Privacy Policy

Modyl is built by Carcinize Corp. We take your privacy seriously and want to be upfront about what we collect, why, and how you can control it.

What we can see when using our apps & services (beyond just this landing page)

Modyl is operated by Carcinize Corporation. We take multi-layered, industry-standard protections to ensure your data is protected and accessed only in accordance with the agreements between us and all applicable laws. Your data is only accessed as necessary to provide application functionality or in accordance with system maintenance and necessary operations. Unless an interaction is explicitly marked confidential and protected by customer-held key features (like BYOK or E2E encryption), everything you send through Modyl is readable by us in the course of this work. That covers messages, interaction names and descriptions, files, and the record of who is in which interaction. This includes direct messages and interactions marked private.

"Private" in Modyl means other people in your organization cannot see it. It does not mean we cannot see it. Unless you are using a BYOK or E2E protected interaction, we hold the keys that make your account work, so we are technically able to read anything stored on our servers.

We read it when we need to operate the service, investigate abuse, comply with a lawful request, or when you ask us for support. We do not sell it and we do not use it to train models.

Confidential channels

Confidential channels, where the content is encrypted so that we cannot read it, are not publicly or broadly available yet. When they are, they will be labelled clearly, and the setting will be fixed when the channel is created. An existing channel cannot be made confidential later, because its history is already stored in a form we can read. Customers and design partners who are testing these features may have access to this functionality.

Agents

Automated agents you add to an interaction are members of it and can read what is posted there. Agents we operate on your behalf run on our infrastructure, which means the same access described above applies to them.

What we collect

We collect the data needed to operate the site, communicate with you, and provide our apps and services:

In the apps

• Account details: your email address, and your name if your identity provider supplies one.
• Workspace identity: a public key identifying you inside a workspace, and the private key our Keyring holds and signs with. You get a separate identity in each workspace you join, and they cannot be linked to each other from the outside.
• Device identifiers: an identifier the app generates and stores in the device keychain, and a separate signing key issued to each device you sign in on.
• Messages and files: what you write in channels and direct messages, channel names and descriptions, images and files you attach, your profile photo, and voice notes you record.
• Usage events: a small fixed set of product events: signing in, a device key being issued or renewed, a workspace session expiring, and feedback you submit. These carry your workspace public key and never your email, your name, or anything you wrote.
• Operational logs and errors: server-side error reports and performance traces about the software, kept briefly to diagnose faults.

A voice note you record is uploaded and stored with the workspace's other files, the same as an image. Live audio in a call is passed between participants as it happens and is not recorded or stored by us.

On the website

• Usage analytics: we use PostHog to see how people use this site. It records the pages you view and how long you stay, the page address and the website that linked you here, any campaign labels on the link, the clicks and scrolling on each page (which also build heatmaps), errors the page hits, how fast the page loads and how long its network requests take, and your browser, device, IP address and the approximate location PostHog derives from it. PostHog sets a cookie and local storage entry with a random identifier, so it can tell that later visits come from the same browser. It does not know your name or email unless you give them in a feedback session. Analytics starts when the page loads, and a notice at the bottom of the page says so. Choose Opt out on that notice and analytics stops and stays off in this browser. If your browser sends a Global Privacy Control signal, we treat it as an opt out and analytics never starts.
  Session replay is separate and starts only after you choose OK on that notice, or start a feedback session. A replay is a reconstruction of what the page showed and what you did on it. Everything you type into a form is masked in the replay, and replays never include the contents or headers of network requests or messages the page logs to the browser console. Session replays are deleted after 30 days.
• Feedback sessions: if we send you a link to give feedback on the site, a panel asks you questions about it. You choose whether to give your name, and optionally your email, or to stay anonymous under a random identifier. We keep your answers, the parts of the page you point at while answering, and a session replay of the visit, recorded as described above. Your answers and replay are linked to your name if you gave it. A feedback session records even if you opted out of analytics earlier, because you start it yourself after the panel explains what it records. Choose Not now and nothing is recorded for the session.
• Communication data: if you email us, use the chat messenger, or request access, we retain your communication. An access request includes the email address and decision context you choose to submit, together with the time and version of your consent. Access requests are stored in Cloudflare D1 and the contact is synchronized to our self-hosted Twenty CRM for review.
• How you found us: when you submit an access request, we store alongside it which of our own pages you first arrived on, which page you submitted from, the name of the website that linked you to us if there was one, and any campaign labels (such as utm_source) that were on the link you followed. We keep this so we can tell which of our pages are actually useful to people. It is stored whether or not you opted out of analytics, because a count that left out the people who opt out would be a misleading one.
  What this deliberately is not: we store the name of the referring website, never the full address of the page you came from, so a search you typed stays out of our records. We keep the name of one of our own pages only when it matches the shape of an ordinary page address on this site; anything else is recorded as/other instead. This record lives in your browser tab for the length of your visit and is sent only with the access request you deliberately submit. It is not a cookie, we do not share it, it sets no identifier that would recognise you on a later visit or on any other website, and it is deleted with the rest of your access request.
• Chat messages: whatever you type into the chat messenger, plus the technical metadata any web service sees when your browser connects to it, such as IP address, browser and device type, and the page you opened chat from. If you give us your email address or name inside a chat so we can reply, we keep that too. We do not pass your identity to the chat provider ourselves. The only thing we send it about you is whether you opened chat from the support page or from elsewhere on the site, so the conversation starts in the right place. Everything else it holds about you is what you chose to type.

Through the Modyl connector

The Modyl connector is the server at https://apex.modyl.to/mcp that ChatGPT, Claude and agents such as Claude Code and Codex connect to. It answers what your agents did and what is waiting for you. Using it, we collect:

• Your sign-in: you sign in through WorkOS, our identity provider. We receive your WorkOS user ID, and your email address and name if WorkOS supplies them. The first time you sign in we create a space of your own for your activity, named after your user ID, and record that you joined it.
• Every call the connector receives: we keep the whole request each time ChatGPT, Claude or another client calls the connector. That includes the name of the tool called and every argument passed to it, which can contain the text of your question or of the message you asked to send. With each call we keep the name and version the client reports (for example ChatGPT or Claude), its user agent, the protocol version, the app it was registered as, whether the call was answered or refused, and the reason for a refusal. These calls are recorded as activity in your own space, so you can see them like any other agent activity.
• What your agents send: if you connect a coding agent (the Claude Code plugin, Codex or another client), it sends the activity of its sessions: your prompts, the tools it ran with their inputs and results, files and other artifacts it produced, and the names of the machine and project it ran in. We keep what it sends so answers can cite it.
• Your answers and subscriptions: when you settle an escalation we keep your verdict, any note you add and who answered. When a client subscribes to events we keep the address it asked us to deliver them to and the secret used to sign them.

The connector reads only the spaces you have access to. A space of your own is visible to you and not to other users of the connector.

How we use it

• Improving the site from how people use it, including session replays, heatmaps and the answers people give in feedback sessions.
• Understanding which of our pages and links bring people who request access, so we can write fewer and better pages.
• Responding to your questions, support requests, or access requests.
• Answering the questions you or your agents ask the connector, and delivering the events you subscribe to.
• Keeping a record of calls and refusals so we can show you what was asked on your behalf, investigate abuse, and fix faults.

Third-party services

We use a small number of trusted third-party services to operate:

• PostHog: site analytics, session replay, heatmaps and feedback sessions, as described underUsage analytics.
• Intercom: the chat messenger and the support conversations held in it. A chat control is available on every page of this site. Intercom loads its own script from its servers and sets its own cookies, but only once you open the chat. If you never open it, no Intercom script runs and no Intercom cookie is set. Intercom processes chat data on our behalf as our processor and service provider, under its own privacy policy.
• Cloudflare: hosting and CDN.
• Telnyx: phone calls to Modyl and the text messages described under Text messages.
• Twenty: our self-hosted access-request CRM.
• WorkOS: sign-in for the Modyl connector.
• Cloudflare R2: a verbatim copy of each connector call and of what your agents send, kept alongside the database copy that runs in our own servers.
• AI model providers: some answers, such as asking where a piece of work belongs or asking about another agent's session, are composed by a language model. For those, the question and the captured records it draws on are sent to the model provider we route that answer through, currently Google Gemini.
• Composio: the connector layer that links Modyl to the tools you connect, such as your calendar or code host. It receives the requests Modyl makes to those tools on your behalf, under an opaque identifier rather than your name or email.
• LangChain (LangSmith): hosts the Modyl agent, routes its model calls and stores its traces. It receives conversation content, the agent's memory and those traces.
• OpenAI: the language model for a conversation when we route it directly rather than through LangSmith. It receives the conversation content sent as model input.
• Stripe: checkout, subscriptions and invoices. Stripe collects your billing contact and payment details on its own page.
• GitHub: only when your organization turns on the GitHub connector. It handles the repository content you authorize.
• Voice providers: when you talk to Modyl, your voice and what Modyl says back go through LiveKit, which runs the realtime voice room, and through the provider handling speech on that route: Deepgram for speech to text, ElevenLabs for text to speech, or Google Gemini Live for realtime speech.
• Research providers: when Modyl looks something up on the web for you, it writes the search query from your conversation, so a query can carry what you said. The query and the results go through the research provider handling that search: Exa, Tavily, Parallel, Valyu or Keenable. We have not yet confirmed zero-retention terms with any of them, so we do not promise that they delete queries.

We use Sentry for error tracking in the Blather app, as described under Blather. We plan to use Cloudflare R2, Intercom and PostHog for Modyl product data as well: R2 for storage and backups, Intercom for support with its Fin assistant, and PostHog for product analytics. They are named here before that use begins.

We do not sell your data to anyone. These services process data only as needed to provide their specific function.

Text messages

If you agree on a call with Modyl to receive texts, we keep your mobile number, the time you agreed and the words you agreed to. We use your number only to send the texts you agreed to, as described on modyl.to/sms.

We do not share or sell your mobile number or your text consent with any third party or affiliate for their marketing or promotional purposes. Telnyx, our phone and messaging carrier, processes your number only to deliver our texts.

Reply STOP to any text to stop them. We record the opt-out and send nothing more unless you reply START.

Cookies

We use a small number of cookies:

• Analytics: PostHog sets a cookie with a random visitor identifier so it can recognise later visits from the same browser. We also store whether you chose OK or Opt out on the analytics notice, so your choice persists.
• Chat cookies: Intercom uses cookies and similar storage to keep a chat conversation attached to you across pages and visits, so a reply reaches you rather than a stranger. These are set only after you open the chat, never on page load.
• Hosting platform cookies: this site is served by our hosting platform, Ploy, which sets its own cookies on every page load, before and independently of any choice you make about our analytics. ploy_anon_id is a persistent pseudonymous visitor identifier that lasts up to a year;ploy_session identifies a single visit. The platform records the page you are on and the address you arrived from, and uses the visitor identifier to keep any content experiment showing you a consistent version of a page. We do not control these cookies, we do not use them to identify you, and opting out of our analytics does not prevent them. Our content delivery provider also sets a security cookie (__cf_bm) to distinguish people from automated traffic.

We do not use advertising cookies, and we do not sell or share anything about your visit with advertisers. The hosting platform cookies described above are set by the platform that runs this site, not by us, and they are the reason we describe them here rather than claiming this site sets none.

Website data retention and deletion

We keep analytics and communication data for as long as needed to operate the site and respond to you. Chat conversations are held in Intercom, and we keep them there for the same reason we keep mail: so a later question can be answered against what was already said. We have not set a fixed automatic expiry on them, so assume a chat conversation persists until it is deleted on request. If you want your data deleted, including a chat conversation, email us at hello@modyl.to or ask in the chat itself, and we will remove it, from Intercom as well as from our own records, within 30 days.

How long we keep it

Messages and files are kept for as long as the workspace exists, unless they are deleted. Account details and your workspace identity are kept while your account exists. Device keys expire on their own and are reissued while you keep using the app, so a device you stop using loses its access when its key expires. Usage events and operational logs are kept by our providers under their own retention settings and are not needed to run your workspace.

Connector calls, your agents' activity and your answers to escalations are kept for as long as your account exists, with no fixed automatic expiry, unless you ask us to delete them. Event subscriptions are kept until the client that made them unsubscribes or you ask us to remove them.

Deleting your data

Email hello@modyl.to from the address you signed in with and we will action it and confirm when it is done. You can also ask for a copy of the personal data we hold about you, to correct it, or to object to how we use it, at the same address.

What deletion does and does not reach

We delete your account, your sign-in, the keys issued to your devices, and your name and profile photo. Two things survive, and we would rather say so than imply otherwise. Messages you have already sent stay in the workspace's history. The record is append-only and other members' copies are already on their devices, so removing them from everyone's view is not something we can honestly promise. And backups roll off on their own schedule, so data may persist in them for a period after deletion.

If you signed in with Apple and also want to stop Apple sharing your details with this app, open iOS Settings, tap your name, then Sign in with Apple. That relationship is between you and Apple and is not one we can end on your behalf.

Blather

Blather is an experimental app from Carcinize Corp: you talk, draw, and optionally show your camera or your screen, and an AI agent acts on a shared canvas. It is built to see and hear a lot, and it does not blur, mask or redact what it records. This section covers the Blather iOS app and its services. Everything else on this page is about Modyl.

What Blather collects

• Account: your email address, name, sign-in id, organization id if you have one, and the sign-in provider you chose (email and password, email code, Apple, Google, Microsoft or GitHub). Your email and ids are attached to your crash reports, product events, model traces and voice room. We use them to know who you are, to decide whether you may use Blather, and to find your data when you ask about it.
• Your voice: microphone audio and the words recognized from it, while a visit is live and the microphone is not muted. While a visit is paused, audio is recognized on your device and the last 30 seconds are kept in memory; they are sent only when you wake the agent.
• Camera frames: only while you turn the camera on.
• Your screen, including other apps and anything on it, and its sound when the broadcast carries it: only while you start screen sharing in the iOS screen-recording picker.
• Your canvas: ink, text, pictures, files, links and the projects the agent builds for you.
• What you do in the app: pen strokes, taps, the controls you use, your requests, and the agent's replies and actions.
• The Blather keyboard: text you type is read only when you tap Optimize, and the prompts you save or send from it. The keyboard types without Full Access; Optimize and sending to the app need it.
• Feedback you send: text and a screenshot.
• Diagnostics: crash and error reports, performance traces, device model, OS version, app version and IP address.
• Recordings of the app's screen: Sentry and PostHog session replay, with network requests and the console log, with no masking. Text you type, text the agent writes, pictures on the canvas, your camera preview and anything else the app shows are in them. Sentry also attaches a screenshot and the view hierarchy to errors and feedback. These recordings, and the log of each visit, are off until you say yes when you first open the app. A red dot shows while the app records, and you can stop it in Account. We use them to debug and improve Blather, and they are not shown to anyone outside Carcinize.

After you sign in, and before anything is sent, the app tells you which providers below receive your voice, camera, screen and canvas, and asks you to allow it. If a provider is added, it asks again. The microphone, the camera and screen sharing also stay off until you allow them in iOS, and you can turn each off in iOS Settings.

Who receives Blather data

We do not sell your data, show ads, or track you across other companies' apps or websites. Each provider is bound by its own terms, and we use it only to run and improve Blather.

• WorkOS (sign-in): your email, name, password (stored hashed by WorkOS) and sign-in events. The WorkOS environment is shared with Modyl's staging apps, so a Blather account is also a Modyl staging account.
• Apple, Google, Microsoft, GitHub: only when you choose them to sign in; they tell WorkOS your name and email.
• LiveKit Cloud: live audio, camera video and screen video between your device and the voice agent.
• Google (Gemini API, including Google Search): your recorded speech, the images from your camera, your screen and your canvas, and the words in your requests. Google turns speech into text, decides what the agent does, speaks the reply and may run web searches built from what you asked.
• fal.ai and OpenAI (image generation; the agent picks one per request): the prompt and reference pictures, including your own drawing over a picture, when you ask the agent to make or change a picture, an animation or an SVG. The results are stored with your canvas.
• LangChain's LangSmith gateway, a model relay, and the model provider behind them (Anthropic, or xAI when Anthropic is rate-limited): the text of a prompt you ask the keyboard to Optimize.
• Cloudflare: everything stored for you. That is the canvas room, uploaded and generated pictures and files, camera and screen frames the agent looked at, saved visit state, and the sandboxes in which the agent builds projects for you. Cloudflare also keeps request logs.
• LangSmith (LangChain): traces of the agent's model calls, which include the words you said and the images it was shown.
• Sentry: crash, error and performance data, profiles, screenshots, and the session replay recordings above.
• PostHog: product events, and the session replay recordings above.
• GitHub: an issue we open in a private repository for an error report, which can quote what the report holds.
• Apple (TestFlight): installs, crashes and the feedback you send through TestFlight.

How long Blather keeps it

• Pictures and files on a canvas are kept while a canvas uses them. A daily sweep deletes ones that no canvas uses, after a grace period.
• The saved state of a paused visit stops being readable 24 hours after it is saved, and is deleted within about 48 hours.
• Canvas rooms, projects, recordings, traces and diagnostics are kept until you ask us to delete them. Sentry, PostHog, LangSmith, LiveKit and Cloudflare also apply their own retention periods to the copies they hold.
• Your sign-in stays until you ask us to delete it.

Delete your Blather account and data

In the app, open Account and choose Delete account. Within 24 hours Blather deletes your visits, recordings, canvases, pictures, uploads and projects, closes your voice rooms, removes your admission and device credentials, signs you out everywhere, and asks LangSmith to delete the traces of your visits. If you have no Modyl organization, it also deletes your sign-in; because that sign-in is shared with Modyl's staging apps, that ends your access to them too. If you belong to a Modyl organization, it keeps your sign-in unless you choose "Also delete my sign-in".

Some copies we remove by hand after that, within 30 days: Sentry events and replays that carry your user id, and PostHog events and recordings. Cloudflare Workers Logs keep a request's log line for Cloudflare's own retention period, and the other providers above apply their own retention to what they hold. You can also emailhello@modyl.to from the address you signed in with, and we do the same.

Children

Blather is for adults. It is not directed to children, and we do not knowingly collect data from them.

Changes to this policy

If we make significant changes, we will post a notice on the site. Minor wording updates will be reflected in the “Updated” date above.