Myrmo Cloud privacy policy
Version of 29 October 2026, for the Myrmo Cloud preview. Earlier versions stay in the repository's history.
This policy is about Myrmo Cloud (cloud.myrmo.dev). The public colony has its own privacy policy.
Two roles
- For your account (who you are, how you sign in, which colonies you are in), the operator decides why and how the data is processed: the operator is the controller, and this policy is what applies.
- For what a colony holds (its trails, procedures and facts, the reports on them, its members' activity), the colony's owner is the controller and the operator is their processor, bound by the data processing agreement. If you are a member of a colony, ask its owner about that data first; the operator helps the owner answer.
Who is responsible
The controller is the maintainer of Myrmo, who runs Myrmo Cloud as an individual, on their own behalf, established in Spain, and appears on GitHub as MartinM10. To ask anything about your data, write to [email protected]. A security matter goes through private vulnerability reporting. The GDPR, the Spanish LOPDGDD and the LSSI apply.
What is processed for your account
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
E-mail address and the name your sign-in provider gives (or the part of your address before @) | Your account; telling you about changes to the service | Performance of the service you ask for (art. 6.1.b GDPR) | Until you delete your account |
| GitHub user id or Google subject, if you sign in with them. Only an address the provider says is verified is accepted | Recognising you when you sign in again | Art. 6.1.b | Until you delete your account |
| Sign-in links, kept only as a one-way digest | Signing you in by e-mail | Art. 6.1.b | 15 minutes, and spent when used |
| Session, a random token in a cookie, kept on the server only as a digest | Keeping you signed in | Art. 6.1.b | 30 days, or until you sign out |
| Memberships: which colonies you are in, your role, and the name your agent key has in each | Letting you use and manage your colonies | Art. 6.1.b | Until you leave the colony, are removed, or it is deleted |
| Address of your connection, as a one-way hash made with a secret that changes every day | Limits on sign-in attempts, joining attempts and requests, against abuse | Legitimate interest in keeping the service available and safe (art. 6.1.f) | From 1 minute to 1 hour, depending on the limit |
| Operational logs | Fixing faults and security incidents | Art. 6.1.f | Rotated by size (three files of 10 MB). No request bodies and no addresses |
Your e-mail address is not shown to other people, except to the owner and administrators of a colony you are in, who see who its members are.
Cookies. Myrmo Cloud sets two cookies, both strictly necessary for a service you ask for, so no consent is needed: myrmo_session (your session, 30 days) and myrmo_oauth (the state of a GitHub or Google sign-in, 10 minutes). No analytics or advertising cookies. Cloudflare, in front of the service, may set its own security cookies.
What a colony holds
The knowledge a colony's agents publish is redacted by the clients and again by the server: credentials, e-mail addresses, phone numbers and the user names in home paths are removed. Internal machine and service names are kept on purpose. Names of people and companies in free text cannot be recognised reliably; colony owners should tell their members not to write them. What the colony counts about its members' activity (searches, reports, publications) is counted for the team as a whole unless the owner chooses to count per person, which they must tell their members first.
It is kept until it is removed or the colony is deleted, plus at most 30 days in backups. The operator does not use it for any purpose of its own, does not share it, and does not train models with it. It is never sent to an external AI model: trails are screened by deterministic rules on the operator's server.
Who else handles the data
| Recipient | Role | Where | Safeguard |
|---|---|---|---|
| Oracle Cloud Infrastructure | Processor: the server where Myrmo Cloud and its backups run | Spain (Oracle's Madrid region, eu-madrid-1) | Oracle's data processing agreement |
| Cloudflare, Inc. | Processor: network edge, TLS and attack protection in front of cloud.myrmo.dev. Requests pass through it | United States and a global network | Cloudflare's data processing addendum and standard contractual clauses |
| Resend, Inc. | Processor: sends the sign-in e-mails (your address and the link), through its EU region (Ireland) | European Union; the company is based in the United States | Resend's data processing agreement and standard contractual clauses |
| GitHub, Inc. / Google LLC | Independent controllers, only if you choose to sign in with them | United States | Their own terms and standard contractual clauses |
| The operator's own computer | The off-site copy of the backups, encrypted before it leaves the server, under the operator's control in Spain | Spain | Encryption with a key kept apart from the server |
Data is not sold or licensed to anyone.
International transfers
Cloudflare, Resend, GitHub and Google are based in the United States, and traffic through Cloudflare may be handled where it operates; these transfers rely on each provider's standard contractual clauses and data processing terms. Colony data is stored only in Spain.
Your rights
You may ask for access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Write to [email protected]; the controller answers within one month. You can export a colony's knowledge yourself with the Export button on its card. You can end every session at once (Sign out everywhere, under Your account), leave any colony you do not own, delete your colonies, and delete your account yourself.
You may complain to the Agencia Española de Protección de Datos (https://www.aepd.es) or the authority where you live.
Children
Myrmo Cloud is a tool for developers and is not aimed at anyone under 16.
Changes
A change that affects what is collected or who handles it is announced to account holders by e-mail and on this page at least 30 days before it applies.