Incognito Mode

Incognito mode creates ephemeral chat sessions that leave no trace on your device. When active, Memo operates as a stateless chat interface — no writes, no storage, no memory.

How It Works

When incognito mode is toggled on, the backend enforces three rules for the session:

Rule	Mechanism
No message persistence	Messages are held in-memory only. The session store write path is bypassed entirely.
No memory storage	Embedding generation is skipped. No vectors are written to the SQLite vec0 table.
No disk writes	All WriteFile calls are routed to /dev/null equivalent. Logs are ephemeral.

func (a *App) HandleChat(ctx context.Context, msg ChatMessage) error {
    if a.incognitoMode {
        // Stream response, hold in memory, never persist
        return a.streamOnly(ctx, msg)
    }
    // Normal path: stream + embed + persist
    return a.streamAndStore(ctx, msg)
}

Activation

Toggle incognito mode from three entry points:

1. Slash command: Type /incognito in the chat input
2. UI toggle: Click the incognito icon in the chat header
3. Settings: Enable "Incognito by default" in Privacy settings

When active, the chat header displays a visual indicator and the input area changes styling to signal the ephemeral state.

Use Cases

Scenario	Why Incognito
Sensitive discussions	Medical, legal, or financial topics you don't want persisted
Testing prompts	Experiment with system prompts without cluttering memory
Guest use	Let someone use your Memo without accessing your history
One-off queries	Quick question that doesn't need to be remembered
Model comparison	Compare model outputs on the same prompt without cross-contamination
API key testing	Test a new external provider without logging the conversation

What Happens When You Toggle Off

When incognito mode is deactivated:

• The ephemeral conversation is discarded — it cannot be recovered
• Memory and persistence resume for new messages
• Previously stored messages and vectors are unaffected

Limitations

• Model responses only: Incognito applies to chat. Downloaded models, configuration changes, and system diagnostics are always persisted (they are not session data).
• No cloud sync: Cloud backup does not include incognito sessions.
• Agent mode: Agent tool calls may produce side effects (file writes, web requests). The tool execution is not retroactively hidden — only the chat metadata is ephemeral.

Privacy Guarantees

Guarantee	Level
No message log on disk	Enforced at write-path level
No vector embeddings created	Skipped in ingestion pipeline
No session metadata stored	Not written to sessions JSON
No memory in swap	OS-managed; consider enabling encrypted swap
Memory dump (crash)	Message content may appear in core dumps

Incognito mode prevents intentional persistence but cannot prevent data from appearing in OS swap, core dumps, or RAM snapshots. For highest security, pair incognito mode with full-disk encryption and encrypted swap.

Comparison with Deletion

Aspect	Incognito Mode	Delete Conversation
Data written to disk	Never	Written, then deleted
Vector embeddings	Never created	Created, then removed
Recoverable	No	Possibly (until overwritten)
Performance	No write overhead	Write + delete overhead
Granularity	Per-session	Per-conversation or bulk