | Data GitHub receives from your visit or account | Your interaction with GitHub under its terms |
| Hugging Face and other model/package CDNs | Optional local model-weight downloads | Standard request data such as IP address | The provider's terms; no Gnosys memory content is needed for the download |
| AI and embedding providers you configure | Only for tasks you deliberately route to them | Prompts, context, documents, media, or queries required for the selected task | Your agreement with the provider |
A separately contracted Gnosys Enterprise hosted offering exists for organizations; it is governed by its own agreement and data-processing addendum (with SCCs Module 2 and transfer assessments where applicable), not by this policy. Status: DPA/SCC/TIA documentation in progress; completed before enterprise onboarding of EU/UK customers.
4. Geographic note (EU/UK)
Our hosted enterprise offering is not currently offered to customers in the EU or UK. The OSS code is available worldwide. Website requests and optional Agent Profile registrations may be processed by Cloudflare and the asset providers described above, including on global infrastructure. If you use the Ask Gnosys chat, your messages are transferred to OpenAI in the United States; provider-backed OSS features are governed by the provider you choose.
5. Your rights
For website visitors in jurisdictions with data-subject rights (including GDPR, UK GDPR, and CCPA/CPRA), contact privacy@gnosys.ai to request access, correction, deletion, restriction, portability, or objection where applicable. Agent Profile credentials can also be revoked through the documented revocation flow. We do not sell personal information or share it for cross-context behavioral advertising. For data inside your local Gnosys install, you control the database directly; we cannot access or act on that local data.
6. AI transparency (EU AI Act)
Gnosys is a memory/retrieval developer tool, not an AI model. Core structured-memory workflows and lexical search can run without an AI provider. Features such as answer synthesis, vision ingestion, and some enrichment workflows require a compatible model; local provider options are available only where documented. No Annex III high-risk use is intended or supported. The Ask Gnosys chat on this website is an AI assistant: its answers are generated by an OpenAI language model from our public documentation, and the chat window says so.
7. Children
Gnosys is a developer tool and this site is not directed at children. We do not knowingly solicit children's personal information; contact us if you believe a child has submitted Agent Profile or other website data.
8. Changes
We will post changes here with a new version number and effective date. Material changes will be highlighted in the repository changelog.