Privacy Policy for Mycolab

Last Updated: 16 September 2026

⚠️ Correction notice (15 September 2026)

Every previous version of this policy overstated our encryption. It described a "zero-knowledge

encryption architecture", said your conversations and code were "end-to-end encrypted on your device

before transmission", and stated that we "cannot decrypt your data even if compelled" using

"TweetNaCl (same as Signal)".

Those statements were not true of the software we ship. That text was inherited from the

upstream project this app was forked from (slopus/happy, which

does implement it) and was rebranded to Mycolab without being re-verified. In our build, the

encryption layer is a pass-through: content is serialized and transmitted, not encrypted by us,

and our servers can read it.

We are correcting this the moment we found it, rather than quietly softening the wording. If you

chose Mycolab because of the previous claims, **please read "What we can see" below and decide

accordingly** — we would rather lose your trust honestly than keep it on a false statement.

End-to-end encryption is planned, and the engineering analysis is public in

docs/E2EE-FEASIBILITY.md. **We will not claim it again until it

is implemented, and until the keys are genuinely outside our reach.**

Update (16 September 2026) — it now ships, for part of what we handle

End-to-end encryption is implemented and deployed. Chat messages and terminal output in newly

created sessions are encrypted on your devices under keys we never receive. This does not cover

session titles, project paths, machine names, timestamps, or uploaded file contents, and it does not

apply to sessions created before it was enabled — those stay readable by us, permanently.

The correction above stays on this page rather than being deleted. We claimed this once without

shipping it; the fix for that is not to quietly replace the retraction with a fresh claim, but to

leave both and let the dates speak. The precise boundary is on the

Security and encryption page, and "What we can see" below is written to match it.

Overview

Mycolab lets you run and observe AI coding sessions on machines you own, from a browser or phone. Your

session content travels through our servers (Hypha Mesh, running on Cloudflare) so that your devices

can reach your machines.

This policy describes what we actually do today.

What we can see

For sessions that are not end-to-end encrypted, we can technically read your session content. That

is every session created before encryption was enabled for your account, every session imported from a

previous install, and any new session created while one of your devices is not yet enrolled.

• Messages and code — your conversations with the coding agent, and any code or file contents that

appear in them, are stored on our servers in a form we can read.

• Terminal output — the output of commands run in a session, likewise.
• File contents — files you upload or that a session produces, stored in our object storage.
• Session and machine metadata — session titles, project directory paths, machine identifiers,

and lifecycle state.

For sessions that are end-to-end encrypted, the first two items above become ciphertext to us:

chat messages and terminal output are encrypted on your devices under keys we never receive. The last

two do not change — we can still see file contents, session titles, project paths, machine

identifiers, lifecycle state, and the timestamps and sizes of messages. Encryption narrows what we can

read; it does not make a session invisible to us. The full boundary is on the

Security and encryption page.

We do not read this content as a matter of practice, and access is restricted internally. But the

architecture does not prevent us from reading it, and it would not prevent a lawful compulsion order

from reaching it. **Please do not treat Mycolab as a confidential channel for secrets you cannot

afford us — or a party who compels us — to see.**

What protects your data today

These are real, and they are what we can honestly claim:

• End-to-end encryption, for chat messages and terminal output in encrypted sessions — encrypted

on your devices under keys we never receive. Scope, conditions and limits: [Security and

encryption](/security).

• Encryption in transit — all connections between your devices, our edge, and your machines use

TLS (HTTPS / WSS). Your data is not sent in the clear over the network.

• Encryption at rest — data stored on Cloudflare Durable Objects and R2 is encrypted at rest by

the storage provider.

• Workspace isolation — your data lives in a workspace that is a separate, single-tenant Durable

Object. Cross-workspace access is denied by default.

• Scoped, revocable tokens — access is granted by tokens bound to one workspace and one permission

level, revocable at any time; authorization fails closed.

• Open source — the implementation is publicly auditable, which is how this correction notice came

to be written.

What we collect

Content

As listed under "What we can see" — messages, terminal output, file contents, and session/machine

metadata. For encrypted sessions we hold the messages and terminal output only as ciphertext.

Operational metadata

• Identifiers — message, session, machine, workspace and device identifiers
• Timestamps — when messages and events were created and synchronized
• Account information — the email address you sign in with
• Connection data — IP address and standard request metadata, as any web service receives

What we do not collect

• Your Claude/Anthropic or other third-party API keys, beyond storing them where you explicitly ask us

to so that your sessions can use them

• Location data
• Advertising identifiers; we do not sell data or serve ads

Analytics

The app derives a pseudonymous analytics identifier from your credential. **This identifier is

linkable back to your account by us** — an earlier version of this policy claimed it was not, which

was incorrect for the current sign-in mechanism.

How we use data

• Content is stored and relayed solely to synchronize your sessions between your devices and your

machines. We do not use it to train models.

• Metadata is used for routing, ordering, presence, billing and abuse prevention.
• Audit records we keep about service calls contain identifiers, timestamps, decisions and

cryptographic digests — not message or file content.

Data retention and deletion

• Session content is retained until you delete it or delete the workspace containing it.
• Deleting a workspace removes its content and its stored objects.
• Operational metadata may be retained after deletion for a limited period for security and billing.

Your rights

Depending on where you live (including under the GDPR if you are in the EU/EEA/UK), you may have the

right to access, correct, export, or delete your personal data, to restrict or object to processing,

and to lodge a complaint with your supervisory authority. Contact us to exercise these rights.

International transfers

Our infrastructure runs on Cloudflare's global network, and your data may be processed outside your

country of residence, including in the United States. **We do not currently operate EU-only data

residency.** End-to-end encryption now ships and is available as a supplementary safeguard for the

content it covers — chat messages and terminal output in encrypted sessions — but not for the

metadata and file contents it does not cover, which still transfer in a form we can read. EU-only

residency remains on our roadmap; we will update this policy when it ships, and not before.

Third-party services

• Cloudflare — hosting, storage, and network (processor)
• Resend — transactional email for sign-in codes
• Anthropic / other model providers — when a session calls a model, the session's prompts and

context go to that provider under *their* terms and privacy policy, not ours

Changes to this policy

We will post material changes here with an updated date. Where a change corrects a previous

misstatement, we will say so explicitly rather than editing silently, as we have done above.

Contact

Open an issue at <https://github.com/oeway/hypha-mesh> or contact the maintainers listed there.