claude-mem installer uploads 30 days of prompts to cmem.ai

The claude-mem installer sends cmem.ai the full text of every prompt you typed into your AI coding tools over the past 30 days, and it does so as soon as its setup page loads, a user reported in a GitHub issue on October 29. cmem.ai has confirmed the behaviour. If you plan to run npx claude-mem install, the report’s workaround is to block cmem.ai before you start, because unticking the only checkbox on the setup screen doesn’t stop the upload.

The report covers interactive runs of installer v15.2.0 or later on a machine where the new setup hasn’t been completed. v15.5.0 was the latest release when it was written. The installer opens the setup page in your browser by itself, and the scan ignores which tools you picked earlier in the installer. Along with the prompts, cmem.ai gets session IDs, project names, folder paths and timestamps. cmem.ai is claude-mem’s paid side: in the claude-mem docs, CMEM Pro, served through cmem.ai, is the pre-selected memory provider, with a 30-day free trial.

What the setup screen says

While it works, the setup screen shows “Checking your AI usage” and “Finding your goals, work and rules”. Neither line mentions an upload. The single checkbox reads “Help make claude-mem smarter for everyone with my anonymized setup results”. It comes ticked by default and is disabled while the upload runs, and cmem.ai confirmed that clearing it has no effect on the upload.

The upload is described in the v15.2.0 changelog, but setup itself never asks. And v15.5.0 shipped on October 29, after cmem.ai had already confirmed the behaviour by email, with the setup upload unchanged. The project’s releases page has since listed v15.6.0, and its notes cover the My Work viewer state store.

Which histories it reads

The scan collects prompts from the local histories of five tools, according to the report:

• Claude Code: ~/.claude/projects/*/*.jsonl, subagent sessions included
• Codex: ~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl
• Gemini CLI: ~/.gemini/tmp/*/chats/*
• Antigravity CLI: ~/.gemini/antigravity-cli/history.jsonl
• OpenCode: ~/.local/share/opencode/opencode.db

The reporter ties each step to file and line references in claude-mem v15.5.0 at commit d7c2da3. The references run from the scan that starts on page load and the checkbox that defaults to ticked, through the 30-day window and the missing tool filter, to the upload call itself.

Where the prompts ended up

cmem.ai sent the prompts to a DeepSeek model through OpenRouter, routed to the cheapest provider. The request did not exclude providers that keep prompts or train on them. cmem.ai says it can’t tell which provider received the prompts, because it deleted the records that would show it.

The privacy policy the reporter quotes says: “Nothing leaves your device unless you explicitly turn on cloud sync.” The reporter never turned on cloud sync. The same policy says “we do not use the content of your memory to train models”. The reporter’s point is that the prompts went to an unknown provider and the request didn’t block training, so for these prompts that promise can’t be guaranteed.

At the reporter’s request, cmem.ai says it deleted its database records for that install. The deletion doesn’t cover any copies at OpenRouter or at the provider that handled the request.