Privacy Policy & Zero-Telemetry Policy

01 Core Privacy Architecture & Sovereign Guarantee

Unlike centralized search engines and vector storage providers (e.g. OpenAI, Pinecone, Google), UltraDemon is engineered from the ground up on Cloudflare Anycast edge nodes across 330+ cities worldwide.

We operate under a strict Zero-Telemetry Policy:

• We do not sell, broker, or monetize developer or agent queries.
• We do not train foundational AI models on customer memory records, scraped documents, or conversation contexts.
• We do not track user identities across external websites or maintain behavioral advertising profiles.
• All BM25 query evaluations run ephemerally inside localized V8 isolates at the nearest edge PoP.

02 Customer Memory Data & SQLite FTS5 Storage

When you store agent facts, preferences, entities, rules, or document chunks via POST /v1/memory:

• Tenant Isolation: Every memory row is cryptographically mapped to your unique user_id and optional container_tag. No cross-tenant access is permissible under any circumstances.
• Storage Engine: Memories are persisted in SQLite D1 databases using compiled C FTS5 with BM25 ranking. Data is encrypted at rest using Cloudflare enterprise-grade encryption.
• Right to Erasure & Portability: Developers retain unconditional rights to delete single memories (DELETE /v1/memory/:id) or wipe entire containers (DELETE /v1/memory?container_tag=:tag). Deletions propagate immediately.

03 Account Registration & Mandatory Email Verification

To maintain network integrity, prevent automated spam, and protect our edge crawler infrastructure, email verification via confirmation link is mandatory for all new developer accounts.

• Upon registration, an activation link is delivered to the provided email address via Supabase Auth.
• Developer consoles, production API key generation, and workspace sessions remain inactive until the verification link is confirmed.
• Passwords are securely hashed using Web Crypto SHA-256 with unique per-user salts. We never store plaintext passwords.

04 API Key Security & Scope Isolation

UltraDemon utilizes cryptographically scoped API keys:

• UltraMemory Keys (um_*): Restricted strictly to agent memory ingestion and recall. Denied access on all search and crawl endpoints.
• UltraSearch Keys (us_*): Restricted strictly to web search queries. Denied access on memory storage and recall.
• Plaintext Keys: Displayed once upon creation and stored exclusively as SHA-256 hashes in Cloudflare D1 and KV.

05 Zero Tracking & Cookies

UltraDemon uses no third-party tracking cookies, behavioral analytics SDKs, or external advertising scripts. Client sessions are managed via standard Authorization: Bearer <token> headers and local browser storage.

06 Contact & Data Protection Officer

For privacy inquiries, audit requests, or data deletion confirmations, reach our team via our public repository: github.com/im-ansh/UltraDemon.