MemoryCore is built so that, in normal use, your data never leaves your machine.

• No cloud service or backend. There is nothing to sign in to and nowhere to sync.
• No network calls. The tool makes zero outbound requests during init, learn, query, and export.
• No API keys. MemoryCore requires no credentials of any kind.
• No LLM or embeddings. Analysis is deterministic, rule-based heuristics; search is lexical. No model — local or remote — is invoked.
• No telemetry. Nothing is measured, collected, or phoned home.

memory learn shells out to your local git binary to read repository signals (git status, git diff, git log, changed files). This is a local, read-only inspection:

• The diff and commit data are processed in memory on your machine to generate proposals. They are not transmitted anywhere.
• MemoryCore never modifies your source or git state — it does not stage, commit, or rewrite history.
• The only files written are inside .memory/, or an explicit --output <file> path you specify.

.memory/ is plain Markdown intended to be committed to git and reviewed in pull requests. Treat it like any other source file — do not put anything in it you would not commit to the repository:

• No secrets. API keys, tokens, passwords, connection strings, or private keys.
• No personal or customer data. PII, credentials, or anything under compliance scope.
• No verbatim sensitive code or data pasted into entry bodies.

Because memory learn proposals are built from commit messages and diffs, review proposed entries before saving — confirm a draft didn't surface a secret that was in a diff or commit body. The interactive flow shows each proposal before anything is written; --dry-run previews without saving. Under --yes, only high-confidence proposals are saved unattended, but you remain responsible for what lands in the store.

If your repository's git history already contains secrets, those are a pre-existing exposure independent of MemoryCore — rotate them and scrub history with the appropriate tooling.

If you discover a security issue, please open an issue at https://github.com/Barosinec/MemoryCore/issues, or contact the maintainer privately if the report itself is sensitive. We'll respond as promptly as we can.