Memoir
Privacy
Browser-first does not mean nobody sees the request.
Memoir normally sends a queried public address from the user's browser directly to the public sources needed for that investigation. This avoids pooling routine address lookups behind a Memoir data server, but each contacted provider can still observe the address, public IP, request metadata, and timing.
Who receives an investigated address?
| Recipient | Normal behavior | Boundary |
|---|---|---|
| Cloudflare Pages | Serves Memoir's public site and workspace shell. | Like an ordinary web host, it can process the public IP, requested URL—including addresses, transaction hashes, and local draft/report identifiers in resource paths—browser and network metadata, timing, and security signals. The static review/report URL does not send its locally stored evidence to Cloudflare. |
| Public history, RPC and intelligence sources | The browser requests admitted source endpoints directly for the selected task. | Those services can observe normal network metadata and the addresses, transaction hashes, token contracts or block ranges included in their requests. Wallet lists and their local labels are not sent as one portfolio, but a provider may correlate individual reads from the same public IP. |
| Memoir server | Does not receive routine browser-direct address history. | An optional deployment can expose a history fallback; the address is sent to it only after the user explicitly chooses that fallback. |
| OpenSanctions | No per-address runtime request. A compact dated EVM subset ships with the app and is matched locally. | The browser downloads the static dataset from the Memoir origin; freshness and separate data licensing still apply. |
| User-selected AI provider | Receives the selected evidence, address, limitations, credential, and normal request metadata directly from the browser. | The provider's own retention, training, and privacy terms apply. |
A live address page automatically checks public names, account controls, issuer restrictions, token approvals, community labels, and bounded token-security and market data. Token checks wait for holdings; requests run in stages from this browser. Providers receive the public inputs needed for their checks, not your AI credentials. Opening an imported dossier or returning to a retained workspace does not trigger these checks. Nothing is sent to an AI provider until you explicitly analyze a reviewed evidence snapshot.
What stays on this device?
- Reports are stored in this site's IndexedDB, including the result, selected evidence snapshot, signals, and contemporaneous limitations.
- Analysis drafts temporarily keep explicitly selected task evidence in this tab's sessionStorage, for up to 24 hours and within a bounded storage limit. They contain no AI credentials. Their URLs do not share the evidence, though the host can observe the requested draft ID.
- Address observations keep bounded current-state checkpoints for comparison; they are not continuous tracking.
- Multi-wallet overviews store up to 12 explicitly added public addresses, local labels and current/previous dated observations in IndexedDB. Adding or reopening a list does not start public reads; Refresh does. Removing an address removes its saved observations. This list is not proof of common ownership.
- Watch rules store selected addresses/assets, amount and direction filters, continuity checkpoints, bounded alerts and recent request-budget timestamps in IndexedDB. Checks run only after starting Watch, while its page is visible and online; closing or hiding it stops scheduling checks. Browser notifications require a separate permission request, and are not a closed-browser monitoring service.
- Funds paths, balance checks and screening results stay in the current page unless the user downloads evidence or explicitly selects facts for a local AI draft/report. A copied task URL reruns public checks; it does not upload a frozen investigation or local wallet list.
- AI configuration and credentials are stored in this origin's localStorage until the user chooses Forget key or clears site data.
- Downloaded dossiers and PDFs are created for the user; Memoir does not upload them to a document service.
Local storage is not an encrypted vault: scripts running on the same origin can read these browser stores. Browser cleanup, eviction or using another device can make local lists and reports unavailable. Export evidence you need to retain, and clear credentials before using Memoir on a shared or untrusted device.
Search measurement and product analytics
Google Search Console reports how Memoir appears in Google Search without adding a visitor tracking script. Since September 29, 2026, Memoir uses Google Analytics 4 for public-page visits and selected product actions. Google can receive these events, normal network metadata, browser and device information, approximate location, and pseudonymous analytics identifiers used to distinguish visitors and sessions. This measurement is not anonymous. See how Google uses information from sites that use its services.
Analytics receives action categories, not your investigation or AI content. Google's tag runs in a separate static frame on memoir-dm4.pages.dev, which cannot read the main site's page content or local stores across the browser's origin boundary. Memoir passes only approved event names and classifications to this frame. Queried addresses, transaction hashes, ENS names, report or draft IDs, report content, AI prompts, credentials, raw errors and source results are excluded.
The selected actions cover investigation starts and results; AI intent, blockers, connection-test results, analysis starts and results; and first report views, reopening reports or requesting an export. Only broad categories such as analysis mode, outcome, failure type and time range accompany these events. Opening public-page Feedback remains a secondary event; its form content is not collected. An export request does not prove that a file was saved or shared, and closing a page without an observed result is not counted as a failure.
Google Analytics may also set analytics cookies on the separate frame's domain. These cookies are restricted to that domain, configured for secure embedded use, and remain subject to your browser's privacy controls.
Public-page URLs and titles use fixed public metadata without query strings or fragments. External referrers retain only their origin; internal referrers retain only public page paths. Workspace events use fixed metadata instead of the actual workspace URL or title. Automatic form, search, click and history measurement, Google signals and advertising personalization are disabled. Google's automatic engagement signals from the hidden frame do not represent time spent in your workspace.
Dedicated random analytics client and session identifiers are kept in this site's localStorage, separately from wallets, reports and credentials. A session expires after 30 minutes without measured activity; when storage is unavailable, identifiers remain only in memory. DNT, Global Privacy Control and Google's analytics-disable flag suppress collection. You can also block Google Analytics with browser privacy controls or Google's Analytics opt-out browser add-on. Blocking analytics does not prevent you from using Memoir. No Memoir analytics backend or database is involved.
Feedback
The Feedback panel prepares an email in the user's own email application. Memoir does not upload the form contents. Page and browser context is included only when the user checks that option. Addresses, transaction hashes, and local draft/report identifiers in the page path are redacted automatically.
Email providers and the maintainer receive the message, sender address and normal email metadata under their own policies. This is not anonymous submission; an email alias may reduce disclosure. Copying the prepared draft does not send it.
Public report requests are separate and optional. When AI is not configured, an analysis action offers a reviewed-report request as an alternative to connecting your own AI. The current public address or transaction hash and known network may be visibly prefilled for your review. You enter an investigation question, optionally share product feedback, and must separately agree to publication before preparing a request. If selected, the maintainer manually investigates and reviews the result, then publishes the public evidence and report in the sample library. This may involve sending that public evidence to the maintainer's chosen AI provider. Feedback, sender details and private circumstances are not part of the published report. Only the fields shown in the email draft are included; selected evidence, saved reports, browsing history and AI credentials are not attached. Opening the form or copying a draft does not submit it.
Requests are handled in the maintainer's mailbox, not a Memoir database. A request does not guarantee a report, response time or funds recovery. To request removal, contact feedback@racco.ai; copies already downloaded, indexed or shared elsewhere may remain. Do not submit confidential material. Core tools and your own AI analysis do not require participation.
What Memoir does not ask for
Rate limits and shared networks
Browser-direct requests reduce centralized Memoir quota pressure, but rate limits are often applied to a public IP. People on the same NAT, corporate network, VPN, or relay may still share an upstream quota. Memoir coordinates requests across its tabs and reports rate limits or source failures instead of translating them into a clear result.
Public addresses and sensitive conclusions
Blockchain records are public, but analysis can still affect privacy and reputation. Memoir does not infer sensitive personal traits, physical location, criminal intent, or a verified real-world identity from behavioral resemblance. Public labels retain their source and uncertainty.
See methodology for the attribution rules and sources for provider-specific disclosure.