Privacy Policy

Who holds your data

Mpalo Inc. is the data controller. We are a Delaware Public Benefit Corporation, and our charter binds us to pursue, with honesty and precision, the question of what it means to preserve, represent, and augment a human mind. That sentence is legal text, not marketing, and it shapes this policy: memory data is treated as something held in trust, not as inventory.

Contact for everything privacy related: privacy@mpalo.com. Operational support runs through the support desk and its ticket system.

What we collect, concretely

No category below is hypothetical. Each names a real place our systems store something, because a policy that cannot name the storage cannot be honest about the data.

• Account basics. Your email address, a password verifier (bcrypt; we never hold the plaintext), an optional display name, an optional recovery email, and, if you add one, a phone number validated through Twilio's Lookup service at the moment you save it.
• Sign-in methods. If you use Google or GitHub sign-in, we hold the provider's account identifier and the email address it confirms, nothing else from the provider. If you create a passkey, we hold its public key. Passkeys involve no biometric data leaving your device.
• Multi-factor secrets. If you enable MFA, your authenticator secret is stored encrypted with keys that live only in our server environment, and recovery codes are stored as salted hashes. The plaintext codes are shown once, at generation.
• Your memory content. What you save through the Mind Platform: conversations, notes, recollections, and their metadata. This is the substance of the product and the most sensitive thing we hold.
• Billing. Payments run entirely inside Stripe. We store your plan state and Stripe's identifiers for subscriptions and invoices. Card numbers never touch our systems.
• Support. Ticket text and any files you attach, held so staff can resolve the request and so you can see the thread later.
• Security records. Login attempt outcomes, session entries (device, IP, timestamps), short-lived rate limiting counters, and revoked token identifiers kept until their natural expiry. These exist to notice attacks and to make logout stick.
• Email. Transactional mail (verification codes, security warnings, receipts) is delivered through Resend. Replies you send to support threads arrive as inbound email and join the ticket.
• Bot defense. Sign-in and signup forms run a Cloudflare Turnstile challenge. It verifies a human is present and builds no advertising profile.
• Your own connections. If you bring your own inference provider keys, they are stored encrypted and used only to serve your requests.

What we never do

• We do not sell user memory data. Ever.
• We do not run advertising, and we load no third-party analytics scripts on this site today.
• We do not train shared models on your memory content unless you have turned the training preference on in settings. It is your switch, it is visible in the product, and it is off the moment you turn it off.
• We do not read your memories to advertise anything to you, now or under future ownership. See decay below.

Where your data lives, and who touches it

The platform runs on Cloudflare's infrastructure: Workers compute, D1 relational storage, KV for short-lived security values, R2 for attachment files. The processors beyond Cloudflare are named above where they appear: Stripe for payment rails, Resend for mail delivery, Twilio for one-time phone validation, Cloudflare itself for Turnstile. Inference providers receive your prompts only when you send work to them through a connection you configured. None of these parties may use your data for their own purposes; each processes on our instruction as part of delivering the service.

How long things last

Retention follows function. Verification codes expire in minutes. Rate limiting counters and CSRF tokens expire within hours. Revoked tokens age out naturally. Status snapshots are pruned on a rolling window. Support threads persist while the account does, because losing the record of a promise would be worse than keeping it.

Memory content belongs to you. Deleting a memory removes it; deleting your account ends the subscription relationship and initiates removal of your stored content from active systems. Backups roll off on their normal schedule.

The Open Decay Protocol. If Mpalo is ever acquired or changes ownership, all user memory data is automatically deleted. It is not transferred to any acquiring entity. You cannot acquire Mpalo and receive its users' memories. This is charter text with engineering behind it, written down before anyone could ever want to test it.

Your choices

In the Mind Platform settings you control the switches that govern secondary processing: model training participation, anonymous diagnostics, and location metadata on saved context. Turning one off takes effect going forward immediately. You can view and delete individual memories, rotate credentials, end sessions remotely, and export what is yours. For anything else, including full account deletion, write to privacy@mpalo.com; a human reads that inbox.

You may access, correct, or delete your personal information regardless of where you live. We answer these requests ourselves rather than routing them through a form designed to discourage them.

Cookies

Exactly three kinds, all functional, none behavioral:

No Google Analytics, no pixels, no cross-site trackers. If that ever changes, this section changes first, in plain language, before any script loads.

Security practice

Passwords are bcrypt verifiers. MFA secrets are AES-GCM encrypted at rest. Sessions can be listed and revoked per device. Credential-changing routes require both your password and a fresh anti-forgery pair. Automated probes exercise the real sign-in pipeline every fifteen minutes and publish the verdict to the status page, so an outage of authentication is reported as one. When something breaks, we say what broke.

We do not currently hold SOC 2 or ISO 27001 certification and will not imply otherwise until we do.

Changes to this policy

Material changes get a new version on this page, a summary of what changed, and notice inside the product for signed-in users. The version history at the top of this document lists every published revision.

Contact

Mpalo Inc., Attn: Privacy.
Email: privacy@mpalo.com