Privacy Policy

The short version

If you only have a minute, here is what you need to know:

• We collect what is needed to run your account and nothing more.
• We do not sell your data. We do not run advertising trackers.
• We do not train AI models on your prompts, code, or project files.
• Payment is a direct on-chain stablecoin transfer on TON or Solana — we never see a card number or bank account.
• You can export or delete your data at any time, and you own the code you generate.

The rest of this page explains exactly what we collect, why, and who we share it with.

What we collect

Account information

When you sign up we store the identifier returned by our authentication provider (usually an email address and a provider-issued user ID) plus an optional display name. We never see or store your password.

Project data

Everything you build through mythos — prompts, generated files, commit history, preview URLs, and metadata such as project name and created date. Project files live in a private internal source repository and are mirrored to our database so the workspace UI can load them quickly.

Usage data

Basic request metadata is recorded automatically: IP address, browser and operating system strings, timestamps, the pages you visited, and the outcome of generation runs. This data is used for security, debugging, and capacity planning. It is not sold or shared with advertisers.

Job applications

If you apply for a role, we store the contact details, location, links, resume URL, work samples, application answers, availability, referral source, and basic browser information you submit so we can review and respond to the application.

AI interactions

Prompts you send to the agent, along with the working-copy files the agent reads during a session, are transmitted to our upstream AI provider so they can generate a response. We keep a short log of prompt text, immutable response evidence, and token/cost totals so we can investigate failed runs and bill credits accurately. We do not store private model reasoning in product logs.

On-chain payment data

When you top up credits using USDT on TON, USDT on Solana, or USDC on Solana, we record the selected asset and network, displayed receive address, scanner watch account when it differs, exact amount, Solana invoice reference when applicable, transaction hash, payment-intent ID, and credit pack purchased. A TON invoice displays the receive address reviewed by Mythos and does not request or use a memo/comment for matching; its derived USDt jetton wallet is used as the scanner watch account. Public chain data may expose a sending address or other transfer payload. This data is used to match the transfer, credit the balance, and investigate payment disputes.

Connected services

If you connect your own Supabase project or GitHub account, we store the credentials needed for that connection (encrypted at rest) and a record of what was connected when. The agent is given only the minimum the connection needs — for Supabase, the project URL and the public anon key.

Published sites

When you publish a project, its static build is copied to our hosting provider and served publicly on your chosen subdomain. Whatever you put in the site becomes public; visitors to it are served directly by the hosting edge (see the sub-processor list).

Legal bases and roles

Where GDPR or an equivalent law applies, we process personal data only on one of these grounds:

• Contract. Running your account, generating and storing your projects, and settling credits — the service you signed up for.
• Legitimate interests. Securing the platform, preventing fraud and abuse, debugging failures, and capacity planning — balanced against your rights and never used for advertising profiles.
• Legal obligation. Keeping payment ledgers for tax and accounting rules, and answering valid legal requests.
• Consent. Anything optional — you can withdraw it at any time without affecting earlier processing.

For the data described in this policy, mythos acts as the data controller. For the applications you build and publish, you are the controller of your end-users’ data — especially if you connect your own Supabase backend, which we never read.

We do not make automated decisions about you that produce legal or similarly significant effects.

Why we collect it

• To sign you in and keep your session alive.
• To generate, store, and serve the projects you build.
• To account for credit spend and honour refunds.
• To detect abuse, fraud, and infrastructure issues, and to keep the sandbox safe for everyone.
• To let you contact support and to contact you about security, legal, or service-critical matters.
• To review and respond to a job application you submit.
• To comply with legal obligations when we receive a valid request.

That is the full list. We do not use your data to build advertising profiles, and we do not sell it to data brokers.

AI training

We do not use your prompts, your generated code, or any other content from your projects to train or fine-tune AI models.

We do send your prompts and the working copy of your project files to an upstream model provider so they can generate a response. Our provider’s enterprise terms prohibit them from using our API traffic to train their models. See the subprocessors section for the current provider.

Who we share data with

mythos is a small layer of code on top of several specialist providers. To operate the service we must share certain data with them. Here is the current list and what each one receives. Their legal roles can differ; not every provider necessarily acts as our processor:

If you connect your own Supabase project (Services → Cloud), your app’s backend — its database, its users, its files — lives in yourSupabase account under Supabase’s terms, not ours. We store the connection credentials encrypted and hand the agent only the project URL and public anon key. We are not a processor of your end-users’ data.

If this list changes we update the date at the top of this page and, for significant changes, announce it in-product. Data-processing terms (DPAs) are used where available. Questions: privacy@mythos.new.

How long we keep it

• Account records. Kept while the account is open, and for up to thirty days after deletion to handle re-activation and support tickets.
• Project files and git history. Kept until you delete the project or transfer the repository out of our organisation. Database mirrors are removed in the same operation.
• Generation logs. Terminal records are deleted once they are more than ninety days old. If a run has not reached a safe terminal state, we retain its limited delivery and credit-recovery record only until that outcome is reconciled, then apply the same deletion rule. Prompts and chat content remain governed by the project-retention rule above.
• Failed remix request identity. After a refunded remix, we keep a minimal record containing opaque request, project, run, and account identifiers—but no prompt, repository, or failure text—to prevent the same browser request from being charged again. Records without a client request key are deleted after ninety days; keyed records remain while the account is open and are deleted with the account.
• Access logs. Kept for up to thirty days for security and abuse investigations.
• Job applications. Deleted once they are more than two years old. You may ask us to delete yours earlier, subject to any legal obligation to retain it.
• Credit and payment ledger. Kept for as long as applicable tax and accounting rules require, currently around seven years.
• Backups. Encrypted backups may contain data for up to thirty days after you delete it from live systems, after which they roll over.

International transfers

mythos runs the app and project sandboxes on Google Cloud Run in europe-west3 (Frankfurt, Germany). Cloud Scheduler and some Google control-plane/operational metadata may use us-central1 (Iowa, USA). The Postgres database (Supabase) is hosted in eu-central-1 (Frankfurt, Germany). The providers named above process data in the regions shown in the register where those regions are published. Where a provider offers a DPA, transfers outside your region use its Standard Contractual Clauses or other stated mechanism.

How we protect it

• TLS is required on every connection. Plain HTTP is rejected.
• Secrets are stored in a managed secret store and rotated on a schedule.
• Database access is scoped with row-level policies so one user cannot read another user’s projects.
• The preview sandbox that runs your code is isolated per project, scales to zero when idle, and is torn down when the project is deleted. Agent tool calls are whitelisted; arbitrary shell access is blocked.
• Error payloads are scrubbed of common secret patterns before they are sent to error tracking.

If we confirm a breach that affects your personal data, we will notify you without undue delay — within 72 hours where GDPR requires it — with what happened, what was affected, and what we are doing about it.

No system is perfectly secure and we do not claim otherwise. If you discover a vulnerability, please report it to support@mythos.new so we can fix it before disclosure.

Your rights

Depending on where you live — including under GDPR in the EU/UK, the CCPA and CPRA in California, and equivalent regimes elsewhere — you have the right to:

• Access the personal data we hold about you.
• Correct anything that is inaccurate.
• Request deletion of your data.
• Restrict or object to certain kinds of processing.
• Receive your data in a portable format and move it elsewhere.
• Withdraw consent where processing relies on consent.
• Lodge a complaint with your local data-protection authority if you believe we are handling your data incorrectly.

Export and deletion are self-service: Account → Export data downloads everything we store about you as JSON, and Account → Delete account removes it. For anything else email privacy@mythos.new. We respond within thirty days. We may ask you to confirm identity so we do not hand your data to an impostor.

What we do not collect

mythos does not intentionally collect:

• Payment card numbers, bank details, or SSNs.
• Precise GPS or geolocation beyond IP-level region.
• Biometric identifiers, health information, political views, religious beliefs, or trade-union membership.
• Data from third-party ad networks, tracking pixels, or data brokers.

If you share any of the above with us accidentally (for example inside a prompt) we will delete it on request and we will not act on it.

Cookies

We use a small number of first-party cookies to keep you signed in and to remember UI preferences. We do not set third-party advertising cookies, and we do not embed tracking pixels from marketing networks. The full inventory — every cookie and storage key, with lifetimes — lives in the Cookie Policy.

Because we do not sell or share personal data for advertising, there is nothing to opt out of — browsers sending a Global Privacy Control signal are already getting the behaviour it asks for.

You can clear cookies from your browser at any time. Clearing them will sign you out.

Children

mythos is not intended for anyone under eighteen, or the age of majority in your jurisdiction. We do not knowingly collect data from children. If you believe a minor has created an account, contact privacy@mythos.new and we will remove the account and associated data.

Changes to this policy

When we update this policy we change the “Last updated” date at the top. For material changes — a new category of data, a new kind of sharing, a new subprocessor that touches user content — we notify active users by email or in-product banner at least thirty days before the change takes effect.

Contact

Privacy and data-rights requests: privacy@mythos.new
Everything else: support@mythos.new or the support page