Billing.

Every saved memory (one ingested turn) is the billable unit. Recall is free, always, for everyone, on every plan: ask a thousand questions a day and the bill does not move. All payments are processed by Paddle, our Merchant of Record, and the exact terms are in the Terms of Service and Refund Policy.

Personal accounts subscribe to a plan with a monthly allowance of saved memories. The Free plan's allowance is a hard cap: when you reach it, saving pauses until the next monthly cycle. Nothing is lost when that happens; everything already saved stays permanent and recall keeps working without limits.

Paid plans include a larger allowance and can go past it with usage-based overage, billed per additional memory at the rate on the pricing page. Overage is a toggle in your billing settings: leave it off and your plan behaves like a hard cap, turn it on and saving never pauses.

Developer accounts top up a credit balance with any amount. Each saved memory deducts the per-memory rate from the balance; a batch of 50 turns deducts 50 memories' worth. Every charge and top-up appears in your ledger on the Credits screen, and credits stay available as long as your account is active.

Creating tenants, listing them, and recalling memories never consume credits. Only saving does.

If a save arrives and your credit balance cannot cover it, the API answers with 402 payment_required:

{
  "success": false,
  "http_status": 402,
  "code": "payment_required",
  "message": "insufficient credits"
}

Handle it like any other stable error code: pause your ingest path, alert whoever tops up the account, and retry after adding credits. Everything already stored is untouched, and recall keeps answering throughout.

Every API key can carry its own spending limit, set or cleared in the dashboard on the key's detail view. A key that reaches its limit starts receiving 402 on saves, while every other key, and the rest of your application, keeps running against the shared balance.

A practical setup: give each service or agent its own ingest key with a limit sized to its expected usage, and keep the unlimited admin key off production paths entirely.

In both cases the failure is on the save only. Nothing is deleted, nothing expires, and recall answers normally the entire time.