Applies to: anyone who runs npx claude-mem install interactively (installer v15.2.0 or later, latest is v15.5.0 at the time of writing) on a machine where the new setup hasn't been completed.
What happens
- The claude-mem installer opens the setup page in your browser automatically.
- The first setup screen reads your local chat histories (see What it reads) and collects the prompts you typed in the last 30 days, regardless of which tools you selected in the installer.
- That first screen then uploads the full text of those prompts to cmem.ai, with session IDs, project names, folder paths and timestamps.
- The upload starts as soon as the setup page loads, and setup offers no way to stop it.
- The setup screen says "Checking your AI usage" and "Finding your goals, work and rules". It does not say that prompts are uploaded.
- The only checkbox on the screen reads "Help make claude-mem smarter for everyone with my anonymized setup results". It is ticked by default and disabled during the upload, and cmem.ai confirmed that unticking it does not stop the upload.
- The upload is described in the v15.2.0 changelog, but setup itself never asks.
- v15.5.0 (Oct 29) was released after cmem.ai had confirmed this behaviour by email, with the setup upload unchanged.
What it reads
| Tool | File |
|---|---|
| Claude Code | ~/.claude/projects/*/*.jsonl (including subagents) |
| Codex | ~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl |
| Gemini CLI | ~/.gemini/tmp/*/chats/* |
| Antigravity CLI | ~/.gemini/antigravity-cli/history.jsonl |
| OpenCode | ~/.local/share/opencode/opencode.db |
Where the prompts went (confirmed by cmem.ai)
- cmem.ai sent the prompts to
deepseek/deepseek-v4-flash-0731through OpenRouter's global endpoint, routed to the cheapest provider first. - The request set neither zero data retention nor
data_collection: "deny", so providers that may keep or train on prompts were not excluded. cmem.ai is still verifying its account-level OpenRouter settings. - cmem.ai says it does not know which provider received the prompts: its records never stored the provider. It is checking OpenRouter's activity log.
- cmem.ai says it deleted its database records for my install on request. That deletion does not cover copies at OpenRouter or the provider.
What the privacy policy says
- "Nothing leaves your device unless you explicitly turn on cloud sync." I never turned on cloud sync, and the prompts were uploaded anyway.
- "we do not use the content of your memory to train models." The prompts went to an unknown provider without training being blocked in the request, so this promise is not guaranteed for the uploaded prompts.
Source (claude-mem v15.5.0, commit d7c2da3)
- When the setup runs:
src/npx-cli/install/browser-setup.ts:21-29 - Installer asks which tools you use, before setup opens:
src/npx-cli/commands/install.ts:2850 - Installer opens the setup page:
src/npx-cli/install/browser-setup.ts:105-107 - Scan starts on page load:
src/ui/my-work/src/setup/setup-data.ts:218-222 - Checkbox, disabled during upload:
src/ui/my-work/src/setup/screens/scan-screen.tsx:56 - Tools scanned:
src/services/prompt-import/readers.ts; no tool filter:src/services/worker-service.ts:595-599 - 30-day window:
src/services/prompt-import/index.ts:27 - Upload:
src/services/work-view/hosted-intent.ts:161-171 - Checkbox ticked by default:
src/services/prompt-import/setup-scan.ts:107
To avoid it: block cmem.ai before running the claude-mem installer.
Related: #4605 (privacy policy vs. default telemetry)