Privacy Policy | Mythos Docs

Mythos Software, LLC, a Delaware limited liability company, operates Mythos and is the controller for the account and platform processing described here. Our correspondence address is 2810 North Church Street, STE 90672, Wilmington, DE 19802, United States. Contact privacy@mythos.new for privacy and data-rights requests.

This policy explains what we collect, why, who receives it and your choices. Customer content that we process on a customer’s behalf is also covered by our Data Processing Agreement.

The short version

If you only have a minute, here is what you need to know:

We process account, project, collaboration and operational data to provide and protect the service.
We do not sell your data. We do not run advertising trackers.
We do not use your Builder prompts, code, or project files to train AI models.
Stripe handles hosted payment details. Mythos keeps the billing and credit records needed to provide purchases and resolve disputes.
You can request a portable account export or account deletion. Some security and legal records have separate retention rules explained below.

The rest of this page explains exactly what we collect, why, and who we share it with.

What we collect

Account information

When you sign up we store the identifier returned by our authentication provider (usually an email address and a provider-issued user ID), an automatically assigned username, and any profile details you choose to add: a display name, bio, location, website, profile photo, and cover image. Profile images are stored privately and delivered through short-lived signed links. Mythos application code does not receive your password; our authentication provider handles credentials and sign-in.

If you enable two-factor authentication, our authentication provider maintains the authenticator enrollment and verification records needed to protect your account. Authenticator secrets and sign-in credentials are excluded from the portable account archive.

Workspace privacy settings record the selected access rules, their revision and the responsible account and time when available. The profile contribution graph uses daily counts of successfully delivered edit Builds, together with a minimal run receipt to prevent counting the same delivery twice. These counts contain no prompt or source code and may appear on your profile with the other profile information you choose to share.

Project data

Everything you build through mythos — prompts, generated files, commit history, preview URLs, and metadata such as project name and created date. Project files live in a private internal source repository and are mirrored to our database so the workspace UI can load them quickly.

Collaboration and messaging also store membership and invitation records, human project-room and direct messages, contact relationships created through project membership, your read, archive, and block choices, and named Share Preview links. Mythos Updates is a platform-authored product feed; we store only your personal read position for it. While a signed-in member has a project open, Mythos keeps a short-lived presence session so other members can see who is currently there.

Shared previews

A person opening a Share Preview can view the latest working preview without a Mythos account. The preview link is a bearer credential: anyone who receives it can open that preview until it expires or the project owner revokes it. Share Preview no longer collects guest names or new comments. Historical preview-comment records created before retirement remain dormant only for the retention, export, correction, and deletion obligations described in this policy.

Usage data

Infrastructure access logs can record request metadata such as IP address, browser and operating-system strings, timestamp, path, and request outcome for security, debugging, and capacity planning. These access logs are separate from published-site Analytics. They are not sold or shared with advertisers.

Optional product analytics and session replay

If you allow optional analytics, we send bounded product-use events to PostHog’s EU service to understand sign-up, template selection, Builds, previews, publishing, connectors and purchases. Events contain opaque account and project/run identifiers, a page category or action, timestamps and limited outcomes, counts, durations, credit usage or purchase amounts and currency. They do not include email addresses, names, prompts, chat, source code, attachments, credentials, private URLs, query strings or fragments. Ordinary network metadata accompanies requests to the provider. Our PostHog configuration disables internal AI training and third-party AI services.

A separate session-replay choice allows sampled, masked recordings and heatmaps only on the public homepage, pricing page and template catalogue, without queries or fragments. Text and input values are masked; form controls, media and embedded previews are blocked. Authentication, dashboards, workspaces, chat, code, Preview, payment, settings and admin surfaces are excluded. Network bodies, headers and console content are not recorded. The browser SDK operates only on those public pages; consented product events from other app surfaces go through Mythos’s server. We do not inject PostHog into customer-built or published sites.

Both optional choices require your consent. While signed out, your choice applies to this browser; while signed in, it applies to your account. A valid browser choice can carry into an account with no saved choice, but cannot replace an existing refusal. You can change or withdraw your choices at Manage cookie preferences. Global Privacy Control stops both optional analytics and replay even if a previous choice allowed them. Declining does not prevent you from using Mythos. Withdrawal stops new collection; it does not by itself erase earlier events. See the retention and rights sections below.

Public-site measurement

Public mythos.new pages use Cloudflare Web Analytics to measure visits and page performance with a cookieless browser beacon. Cloudflare receives those measurements. This is separate from account and operational logs and from the optional visitor analytics on customer-published sites. Dismissing the Mythos app cookie notice does not disable the cookieless beacon. See Cloudflare’s data collection documentation and our Cookie Policy.

Job applications

If you apply for a role, we store the contact details, location, links, resume URL, work samples, application answers, availability, referral source, and basic browser information you submit so we can review and respond to the application.

AI interactions

When you explicitly start voice dictation, your browser records a bounded audio clip and sends it through Mythos to OpenAI for transcription. Mythos does not persist the audio. The returned text is inserted into the composer for you to review and is not submitted automatically.

Prompts you send to the Builder, along with the working-copy files it reads during a session, are transmitted to OpenAI so it can generate code. For oversized document attachments, a separate bounded OpenAI extraction call may receive selected document chunks and pseudonymous source-reference identifiers before the Builder runs; it does not receive the repository, backend credentials, secrets, or runtime evidence and cannot write code. Your prompt remains in your project chat. We keep the bounded task classification when the optional profiler is enabled, immutable routing decision, per-stage token/cost totals, and sanitized outcome evidence needed to investigate failed runs and bill credits accurately. Operational logs and traces exclude prompts, code, file contents, tool payloads, and private model reasoning.

To continue a Build paused at its credit limit, we keep a private working-copy snapshot and encrypted execution state. This can include project content and tool progress required to resume that exact Build without repeating completed actions. It is private execution storage, not operational telemetry or a public preview.

Payments and credits

For Stripe purchases, we receive customer, checkout, payment and subscription identifiers, the selected offer, amounts, currency, billing status, relevant billing/contact information returned by Stripe, consent evidence and credit movements. Full payment-card numbers and CVCs stay in Stripe’s hosted payment flow. Stripe also processes information for its own payment, fraud-prevention and legal obligations under its terms.

Historical cryptocurrency purchases may leave transaction hashes, wallet or invoice references, selected assets/networks, amounts and credit records. Public blockchain records are outside Mythos’s control and cannot be erased by deleting a Mythos account.

Connected services

When you authorize a connection, we retain its identity, granted scopes, connection state and the encrypted credentials required to perform your requested actions. The connector gateway can hold provider responses and minimal execution receipts for reliable retry and dispute resolution. A provider response can contain personal data from the service you connected. We do not give provider secrets to the Builder.

Managed Supabase connections authorize an existing organization in your own provider account. Backend project metadata and requested operations are processed to connect and operate that backend. Your provider account, projects and data remain subject to that provider’s agreement. Mythos does not acquire ownership of them.

Retired Supabase connections may retain encrypted legacy credentials and metadata for compatibility and safe cleanup. An ordinary frontend Build may use a stored public project URL and anon key; provider tokens and service-role credentials are excluded from model context.

Published sites

When you publish a project, its static build is copied to our hosting provider and served publicly on your chosen subdomain. Whatever you put in the site becomes public; visitors to it are served directly by the hosting edge (see the sub-processor list).

Published-site visitor analytics

A project owner can enable or disable Visitor analytics under More → Project settings → Publishing. With this setting enabled, analytics runs automatically on a live published site, never in Preview. Mythos does not add a consent card or preferences button. A remembered rejection on that hostname and Global Privacy Control stop collection and clear the analytics session cookie. A missing preference is not recorded as consent. Existing preferences, and choices made through a control supplied by the site owner, can be remembered for up to 180 days. Disabling analytics or unpublishing stops new collection without deleting earlier history.

For each accepted page view we store the project, event time, a random 30-minute session identifier, the pathname without its query or fragment, an external referrer hostname or “Direct”, a coarse Desktop/Mobile/Tablet class, and a two-letter country code derived from the browser’s IANA time zone (or XX when unavailable). We do not store the time-zone identifier or the visitor’s IP address, full user-agent, full referrer or URL, query or UTM parameters, fingerprint, Mythos account identity, or a profile that follows the visitor across separate sessions.

Legal bases and roles

Where GDPR or an equivalent law applies, we process personal data only on one of these grounds:

Contract. Running your account, generating and storing your projects, and settling credits — the service you signed up for.
Legitimate interests. Securing the platform, preventing fraud and abuse, debugging failures, and capacity planning — balanced against your rights and never used for advertising profiles.
Legal obligation. Keeping payment ledgers for tax and accounting rules, and answering valid legal requests.
Consent. Optional product analytics and separately optional session replay rely on your consent. You can withdraw it at any time without affecting the lawfulness of earlier processing.

Mythos Software, LLC is the controller for your account and platform operations. For an application you build and publish, you determine its purposes and normally act as the controller of your end-users’ data. Mythos acts as your processor for customer personal data handled on your documented instructions, including the bounded built-in visitor dataset; our Data Processing Agreement describes that relationship. You remain responsible for the notices and consent your application requires, including for built-in analytics and any additional scripts you add. If prior consent is required, configure your site to block analytics until that choice is made. Automatic collection is a product setting, not a claim that consent is unnecessary in every jurisdiction.

We do not make automated decisions about you that produce legal or similarly significant effects.

Why we collect it

To sign you in and keep your session alive.
To generate, store, and serve the projects you build.
To provide project owners with aggregate traffic metrics for their published sites when Visitor analytics is enabled.
To account for credit spend and honour refunds.
To understand and improve Mythos through optional product analytics and separately optional public-page replay, when you consent.
To detect abuse, fraud, and infrastructure issues, and to keep the sandbox safe for everyone.
To let you contact support and to contact you about security, legal, or service-critical matters.
To review and respond to a job application you submit.
To comply with legal obligations when we receive a valid request.

That is the full list. We do not use your data to build advertising profiles, and we do not sell it to data brokers.

AI training

We do not use your prompts, your generated code, or any other content from your projects to train or fine-tune AI models.

We send explicitly recorded voice audio to OpenAI only to produce the transcript placed in your composer. We also send Builder prompts and the working copy of your project files to OpenAI so it can generate a response. If the separately activated oversized-document path applies, a bounded OpenAI extraction call receives selected chunks and pseudonymous source-reference identifiers (content hashes and chunk IDs) from those attachments to create a source-referenced brief. It does not receive attachment filenames or MIME types, the current user goal or repository, and it cannot write code. OpenAI’s business API service is configured for processing, not model training. See the subprocessor register for provider roles and processing boundaries.

The Subprocessor and Service Provider Register identifies the providers, purposes and processing locations used for hosting, storage, AI inference, email, monitoring, optional product analytics, payments and documentation. A provider’s role depends on the activity: for example, Stripe may act as an independent controller for its own payment and compliance purposes, and a service you connect in your own account remains your selected provider.

We disclose data to authorized workspace members according to their access, to the public when you publish it, to providers needed for the requested service, and where required by a valid legal obligation. A business reorganization may require a protected transfer consistent with this policy and applicable notice requirements. We do not sell personal data or share it for cross-context behavioral advertising.

Public documentation is hosted by Fern. Opening it sends the ordinary browser request to that provider; Mythos does not append account or project content to documentation links. Status and other third-party pages have their own notices. We update the register when processing changes and provide the advance notice required by the DPA or applicable law.

How long we keep it

Account records. Kept while the account is open. Account deletion starts a staged removal of account and project resources; it is not a thirty-day reactivation period. The product distinguishes pending cleanup from completed deletion. Where provider cleanup or an action outcome remains unresolved, we retain the records needed to finish safely and restrict their use to that purpose. There is no self-service restoration after completed deletion.
Project files and git history. Retained while the project exists. Project deletion removes Mythos-managed project records, repository and hosted artifacts through the deletion process. A repository or backend in your own provider account is not deleted merely because you close Mythos; our connection authority is handled separately.
Collaboration and messaging. Memberships, invitations, project-room messages, and Share Preview link metadata follow the project/account deletion boundary. A direct conversation, its shared message history, contact relationship, archive/read state, and block choice are not deleted merely because project access ends; they remain until an affected account is deleted. Your Mythos Updates read position follows your account deletion boundary, while the platform-authored update itself is global product content. Dormant historical preview-comment records follow the project boundary and are retained only for compatibility with export, correction, and deletion requests. Share Preview access capabilities are short-lived, and an expired, replaced, or revoked link can no longer open the preview. Presence sessions are temporary: they stop being shown after sixty seconds without a heartbeat, become eligible for deletion after twenty-four hours, and are removed by the next daily retention sweep.
Generation logs. Terminal records become eligible for the daily deletion sweep once they are more than ninety days old. If a run has not reached a safe terminal state, we retain its limited delivery and credit-recovery record only until that outcome is reconciled, then apply the same deletion rule. Prompts and chat content remain governed by the project-retention rule above.
Paused Build working copies. Private source snapshots remain available while the Build needs them for continuation or safe recovery. After the Build becomes terminal or is deleted, their exact objects become eligible for bounded cleanup after one day; unsuccessful cleanup stays recorded for retry. The associated execution and billing records follow the generation-retention and account/project-erasure rules above.
Profile contribution activity. Daily edit counts and their minimal duplicate-prevention receipts cover the last 365 UTC calendar days, including today. Older records are excluded from the graph and become eligible for the next bounded daily deletion sweep. Account deletion removes these records earlier. This does not extend the lifetime of generation prompts or run payloads. History that was already unavailable before these counters began is shown as unavailable, not invented as zero activity.
Workspace privacy settings. Current rules and their revision history remain with the workspace. Deleting an account removes its actor reference from shared policy records; it does not remove the workspace’s access rules. Workspace deletion removes those policy records.
Failed remix request identity. After a refunded remix, we keep a minimal record containing opaque request, project, run, and account identifiers—but no prompt, repository, or failure text—to prevent the same browser request from being charged again. Records without a client request key are deleted after ninety days; keyed records remain while the account is open and are deleted with the account.
Message identity security tombstone. After project or account deletion removes chat content, we retain the random message UUID, its former random project UUID, semantic role, opaque workflow binding and, for a human turn, the former random account UUID only when an immutable source proved the author. Older uncorrelated human turns keep an explicit unknown-author binding instead; we do not infer the author from the project owner. This content-free record is kept permanently so a deleted identity cannot be reassigned across accounts, projects, roles, or trusted assistant workflows. It contains no prompt, response, profile, email, repository, or chat payload. We use it only for anti-replay and provenance-spoof prevention under our security legitimate interest.
Access logs. Kept for up to thirty days for security and abuse investigations.
Optional product analytics. PostHog retains events and associated metadata under its paid-plan seven-year retention window. This is separate from financial-record retention. You can request earlier erasure of data linked to you. Account deletion suppresses pending delivery and requests provider erasure; the product records pending provider cleanup separately from completed deletion. Withdrawing consent stops new collection but does not automatically erase previously collected events.
Optional session replay. Masked session recordings are retained for thirty days under our selected PostHog recording setting. Associated product-event metadata follows the separate event-retention rule above. You can request earlier erasure of recordings linked to you.
Published-site analytics. Raw page-view events become eligible for deletion after ninety days and are removed by the scheduled retention sweep. Deleting the project or account removes them earlier. Turning Visitor analytics off or unpublishing stops new collection immediately but keeps existing history until that retention or deletion boundary.
Support and job applications. Job applications and resolved, closed or spam support requests become eligible for deletion after two years. An unresolved support case is retained while it needs action. You may request earlier deletion, subject to applicable obligations.
Planned welcome-credit retention change. After the advance notice described in “Changes to this policy” has been provided to active users, we will retain a keyed fingerprint of the email address that received the welcome bonus and the original award date to prevent repeated welcome-credit claims, including after account deletion. This record will have no time-based expiry. It will contain no email address, profile, or account identifier and will be used only to determine eligibility for that bonus. Once effective, deleting and recreating an account will not make the same mailbox eligible again.
Financial and legal records. Payment, invoice, dispute and accounting records may need to be retained after account closure for applicable tax, accounting, fraud-prevention or legal-claim obligations. We limit this exception to the records needed for that purpose; it is not a reason to retain unrelated project content.
Backups. Provider-managed backup copies follow the applicable backup expiry cycle rather than live row deletion. They are restricted to recovery and protection, not routine use. If a backup is restored, applicable deletion requests must be reapplied before the restored data returns to ordinary processing.
Connector results. Successfully completed provider-response payloads are no longer available for replay after thirty days from completion. They are erased by bounded maintenance, or when an expired result is read. Confirmed connection, project and account cleanup also erases the stored response payloads covered by that cleanup. Minimal operation identifiers, digests and outcome receipts may remain to prevent duplicate external actions. An executing action or an action with an unknown external outcome must first be reconciled; we do not discard the evidence needed to determine whether it occurred.

Scheduled cleanup is bounded so it can complete safely. A failed run or backlog can delay physical removal; access restrictions and logical expiry still apply where implemented. We investigate failures and do not report a pending account deletion as complete.

International transfers

mythos runs the app and project sandboxes on Google Cloud Run in europe-west3 (Frankfurt, Germany). Cloud Scheduler and some Google control-plane/operational metadata may use us-central1 (Iowa, USA). The Postgres database (Supabase) is hosted in eu-central-1 (Frankfurt, Germany). The providers named above process data in the regions shown in the register where those regions are published. An EU infrastructure region does not mean that every provider, support operation or subprocessor processes data only in the EU. Cross-border processing requires an applicable safeguard, such as an adequacy decision or Standard Contractual Clauses, where required by law. Our customer DPA describes the transfer terms applicable to processing by Mythos; the provider register links the providers’ own terms.

How we protect it

We use HTTPS for public service traffic, managed secret storage, encrypted connector credentials, scoped database access, role checks and isolated build execution. Operational error handling scrubs common secret patterns, and Sentry session replay is disabled. These measures reduce risk; they do not guarantee that no incident can occur. Our Security page describes reporting and scope.

We assess personal-data incidents and notify affected customers, people and authorities when the applicable legal thresholds require it. Under GDPR, the supervisory-authority deadline can be 72 hours after awareness; notification to affected people has a different risk threshold. We do not treat a fixed 72-hour message to every user as a substitute for that assessment.

Your rights

Depending on where you live — including under GDPR in the EU/UK, the CCPA and CPRA in California, and equivalent regimes elsewhere — you have the right to:

Access the personal data we hold about you.
Correct anything that is inaccurate.
Request deletion of your data.
Restrict or object to certain kinds of processing.
Receive your data in a portable format and move it elsewhere.
Withdraw consent where processing relies on consent.
Lodge a complaint with your local data-protection authority if you believe we are handling your data incorrectly.

Account → Export data prepares a portable JSON archive of the supported account-data categories and records its scope. A completed download requires every included category to be collected successfully; a failed or oversized request is reported as an error, not delivered as a partial completed archive. Credentials, OAuth tokens and other secrets are excluded. The archive includes your daily profile contribution counts, current workspace privacy rules within your access and policy changes attributed to you, as well as your direct-conversation identities and message history, messages you authored in project rooms, your own contacts, read/archive state and outgoing block choices, your own Share Preview link actions, historical authored review content where applicable, and short-lived project-presence records. It does not include a contact’s unrelated profile or content, another person’s block choice, or the global Mythos Updates content. The portable archive includes final public Build credit receipts and the canonical charge and refund transactions. It excludes private continuation snapshots, encrypted execution state and internal provider-cost, reservation and anti-replay controls; their canonical prompts, results and user-facing credit movements are included through the supported project and billing records. The portable archive also excludes the internal message-identity anti-replay registry described above. Requests to access, correct, or object to that permanent security record require verified manual review. Account → Delete account starts account closure and removal of associated project resources; legal records and encrypted backups follow the retention periods above. For data not covered by the automated archive or any other rights request, email privacy@mythos.new. We respond within the applicable legal deadline, normally one month for GDPR requests. If a lawful extension is needed, we explain it within the initial period. We may ask you to confirm identity so we do not hand your data to an impostor.

If you visited a site published by a Mythos customer, contact that site owner first: they are the controller for the site’s visitor data. We assist project owners with valid access, restriction, and deletion requests for the bounded analytics data we process for them.

If you previously commented as a guest on a Share Preview before that feature was retired, contact the project owner or privacy@mythos.new. We may ask for the exact preview link and sufficient evidence to verify authorship before disclosing, correcting, or deleting the historical record.

What we do not collect

mythos does not intentionally collect:

Full payment-card numbers, CVCs or government identifiers through the Mythos application; payment providers collect the details needed for their hosted payment flow.
Precise GPS or geolocation beyond IP-level region.
Biometric identifiers, health information, political views, religious beliefs, or trade-union membership.
Data from third-party ad networks, tracking pixels, or data brokers.

Do not submit sensitive data that is unnecessary for your task. If you include it in a prompt or connected-service response, it can be processed with that content. Contact us to request removal; applicable access, retention and legal exceptions still apply.

Cookies

The Mythos app uses first-party cookies for sign-in and essential preferences, including a signed browser-consent identifier. Optional product analytics and separately optional replay require your consent; their choices are described in the Cookie Policy. An analytics-enabled published site uses a random, host-only session cookie with a sliding 30-minute lifetime unless a stored refusal or Global Privacy Control blocks collection. An existing allow/reject preference, or one set by a site-owned control, can last up to 180 days; the tracker does not create an accepted preference when none exists. The session identifier is pseudonymous, not a guarantee of anonymity. Rejection or Global Privacy Control stops new analytics and clears that session cookie. See the Cookie Policy for the inventory and controls.

We do not sell or share personal data for cross-context behavioral advertising. Built-in published-site analytics honors Global Privacy Control by stopping collection, including when a stored preference says accepted. Browser choices apply per hostname, device and browser.

Children

mythos is not intended for anyone under eighteen, or the age of majority in your jurisdiction. We do not knowingly collect data from children. If you believe a minor has created an account, contact privacy@mythos.new and we will remove the account and associated data.

Changes to this policy

When this policy changes, we update its version and date and explain material changes in the change history. We provide active users at least thirty days’ advance email or in-product notice before material new uses or sharing of their data, except where a shorter period is legally required or necessary to address an urgent security issue. We seek consent separately where required. Publishing a page alone does not establish delivery of an individual notice.

Contact

Mythos Software, LLC — 2810 North Church Street, STE 90672, Wilmington, DE 19802, United States.

Privacy and data-rights requests: privacy@mythos.new
Everything else: support@mythos.new or the support page