Privacy Policy
Effective October 28, 2026. Operated by [Company legal name], [Registered address].
The short version
- Your workspace content is yours. We use it only to run Mehemoth for you.
- We don't sell personal data, and we don't use your content to train AI models.
- Outside services only see your data when they're needed for a feature you use (listed below).
- You can export everything and delete your account at any time from Settings.
What we collect
- Account details: your name, email address and a hashed password. We never store your password in readable form.
- Workspace content: projects, tasks, notes, documents, memory, files, stats, routines and the items your agents send in. This is the content you or your connected tools put into Mehemoth.
- Email headers, if you connect Gmail: the sender, subject and date of unread mail, read-only, to list in your daily brief. Mehemoth can't read message bodies or attachments, and it never sends or changes email.
- Connection details: API keys (we store only a one-way hash), webhook secrets and Google Calendar and Gmail access tokens (encrypted), and which connected apps have used your workspace.
- Security records: sign-in sessions, rate-limit counters and an audit log of sensitive actions such as creating keys, with the IP address where available.
- Product usage: which features and dashboard widgets are used (for example “review mode opened” or “stats widget added”). These events never contain your content, and they are tied to a scrambled ID rather than your name or email. You can turn this off in Settings.
- Error reports: if something breaks, technical details of the error. Before a report leaves our servers we remove email addresses, IP addresses, cookies, authorization headers, request bodies and query strings.
How we use it
- To provide Mehemoth: store, search and show your content, run your routines, and deliver what your agents send.
- To keep it secure: authenticate you, limit abuse, and investigate problems.
- To improve it: understand which features are used and fix errors.
- To contact you about your account or important changes. We don't send marketing email without your consent.
Where the law requires a legal basis, we rely on providing the service you asked for (contract), our legitimate interest in keeping it secure and working, and your consent for optional features you switch on.
AI features
Your content is only sent to an AI provider when you use an AI feature, such as asking the command center for an answer or drafting a project brief. Agents you connect (like Claude Code or ChatGPT) are your own tools. What they do with the data you let them read is covered by their providers' terms. You control access with scoped keys and the consent screen, and you can revoke it in Applications.
Service providers
| Provider | What for | When |
|---|---|---|
| Neon | Database hosting (all workspace data) | Always |
| Vercel | Application hosting and scheduled jobs | Always |
| Cloudflare R2 | File storage | When you upload files |
| Anthropic | AI answers and drafted project briefs | Only when you ask for an AI feature |
| Voyage AI | Search embeddings (text turned into vectors) | Only if semantic search is enabled |
| Reading your calendar, and Gmail message headers (sender, subject, date), read-only | Only if you connect Google Calendar or Gmail | |
| Sentry | Error reports, with personal data removed | If error monitoring is enabled |
These providers process data on our behalf under their data processing terms. Some are based in the United States, so your data may be processed outside your country, with the safeguards those terms provide.
Cookies
We use only cookies needed for Mehemoth to work: your sign-in session, which workspace you last chose, whether your sidebar is collapsed, and short-lived cookies that secure connection flows. There are no advertising or third-party tracking cookies, so there is no cookie banner.
How long we keep data
- Workspace content: until you delete it or delete your account. Email headers are not stored separately. They appear only in the daily brief items you keep or delete.
- Product usage events: up to 13 months, then deleted automatically.
- Database backups: kept by our database provider for a limited recovery window, then overwritten.
Your choices and rights
- Export: Settings → Your data → Download my data gives you a complete copy of your account and the workspaces you own.
- Delete: Settings → Your data → Delete account removes your account and the workspaces you own straight away, including stored files and connections. Copies in backups expire with the backup window.
- Correct: you can edit your content and account details in the app.
- Opt out of usage analytics: in Settings.
Depending on where you live, you may also have rights to object to or restrict processing, and to complain to your data protection authority. To use any of these rights, contact [privacy@your-domain].
Security
Each workspace's data is isolated by database-level access rules. Connections are encrypted, and secrets are hashed or encrypted at rest. No system is perfectly secure. If a breach affects your data, we will tell you as the law requires.
Children
Mehemoth isn't meant for children under 16, and we don't knowingly collect their data.
Changes
If we make a material change, we'll tell you in the app and ask you to accept the new version before you continue.
Contact
[Company legal name], [Registered address]. Email [privacy@your-domain]. See also our Terms of Service.