Privacy Policy
Crystal is a memory service operated by ERA HQ ("we", "us"). This policy describes what we collect, why, and what control you have. The short version: your memory bank belongs to you, we process it only to run the service you asked for, and we do not sell data or run ads.
What we collect
- Account information. Your email address and sign-in identity, handled through Google Firebase Authentication. If you sign in with Google, we receive your email and basic profile from Google.
- Content you store. The knowledge you and your connected AI tools write into your memory bank: crystals, facts, and documents you ingest. This is the product, and it is yours.
- Usage and operational data. Request logs, error logs, and usage counters (for example, how many crystals your plan holds and your daily AI allowance consumption) needed to operate, secure, and bill the service.
- Billing information. Payments are processed by Stripe acting as merchant of record. We never see or store your card number. Stripe shares with us your subscription status and what we need for tax and receipts.
How your content is processed
To provide the service, your stored content is processed by the infrastructure and model providers that power Crystal: Google Cloud (hosting and databases), and large language model providers used for extraction, curation, and recall (on managed plans, requests route through our provider accounts; if you bring your own API key, requests route through yours). We send providers only what the requested operation needs, and we do not permit them to use your content to train their models under the agreements governing our accounts.
What we do not do
- We do not sell your data or share it with advertisers. There are no ads.
- We do not train models on your memory bank.
- We do not read your content except as needed to operate the service, investigate abuse, or support you at your request.
Retention and deletion
Your content stays until you delete it. You can delete individual crystals and documents in the console, and you can request full account deletion at any time by emailing us; deletion removes your bank from production systems, with residual copies in backups expiring on the backup rotation schedule. You can export your bank before deleting it.
Security
Data is encrypted in transit and at rest on Google Cloud infrastructure. Access tokens are revocable, API keys are stored hashed, and administrative access to production is limited and logged.
Your rights
You can access, export, correct, or delete your data. Depending on where you live, you may have additional statutory rights; email us and we will honor them.
Children
Crystal is not directed at children under 13, and we do not knowingly collect their data.
Changes
If this policy changes materially, we will note it here with a new date, and for significant changes we will tell account holders by email.
Contact
hello@erahq.ai