Building a persistent memory for AI means stepping into sensitive territory. The notes you trust to the system aren't just any data: they are work thoughts, decisions, fragments of professional life. That's why we defined five principles that guide every technical and product choice in Timo. These aren't marketing promises. They are the constraints we've set on the way we build the service. They explain what you can expect from us and what we've decided not to do, even when it would be more convenient.
1. Your data stays yours
The content of your space belongs to you. We don't use it to train models, we don't analyze it for commercial purposes, we don't share it with third parties.
We distinguish two levels of data and handle them differently. The first level is account data: name, email, payment information. On these we apply the standard rules of a subscription service, in line with GDPR and European regulations. The second level is the content of your space: notes, saved conversations, decisions, memories you trust to the memory. On these the rules are stricter. No centralized analysis, no use for training, no operational access except for documented technical reasons, always traced in your action history.
Full export is always available, right away, without waiting and without requests to support. You'll find the "Export space" button in your account settings. The file you download is a folder structure in standard markdown, readable by Obsidian, by any text editor, by you five years from now when maybe you won't even remember the name Timo.
Deletion is granular. You can delete a single note, an entire folder, the whole space. When you delete, we really delete: the data disappears from the database, it doesn't stay in long-lived caches, it doesn't end up in eternal backups. We only keep what the law requires us to keep, for the strictly necessary time.
Ownership of your data isn't a concession we grant you. It's the starting point.
2. Infrastructural privacy
Privacy isn't something you declare in a policy page. You make it through the way the system is built.
Timo is a dedicated instance for each user. It means every user has their own isolated instance, their own database, their own space. There is no big shared database where your notes live alongside those of thousands of other people. There is no application layer where an error in query filtering could surface other users' data, because there's no shared pool to filter from.
This choice has a cost. Running thousands of separate instances costs more than a single shared system. It costs more to our team, it costs more on the infrastructure. But it shifts privacy from the plane of promises to the plane of structural properties.
Concrete example: if your account's Timo instance were to have a problem, the problem concerns your instance and that's it. There's no security incident that exposes every user's data at once, because architecturally it isn't possible. Not because we commit to avoiding it, but because the separation is physical.
The same applies to credentials. Your AI model key lives in the configuration of your instance, not in a centralized secrets warehouse that an attacker could target to obtain thousands of keys at once.
Here too the distinction between levels comes back. For account data we apply standard good practices: encryption at rest, encryption in transit, restricted and traced access. For the content of your space we add per-instance isolation as the first line of defense, even before application controls.
Privacy that works is privacy that doesn't depend only on our good will.
3. Full transparency
Prices are public and you'll find them on the site. The terms of service are readable without a law degree. The processes that concern your account are visible to you.
Every user has access to their own action history. It's a chronological list of what happened on your account: when the trial period started, when you ran an export of the space, when you added or revoked a key, from which addresses access was made, when you changed configuration. You consult it from the user area with one click, you download it in a readable format, you keep it as proof of the behavior of the service over time.
No silent telemetry. We don't collect hidden behavioral data about your use of the product for internal analytics. The minimum technical metrics we need to keep the service running (response times, errors, load) are aggregated and not tied to individual users. What we collect is listed in the privacy notice without filters.
No surprise clauses. The terms of service have no items buried at the bottom that take rights away from you. If we change something significant, we notify you in advance, in a readable way, with time to read and decide. If the change is substantial and to your disadvantage, you have the right to leave and take your data with you before anything changes.
Prices also follow this logic. What you pay us is written plainly. What you pay your AI provider is written in their pricing, and we help you estimate it before you start. There are no hidden costs that emerge at renewal, there are no usage limits that aren't communicated and trigger extra charges.
Transparent means you can check. And we give you the tools to do it.
4. Cost control — you bring the key
You choose the AI model, and you pay for it, directly to the provider.
Timo is a memory service, not a token reseller. When you set up your space, you enter the key of the provider you prefer: Anthropic for Claude, OpenAI for its models, any other provider compatible with the MCP protocol. Requests to the model leave from your AI using your key, and token usage ends up on your provider's invoice. We don't get in the middle.
This has three concrete consequences we consider important. The first: the cost of AI is controlled by you, not by us. If you want an economical model for daily work and a more powerful model for specific cases, you decide by changing configuration. If you have a professional plan with a discount from your provider, that discount applies to the usage you do with Timo as well.
The second: we have no incentive to make you burn more tokens. Our subscription is a flat fee, it doesn't scale with AI usage, so we don't build artificially long prompts or redundant calls to inflate the bill. We work to reduce the number of calls, not to increase it.
The third, more subtle: changing models doesn't mean changing services. If tomorrow you decide that your favorite model no longer convinces you and you want to switch to a competitor, you replace the key in configuration and Timo keeps working with your new choice. The memory is separate from the model that uses it.
The Timo subscription price covers what we do: dedicated hosting of your instance, storage of the space, maintenance, development, support. It doesn't cover AI usage, because that usage doesn't pass through us. It's a choice of clarity, not a commercial trick.
You choose the model. You control the budget.
5. Durable memory
A memory worth building has to last over time. Even beyond Timo, if it ever comes to that.
That's why your data is and stays in standard markdown. Not in a proprietary format that only our tools read. Not in an opaque database from which extracting it requires help from our support. Markdown, in folders readable by anyone, with structured metadata where it's needed. The format you would use if you wrote your notes by hand in any text editor.
The consequence is simple: full export of the space takes seconds, not procedures. When you download the export package, you get a folder you can open immediately in Obsidian, in VS Code, in any markdown editor on the market, and work on it as if Timo had never been in the middle. Internal links keep working, folder structures are preserved, attachments are in the same relative positions.
The point of this choice is respect for the long term. A personal memory you tend over time is an investment. It would be wrong of us to build it in a format that ties you to us for technical reasons, not because the service satisfies you. If Timo serves you, you'll stay because the service works. If one day it no longer serves you, or if one day we close down, your memory stays intact, readable, usable.
That's why the Obsidian integration is direct, through the Timo Sync plugin: the Timo space is an Obsidian space. Same thing, no conversions, no migrations, no formatting losses. What you see in the app is what you would see by opening the same folder in the editor you already use.
Build a memory that outlasts the service that hosts it. It's the least we owe to those who entrust it to us.
These five points aren't a slogan. They're the way we make product and infrastructure decisions, every day. When we choose, we choose within these constraints. They are what you can demand from us.