Privacy Policy

Modyl is built by Carcinize Corp. We take your privacy seriously and want to be upfront about what we collect, why, and how you can control it.

What we can see when using our apps & services (beyond just this landing page)

Modyl is operated by Carcinize Corporation. We take multi-layered, industry-standard protections to ensure your data is protected and accessed only in accordance with the agreements between us and all applicable laws. Your data is only accessed as necessary to provide application functionality or in accordance with system maintenance and necessary operations. Unless an interaction is explicitly marked confidential and protected by customer-held key features (like BYOK or E2E encryption), everything you send through Modyl is readable by us in the course of this work — messages, interaction names and descriptions, files, and the record of who is in which interaction. This includes direct messages and interactions marked private.

"Private" in Modyl means other people in your organization cannot see it. It does not mean we cannot see it. Unless you are using a BYOK or E2E protected interaction, we hold the keys that make your account work, so we are technically able to read anything stored on our servers.

We read it when we need to operate the service, investigate abuse, comply with a lawful request, or when you ask us for support. We do not sell it and we do not use it to train models.

Confidential channels

Confidential channels, where the content is encrypted so that we cannot read it, are not publicly or broadly available yet. When they are, they will be labelled clearly, and the setting will be fixed when the channel is created — an existing channel cannot be made confidential later, because its history is already stored in a form we can read. Customers and design partners who are testing these features may have access to this functionality.

Agents

Automated agents you add to an interaction are members of it and can read what is posted there. Agents we operate on your behalf run on our infrastructure, which means the same access described above applies to them.

What we collect

We collect the data needed to operate the site, communicate with you, and provide our apps and services:

In the apps

• Account details — your email address, and your name if your identity provider supplies one.
• Workspace identity — a public key identifying you inside a workspace, and the private key our Keyring holds and signs with. You get a separate identity in each workspace you join, and they cannot be linked to each other from the outside.
• Device identifiers — an identifier the app generates and stores in the device keychain, and a separate signing key issued to each device you sign in on.
• Messages and files — what you write in channels and direct messages, channel names and descriptions, images and files you attach, your profile photo, and voice notes you record.
• Usage events — a small fixed set of product events: signing in, a device key being issued or renewed, a workspace session expiring, and feedback you submit. These carry your workspace public key and never your email, your name, or anything you wrote.
• Operational logs and errors — server-side error reports and performance traces about the software, kept briefly to diagnose faults.

A voice note you record is uploaded and stored with the workspace's other files, the same as an image. Live audio in a call is passed between participants as it happens and is not recorded or stored by us.

On the website

• Optional usage analytics: fixed, allowlisted interaction events collected through PostHog after you accept analytics. We do not send page URLs, query strings, referrers, hostnames, form values, or session recordings to PostHog, and those events carry no per-visitor identifier. This helps us understand aggregate use without collecting submitted content.
• Communication data: if you email us, use the chat messenger, or request access, we retain your communication. An access request includes the email address and decision context you choose to submit, together with the time and version of your consent. Access requests are stored in Cloudflare D1 and the contact is synchronized to our self-hosted Twenty CRM for review.
• How you found us: when you submit an access request, we store alongside it which of our own pages you first arrived on, which page you submitted from, the name of the website that linked you to us if there was one, and any campaign labels (such as utm_source) that were on the link you followed. We keep this so we can tell which of our pages are actually useful to people. It is stored whether or not you accepted optional analytics, because a count that included only the people who accept analytics would be a misleading one.
  What this deliberately is not: we store the name of the referring website, never the full address of the page you came from, so a search you typed stays out of our records. We keep the name of one of our own pages only when it matches the shape of an ordinary page address on this site; anything else is recorded as/other instead. This record lives in your browser tab for the length of your visit and is sent only with the access request you deliberately submit. It is not a cookie, we do not share it, it sets no identifier that would recognise you on a later visit or on any other website, and it is deleted with the rest of your access request.
• Chat messages: whatever you type into the chat messenger, plus the technical metadata any web service sees when your browser connects to it, such as IP address, browser and device type, and the page you opened chat from. If you give us your email address or name inside a chat so we can reply, we keep that too. We do not pass your identity to the chat provider ourselves. The only thing we send it about you is whether you opened chat from the support page or from elsewhere on the site, so the conversation starts in the right place. Everything else it holds about you is what you chose to type.

Through the Modyl connector

The Modyl connector is the server at https://apex.modyl.to/mcp that ChatGPT, Claude and coding agents such as Claude Code and Codex connect to. It answers what your agents did and what is waiting for you. Using it, we collect:

• Your sign-in: you sign in through WorkOS, our identity provider. We receive your WorkOS user ID, and your email address and name if WorkOS supplies them. The first time you sign in we create a space of your own for your activity, named after your user ID, and record that you joined it.
• Every call the connector receives: we keep the whole request each time ChatGPT, Claude or another client calls the connector. That includes the name of the tool called and every argument passed to it, which can contain the text of your question or of the message you asked to send. With each call we keep the name and version the client reports (for example ChatGPT or Claude), its user agent, the protocol version, the app it was registered as, whether the call was answered or refused, and the reason for a refusal. These calls are recorded as activity in your own space, so you can see them like any other agent activity.
• What your agents send: if you connect a coding agent (the Claude Code plugin, Codex or another client), it sends the activity of its sessions: your prompts, the tools it ran with their inputs and results, files and other artifacts it produced, and the names of the machine and project it ran in. We keep what it sends so answers can cite it.
• Your answers and subscriptions: when you settle an escalation we keep your verdict, any note you add and who answered. When a client subscribes to events we keep the address it asked us to deliver them to and the secret used to sign them.

The connector reads only the spaces you have access to. A space of your own is visible to you and not to other users of the connector.

How we use it

• Improving the site based on aggregate usage patterns.
• Understanding which of our pages and links bring people who request access, so we can write fewer and better pages.
• Responding to your questions, support requests, or access requests.
• Answering the questions you or your agents ask the connector, and delivering the events you subscribe to.
• Keeping a record of calls and refusals so we can show you what was asked on your behalf, investigate abuse, and fix faults.

Third-party services

We use a small number of trusted third-party services to operate:

• PostHog: consented, fixed-event analytics.
• Intercom: the chat messenger and the support conversations held in it. A chat control is available on every page of this site. Intercom loads its own script from its servers and sets its own cookies, but only once you open the chat. If you never open it, no Intercom script runs and no Intercom cookie is set. Intercom processes chat data on our behalf as our processor and service provider, under its own privacy policy.
• Cloudflare: hosting and CDN.
• Twenty: our self-hosted access-request CRM.
• WorkOS: sign-in for the Modyl connector.
• Cloudflare R2: a verbatim copy of each connector call and of what your agents send, kept alongside the database copy that runs in our own servers.
• AI model providers: some answers, such as asking where a piece of work belongs or asking about another agent's session, are composed by a language model. For those, the question and the captured records it draws on are sent to the model provider we route that answer through, currently Google Gemini.

We do not sell your data to anyone. These services process data only as needed to provide their specific function.

Cookies

We use a small number of cookies:

• Analytics choice: we store whether you accepted or declined optional analytics so your choice persists. Analytics events use no persistent visitor identifier.
• Chat cookies: Intercom uses cookies and similar storage to keep a chat conversation attached to you across pages and visits, so a reply reaches you rather than a stranger. These are set only after you open the chat, never on page load.
• Hosting platform cookies: this site is served by our hosting platform, Ploy, which sets its own cookies on every page load, before and independently of any choice you make about our analytics. ploy_anon_id is a persistent pseudonymous visitor identifier that lasts up to a year;ploy_session identifies a single visit. The platform records the page you are on and the address you arrived from, and uses the visitor identifier to keep any content experiment showing you a consistent version of a page. We do not control these cookies, we do not use them to identify you, and declining our optional analytics does not prevent them. Our content delivery provider also sets a security cookie (__cf_bm) to distinguish people from automated traffic.

We do not use advertising cookies, and we do not sell or share anything about your visit with advertisers. The hosting platform cookies described above are set by the platform that runs this site, not by us, and they are the reason we describe them here rather than claiming this site sets none.

Website data retention and deletion

We keep analytics and communication data for as long as needed to operate the site and respond to you. Chat conversations are held in Intercom, and we keep them there for the same reason we keep mail: so a later question can be answered against what was already said. We have not set a fixed automatic expiry on them, so assume a chat conversation persists until it is deleted on request. If you want your data deleted, including a chat conversation, email us at hello@modyl.to or ask in the chat itself, and we will remove it, from Intercom as well as from our own records, within 30 days.

How long we keep it

Messages and files are kept for as long as the workspace exists, unless they are deleted. Account details and your workspace identity are kept while your account exists. Device keys expire on their own and are reissued while you keep using the app, so a device you stop using loses its access when its key expires. Usage events and operational logs are kept by our providers under their own retention settings and are not needed to run your workspace.

Connector calls, your agents' activity and your answers to escalations are kept for as long as your account exists, with no fixed automatic expiry, unless you ask us to delete them. Event subscriptions are kept until the client that made them unsubscribes or you ask us to remove them.

Deleting your data

Email hello@modyl.to from the address you signed in with and we will action it and confirm when it is done. You can also ask for a copy of the personal data we hold about you, to correct it, or to object to how we use it, at the same address.

What deletion does and does not reach

We delete your account, your sign-in, the keys issued to your devices, and your name and profile photo. Two things survive, and we would rather say so than imply otherwise. Messages you have already sent stay in the workspace's history — the record is append-only and other members' copies are already on their devices, so removing them from everyone's view is not something we can honestly promise. And backups roll off on their own schedule, so data may persist in them for a period after deletion.

If you signed in with Apple and also want to stop Apple sharing your details with this app, open iOS Settings, tap your name, then Sign in with Apple. That relationship is between you and Apple and is not one we can end on your behalf.

Changes to this policy

If we make significant changes, we will post a notice on the site. Minor wording updates will be reflected in the “Updated” date above.