Privacy policy

Effective 12 July 2026 · Last revised 12 July 2026

This page explains how mosADD (the "Service") handles personal data. mosADD is built in the Swiss privacy tradition: our data practices are governed by Swiss data-protection law (FADP / revDSG), and because our infrastructure runs in the EU (Frankfurt) we also honour the GDPR for users in the EU/EEA. If you are in the United States, the U.S. state privacy rights section below describes your CCPA/CPRA and equivalent state rights. For requests related to your data write to privacy@mosadd.com.

1. Who is the data controller

The data controller for mosADD consumer accounts is mosADD Sàrl, Rte de la Galaise 33, 1228 Plan-les-Ouates, Switzerland. If you self-host the open-source mosadd OS, you are your own data controller — this policy then describes only the upstream code, not your deployment. Where you connect mosADD to your own workspace and invite others onto seats you pay for, you act as controller for those members' use within your workspace and we act as your processor for that workspace data.

2. What we collect

Account data

A sign-in identifier — an email is optional; internal and sovereign accounts sign in with a passphrase or PIN and no email is required
Display name and optional avatar
Authentication tokens (issued and validated by Supabase Auth)

Communications content

Direct messages (mDM) — end-to-end encrypted by default (X3DH + Double Ratchet via @mosadd/crypto); the operator stores only ciphertext and cannot read them
Mail (mAYL) — transport + at-rest encrypted, server-readable to enable threading and search (not end-to-end)
Push-to-talk and voice (mTALK / calls) — transport-encrypted; media is recorded only if you explicitly enable recording for a session
Channels (mIRC) — transport + at-rest encrypted, server-readable by design; visibility per channel policy (not end-to-end)

AI memory & RAG (your "second brain")

mosADD can build a searchable memory index so you and your agents can recall past context. There are two separate indexes with two different privacy guarantees:

Server-side index (not end-to-end encrypted). When you add content to your knowledge base — files you upload, mail (mAYL), channel (mIRC) messages, and call transcripts you choose to index — we generate text embeddings (vectors) and store them in our database (pgvector) scoped to your account, so search works across your devices. This content is server-readable by design and is not end-to-end encrypted. End-to-end-encrypted mDM plaintext is never sent to the server index.
On-device index (stays local). The desktop app can build a local index of your own machine's content (and, with your permission, local drives) using an on-device model. This index and its source content are stored on your device and are never uploaded to us.

Connectors (USB hub / Composio)

When you connect an external tool or account (for example through the USB connection hub, which uses Composio as an OAuth broker), you authorise a specific data flow between that third-party service and mosADD. We store the connection's authorisation tokens and metadata needed to keep the connector working; the third-party service is governed by its own privacy policy. You can disconnect a connector at any time, which revokes the stored authorisation.

Telemetry & threat radar

Device events emitted by the threat-radar (canonical event types) — used to protect your account from compromise
IP address (hashed before storage), user agent, and approximate region
Stack traces and error reports (only if you opted in)

Payment & subscription data

We use Stripe for hosted-hub billing and subscription seats. Card numbers are never received by mosadd servers; Stripe handles them end-to-end. We store a Stripe customer ID, a subscription state, and — for workspace plans — the seat count and the membership/roles of the users you add to those seats.

What we do NOT collect

We do not sell data to third parties, and we do not "share" it for cross-context behavioural advertising
We do not run advertising trackers (no Google Analytics, no Facebook Pixel)
We do not store passwords (Supabase Auth handles this with bcrypt); for E2EE accounts we also never hold your encryption keys
We do not access end-to-end encrypted message contents, and we do not use your content to train AI models

3. Legal basis (GDPR Art. 6)

Data category	Basis
Account, communications content	Contract (Art. 6(1)(b)) — needed to provide the service
Server-side RAG / knowledge index	Contract (Art. 6(1)(b)) — you asked us to index and recall it
Connectors (Composio / USB hub)	Consent (Art. 6(1)(a)) — you authorise each connection
Threat radar events	Legitimate interest (Art. 6(1)(f)) — account-security defense
Telemetry	Consent (Art. 6(1)(a)) — opt-in toggle in settings
Stripe billing & seats	Contract (Art. 6(1)(b))

4. Retention

Data category	Retention
Account	Until you delete the account
DMs / emails / channel messages	Default: forever; you can set per-thread TTL
mIRC ephemeral & mTALK content	Per-room TTL (default 24h)
Server-side RAG embeddings	Until you delete the source item or your account; removing a source removes its embeddings
Connector authorisations	Until you disconnect the connector or delete the account
Threat-radar device events	90 days for routine events; 7 years for NIS2-eligible events
Stripe customer IDs / seat records	Until you delete the account; subscription history retained 7 years for tax
Audit log (immutable)	7 years (NIS2 minimum)

5. Your rights (GDPR Art. 15–22)

Access (Art. 15): request a copy of your data
Rectification (Art. 16): correct inaccurate data
Erasure (Art. 17): delete your account — DMs, emails, threads and RAG embeddings are removed within 30 days; immutable audit log retains NIS2-eligible events as anonymised hashes
Restriction (Art. 18): ask us to pause processing
Portability (Art. 20): machine-readable export (JSON)
Object (Art. 21): opt out of legitimate-interest processing
Automated decisioning (Art. 22): threat-radar automated actions (account lock) can be appealed via appeals@mosadd.com for human review

Email privacy@mosadd.com to exercise any of these. We respond within 30 days.

6. U.S. state privacy rights (CCPA/CPRA & equivalents)

If you are a resident of California or another U.S. state with a comprehensive privacy law (e.g. Virginia, Colorado, Connecticut, Utah, Texas), you have the rights below. We honour them regardless of where you live.

Right to know / access: what personal information we collect, the purposes, and the categories of recipients (see §2 and §7).
Right to delete: request deletion of your personal information (subject to legal-retention exceptions such as the audit log and tax records).
Right to correct: fix inaccurate personal information.
Right to portability: receive a copy in a portable format (JSON export).
Right to opt out of sale or sharing: we do not sell your personal information and we do not "share" it for cross-context behavioural advertising, as those terms are defined by the CCPA/CPRA — so there is nothing to opt out of. We do not use or disclose sensitive personal information beyond the purposes permitted by the CCPA.
Right to non-discrimination: we will not deny service, charge a different price, or degrade quality because you exercised a privacy right.

To exercise any of these, email privacy@mosadd.com. We will verify your request against your account and respond within the statutory window (45 days for CCPA, extendable once). You may use an authorised agent. Because we do not sell or share personal information, we do not process "Do Not Sell" signals — but we honour Global Privacy Control (GPC) as an opt-out preference where applicable.

7. Sub-processors

Processor	Purpose	Location
Supabase	Postgres + Auth + Storage + Edge Functions + vector index	EU (Frankfurt)
Stripe	Subscription & seat billing	Ireland (EU) and US
Composio	Connector / OAuth broker for the USB hub (only for tools you connect)	US
Resend	Outbound email (mAYL + invites)	EU
LiveKit	Real-time voice & push-to-talk media routing (mTALK / calls); media is transient and not stored unless you record a session	Global edge + US contracts
Vercel	Website hosting (mosadd.com, mcp.mosadd.com)	Global edge + US contracts
Cloudflare	DNS + WAF	Global edge
GitHub	Source code, releases (public OSS only)	US
Sentry (when enabled)	Error monitoring	EU (Frankfurt)

For US-located processors (Stripe, Composio, LiveKit, Vercel, Cloudflare, GitHub), transfers use Standard Contractual Clauses and, where available, the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework.

8. Breach notification

In the event of a confirmed personal-data breach with risk to your rights and freedoms, we will notify the supervisory authority within 72 hours (GDPR Art. 33) and inform affected users without undue delay (Art. 34). Our process is published at github.com/Hei33enberg/mosADD/docs/security/incident-response.md.

9. Children

mosadd is not intended for users under 16. If you believe a minor has created an account, contact us and we will delete it.

10. Cookies and trackers

We use only first-party cookies strictly necessary for authentication. No analytics, no advertising, no cross-site tracking.

11. Changes

Material changes are announced in the in-app changelog at least 14 days before they take effect. The latest version always lives at mosadd.com/privacy.html. Past versions are kept in git history.

12. Contact & complaints

Data subject requests: privacy@mosadd.com
Security reports: security@mosadd.com
You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC), or, if you are in the EU/EEA, with your national supervisory authority. California residents may contact the California Privacy Protection Agency.