Global Memory: Safer Suggestions and Clearer Privacy Controls
An AI memory feature asks for a lot of trust. It may keep personal details for months, add them to future chats, and shape answers long after the original conversation has ended.
The latest Global Memory update makes those choices more explicit. Memory remains disabled by default. When enabled, it stays in the browser unless you separately turn on sync. Suggestions now face stricter checks before they can be saved, and the editor shows where each memory came from and whether it is active.
Global Memory is separate from NanoGPT's Context Memory feature. Context Memory compresses one long conversation so it can continue beyond a model's normal context window. Global Memory carries selected facts, preferences, and instructions between different conversations.
Local by default
Turning on Global Memory does not automatically upload a profile to NanoGPT. Without sync, the memory text and structured items remain in the browser's local storage.
The settings page now labels the storage state instead of reducing it to a single sync switch:
- Local only keeps Global Memory on the current device.
- Recoverable encrypted sync encrypts the stored cloud snapshot, while allowing NanoGPT infrastructure to decrypt it for account recovery. It is encrypted storage, but it is not zero-knowledge.
- Zero-knowledge encrypted sync encrypts the snapshot in the browser with a user-held passphrase or passkey-protected key. NanoGPT cannot read or recover the stored contents.
Global Memory uses the account-wide encryption setting for synced presets and settings. Enabling Memory sync therefore also enables that account-wide sync category; conversation-history sync remains a separate setting.
The interface also reports what it has actually observed in the stored snapshot. Changing an encryption setting does not instantly rewrite an older cloud copy, so Memory can show states such as recoverable, zero-knowledge, retained, unverified, or awaiting migration. The Sync now action rewrites and verifies the snapshot under the configured mode.
The analyzer no longer gets the final say
Global Memory uses a helper model to find possible facts, preferences, standing instructions, and outdated entries. Model output is treated as a suggestion rather than trusted storage input.
Every proposal now passes deterministic checks after extraction. A proposed memory must be supported by the user's own current or recent statements. The validator rejects or pauses proposals involving:
- Passwords, API keys, authentication codes, recovery phrases, and similar secrets
- Prompt-injection language or instructions found inside pasted and quoted material
- Claims supported only by an assistant response, tool output, or another person
- Unsupported additions that do not match the user's source text
- Conflicts with existing identity, location, job, age, pronoun, or account information
The checks are intentionally conservative. They reduce obvious poisoning and accidental storage, but they cannot prove that every statement is true or understand every paraphrase perfectly.
More suggestions require review
Automatic saving remains off by default. Users can review each proposed addition or removal before it changes Global Memory.
Even when auto-add is enabled, some suggestions are held for an explicit decision. Standing instructions, identity and account details, conflicting facts, removal requests, and claims found only in recent context are marked Review required. These suggestions remain in the review queue rather than disappearing on a short timer.
The review panel shows the proposed text, category, conflicts, and whether the change adds or removes information. Suggestions can be saved or dismissed individually, and failed saves remain visible with an error instead of being treated as complete.
Safer remote analysis, with an important limit
The default remote analyzer now uses an attestation-backed Trusted Execution Environment route. Its fallback path is restricted to other eligible TEE routes. If no protected route is available, analysis fails instead of silently moving to an ordinary provider path.
This protects the model-processing step, but it is not browser-to-enclave Private Mode. NanoGPT receives the excerpts being analyzed before forwarding them to the protected environment, and attestation is checked by NanoGPT's server-side transport rather than independently by the browser.
Users on supported devices can instead select the browser-local analyzer. In that mode, the suggestion-analysis step runs on the device. A custom remote analyzer is also available, but it may not use a TEE.
Local analysis does not keep Memory out of every later request. When Global Memory is active, relevant saved items are added to future chats and sent to the selected chat model so it can use them.
A more useful Memory editor
The editor still offers a plain-text view for direct control and compatibility. It now also shows each structured memory item with:
- Its fact, preference, or instruction category
- Active or disabled status
- Whether it came from analysis, an import, or a manual edit
- Created and updated dates
- Confidence and expiration information
- A link to the source conversation when that conversation is still available on the device
Each item can be edited, disabled, re-enabled, or deleted. Disabling keeps the record but excludes it from active use. Expired items are also excluded from chats, although disabled and expired records may remain stored until they are deleted or Memory is cleared.
Local clear and remote deletion are different actions
Clearing a browser copy does not prove that a previously synced copy is gone. The editor now separates Clear local from Clear local + remote and explains the difference before acting.
The remote option sends a deletion request, then checks that a later pull reports no Memory snapshot before showing success. If deletion or verification fails, the interface reports the failure and keeps the safety state instead of claiming the data was removed.
Turning sync off also stops new uploads, but it does not by itself delete a cloud snapshot created earlier. The storage-status label calls out retained or unverified remote data so it can be handled deliberately.
Account changes are isolated more carefully
Local Memory is scoped to the account that created it. Signing out or switching accounts quarantines the previous account's local state before the new account can read, change, upload, or restore Memory.
Conversation-history imports and analyzer callbacks are also tied to the account that started them. A late result from an old account is ignored after a switch rather than appearing as a suggestion under the new account.
These controls are mostly invisible during normal use, but they matter on shared browsers and during rapid sign-in changes.
Choosing a storage and analysis setup
For one-device use, leaving sync off keeps the saved Memory local. Pairing that with the browser-local analyzer also keeps the suggestion-analysis step on the device.
For cross-device use, zero-knowledge sync gives the strongest protection for the stored snapshot, with the tradeoff that NanoGPT cannot recover a lost passphrase or unavailable key. Recoverable encryption is easier to restore, while allowing NanoGPT infrastructure to decrypt the snapshot.
Whichever option you choose, reviewing suggestions before saving gives the most control over what becomes persistent. The Memory editor can then be used to disable temporary details, remove stale facts, and verify deletion of any synced copy.
