Usage & billing

This page covers the hosted service at https://app.ergomem.com. A self-hosted deployment (see Install) has no plans or billing — every tenant there is unmetered unless an operator explicitly configures it.

Plans

Reads are always free — plans and credits only ever apply to guarded writes. "Grandfathered" covers any account that predates plan metering; it's never metered, no matter how much it writes.

Upgrading your plan

Upgrading from Free to Pro or Team happens in the app — click "Upgrade to Pro" (or Team) on the usage page or the dashboard's plan card, complete Stripe Checkout, and you're back in the app on the new plan once payment confirms. There's no separate trip to the marketing pricing page to start a paid plan anymore.

Already on Pro or Team and want to change plans, update your card, or cancel? Use the billing portal (linked from the same usage page) rather than the upgrade button, which is only for a Free workspace's first upgrade.

What's metered

A guarded write is a remember, learn, or supersede call that actually runs the contradiction guard — including a blocked 409 conflict, since the refusal is still the gate doing its job. An unauthenticated, rate-limited, or malformed request (401/429/400/413) never reaches the gate, so it's never counted.

Never metered, on any plan: recall, why, active, history, diagnose (all reads), and retract (pure removal, runs no gate).

If a write would exceed both the monthly allowance and your credit balance (see below), it's refused before anything is stored — nothing is written and that refused request doesn't itself count toward the cap.

Limits are enforced in this order: authentication, then rate limit, then the monthly write cap, then the active-claims cap.

Monthly reset

The monthly guarded-write count resets at the start of every UTC calendar month — resets_at is always the first instant of the next month (YYYY-MM-01T00:00:00Z). The project-count limit doesn't reset monthly; it's just a ceiling on how many projects exist at once, and an existing project keeps working even if you're later on a lower plan.

Rate limits

Separate from guarded-write metering above, every account also has a plain rate limit — a ceiling on requests per minute, tracked separately for reads and writes so a burst of one doesn't eat the other's budget. It applies to every plan, including Free, and to reads (which are otherwise unmetered). Some accounts also get a small burst allowance on top of the steady rate for short spikes.

Go over it and a request gets 429 Too Many Requests with a Retry-After header telling you how many seconds to wait before retrying. This is a self-hosted/API-level detail (see HTTP API → Quotas for the exact shape) — most agents using the hosted MCP endpoint will only ever notice it as an occasional retry.

Credits

Credits are a persistent balance that never expires — they survive a plan change or cancellation, and are only touched once your plan's monthly allowance for the current month is exhausted. A guarded write always drains the monthly allowance first; a credit is spent only after that, one credit per guarded write (a blocked 409 still spends one, same as a stored write).

Once both the monthly allowance and your credit balance hit zero, further guarded writes are refused with monthly_write_limit_reached until the next monthly reset or a credit top-up — there's no overdraft. Grandfathered accounts never touch credits at all.

Credit packs:

Autoload

Autoload is an opt-in, off-by-default automatic top-up: when enabled, it watches your credit balance and — once it drops below a threshold you set — charges a saved card for one credit pack and adds those credits automatically.

• Off by default; you turn it on explicitly and choose the threshold and pack.
• Requires a saved card on file.
• Credits are added only once the charge is confirmed by the payment webhook — never optimistically at charge time.
• A failed charge (declined card, etc.) adds nothing and hard-stops autoload — it is not retried on the next scheduled check, or any check after that. Fix the payment method, then re-save your autoload settings (the Save button on the usage page) to clear the failure and re-arm it.

Team invites

Team-plan orgs can invite teammates into their org from the Team page in the app. Free and Pro stay single-owner (1 seat).

• Owner-only. Whoever was first mapped into your org (from signup) is the owner; only the owner can invite or remove teammates. There's no ownership-transfer step today.
• Invite by email — no separate signup, no invite email. Enter a teammate's email and they get member access immediately. Tell them directly to open the app and sign in with that email; the app doesn't send them anything on your behalf.
• 10 seats by default, including the owner. Hitting the cap returns a "seat limit reached" error — remove a teammate to free a seat, or re-invite an existing member (that never costs a seat).
• Removal is immediate and can't be undone. The owner can remove any teammate except themselves; a removed teammate loses access right away.

Notifications

A few account-critical events send you an email — these aren't marketing email and there's no opt-out for them:

The welcome email is sent once, right after you confirm your signup email. The upgrade receipt is a lightweight "you're on plan X now" confirmation, not a tax invoice — Stripe sends its own receipt for the actual charge separately. Payment- and autoload-failure emails are sent when the underlying charge fails. Quota-approaching emails are checked whenever anyone on your org opens the usage page, and are sent at most once per threshold per billing cycle.

Deleting your account & data

Any workspace, on any plan, can self-serve delete its account and all of its data — no support ticket needed. From the Danger Zone on the Data page, the workspace owner types their account email to confirm, and can permanently:

• cancel any active subscription,
• purge every claim and all history for the org from the engine, and
• unlink the owner's own sign-in access.

This is owner-only (whoever first signed up for the workspace) and irreversible — there's no soft-delete or undo, matching Ergo's own retract vs. supersede distinction: a single wrong claim can be retracted, but an account deletion is a full purge, not a claim-level operation. If billing cancellation fails for any reason, deletion still proceeds and the failure is surfaced rather than silently swallowed — contact [email protected] if you're ever unexpectedly still billed afterward.

This is the self-serve path behind our GDPR right-to-erasure story — see the privacy policy for the full data-handling commitment.

Data retention

By default, Ergo keeps every claim (active, superseded, or retracted) indefinitely until you delete it yourself. Automatic, opt-in retention — evicting old or excess claims on a schedule — exists in the engine but still isn't wired into a self-serve toggle in the app; if you want it enabled for your workspace, contact [email protected].

When it is enabled for a tenant, eviction runs on two independent knobs, either or both of which can be set:

• ttl_days — evict active claims older than this many days, by created_at.
• max_active — cap the tenant's total active-claim count across every project; over the cap, the oldest claims (again by created_at) are evicted first until the tenant is back at the cap.

An evicted claim isn't deleted — it flips to status: "evicted", the same way a retracted claim flips to status: "retracted", so it stays visible in /history rather than vanishing.

Where to see and manage this

Your live usage (writes used this month, credit balance, current plan) and billing (buy credits, enable autoload, change plan) are on the usage page in the app; team management is on the team page.