Privacy Policy

This policy covers myso.dev, the Myso console, the Myso API and the Myso CLI and editor extensions. Myso is operated by Hostwares.

It does not cover applications you build with Myso. If your app collects data from your own users, you are the controller of that data and need your own policy.

• Account details — your email address, name, organisation name, and a hashed password (or, if you use Google sign-in, the profile Google returns).
• Content you send us — prompts, conversations, and the files in your project workspaces.
• Things the agent produces — code it writes, commands it runs, and the output of those commands.
• Usage and billing records — model used, token counts, tool calls, credits consumed, invoices.
• Technical logs — IP address, user agent, request paths and timestamps, kept for security and debugging.
• Credentials you connect — when you install our GitHub App, we store the installation id, not your GitHub password. Cloud credentials we provision for you are encrypted at rest.

We do not ask for, and you should not send us, payment card numbers by email or in a prompt.

• Running the service you asked for — answering prompts, executing agent turns, provisioning and hosting your projects.
• Metering and billing your usage.
• Security: detecting abuse, rate-limit evasion and fraud.
• Support, when you contact us about a problem.

We do not sell your data, and we do not use your prompts or code to train models. Our model providers are contractually bound not to train on data sent through their APIs.

Delivering Myso means passing some data to these providers. This is the full list.

• Anthropic and Meta — receive your prompts and conversation context to generate responses.
• GitHub — when you connect the Myso GitHub App, receives the code we push on your behalf, to the repositories you selected.
• Hostwares — hosts the sites and databases Myso provisions for your projects.
• Google — reCAPTCHA runs on our login and registration pages to block automated signups, and sets its own cookies. Google sign-in, if you use it.
• Cloudflare — Turnstile, used for the same anti-abuse purpose.
• Brave Search and Tavily — receive a search query when the agent uses its web-search tool. They do not receive the rest of your conversation.
• Our email relay — receives your address and message content for account email such as verification and password resets.

Myso's application servers, database and the project workspaces run on Hetzner infrastructure in Germany. Backups are held in the same region.

Sites and databases provisioned through Myso Cloud run on Hostwares infrastructure, which includes facilities in Germany and Bangladesh. Where your particular project runs depends on the region chosen at provisioning time.

Our model providers and the other services above process data in their own regions, which may include the United States. Sending a prompt to Myso means accepting that transfer.

• Session cookie — keeps you signed in. Strictly necessary; the service cannot work without it.
• Google reCAPTCHA cookies — set by Google on the login and registration pages to tell humans from bots.
• Cloudflare Turnstile — set for the same purpose where enabled.

We run no advertising and no analytics trackers. We do not build a profile of you across other websites.

• Account records — for as long as your account exists.
• Conversations and project files — until you delete them, or 30 days after you close your account.
• Usage and billing records — retained as long as tax and accounting law requires, typically several years. These are financial records and survive account deletion.
• Technical logs — around 90 days.
• Audit logs — one year.

Wherever you live, you can ask us to:

• Give you a copy of the data we hold about you.
• Correct anything inaccurate.
• Delete your account and its contents, subject to the billing records above.
• Stop processing your data, which in practice means closing your account.

Email [email protected]. We aim to respond within 30 days. If you are in the UK or EU and are unhappy with our response, you may complain to your national data protection authority.

• Traffic is encrypted in transit with TLS.
• API keys are stored as SHA-256 hashes; we cannot show you a key again after you create it.
• Provisioned cloud credentials are encrypted at rest with AES-256-GCM.
• Every project gets its own isolated database with its own signing secret, so one project's credentials cannot read another's data.
• Access to production systems is limited to staff who need it.

No system is perfectly secure. If you find a vulnerability, please tell us at [email protected] before disclosing it publicly.

Myso is not for anyone under 18. We do not knowingly collect data from children.

We will post any change here and update the date at the top. If a change materially affects how we handle your data, we will email you before it takes effect.