Privacy Policy

1. Scope

This notice covers the Mocha website, the app, and support communications. It does not cover third-party services you choose to connect; those services have their own privacy policies.

2. What we collect

• Account information. Your email address, plus the profile settings you choose: display name, assistant name, timezone, and voice or privacy preferences. Your password is handled by our authentication provider and is not visible to us.
• Your content. Conversations and messages, memories, projects and their decisions and updates, tasks, notes, knowledge files you upload and the text extracted from them, dashboards, scheduled workflows, notifications, and records of tool activity.
• Connected service data. If you connect a service, we access the data within the permissions you approve. Depending on the service, that can include email, calendar events, documents, spreadsheets, and tasks. Access and refresh tokens are encrypted before storage.
• Technical information. IP address, browser and device type, timestamps, and error or security logs created by our hosting, database, and storage providers when you use the service.
• Browser preferences. Sidebar state, whether you dismissed a notice, and an in-progress focus timer are stored in your browser’s local storage. They are not cookies and are not sent to us.

3. How we use information

We use this information to:

• create, authenticate, and secure your account;
• generate replies and propose memory candidates;
• search content you own when you ask a question;
• run scheduled workflows and deliver in-app notifications;
• show activity history and request approvals for actions;
• debug problems, prevent abuse, and protect the service;
• respond to support and legal requests;
• enforce our terms and comply with applicable law.

4. AI processing

To generate a reply, Mocha sends the relevant part of your request, along with the context selected for that turn, to a third-party AI model provider. Context can include recent messages, approved memories, project details, knowledge passages, and results from connected services.

Your privacy mode controls this. Before a cloud request, the context preview shows what will be sent and lets you exclude memories, projects, tools, or services. In modes that block cloud processing, the request is not sent to a cloud provider.

We do not use your content to train AI models ourselves. Third-party providers process requests under their own terms and may retain or handle data according to their policies. Review the context preview before sending sensitive information.

5. Connected services

If you connect a service, we exchange data with it on your behalf within the permissions you grant. Connection results are treated as reference data and are not trusted as instructions. You can disconnect a service in Settings, which stops future access.

6. Cookies and local storage

We use a strictly necessary cookie to keep you signed in. We do not use advertising cookies, cross-site tracking, or third-party analytics. The Cookie Notice lists what is stored and how to clear it.

7. How we share information

We do not sell your personal information, and we do not share it for advertising. We share it only with:

• Service providers that host and operate the service, including hosting and content delivery, database, authentication, file storage, and email delivery providers.
• AI model providers, when a feature sends a request for processing.
• Services you connect, when you use a feature that reads from or writes to them.
• Authorities or other parties when required by law, valid legal process, or to protect rights, safety, and security.
• A successor organisation if the service is transferred, merged, or sold, subject to this notice.

These providers process information on our behalf or, for services you connect, under their own terms.

8. Retention and deletion

Your content stays until you delete it or delete your account. Removing a memory, note, task, project, conversation, or knowledge source deletes it from the active service.

When you delete your account, we delete your account record, your stored content, and your uploaded knowledge files. Residual copies may remain for a limited period in provider backups until normal backup rotation removes them. Providers may retain operational logs under their own policies.

9. Security

We protect data with encryption in transit, encryption of stored service credentials, and per-user access controls that limit each account to its own rows. No system is perfectly secure, so use a strong, unique password and tell us about suspected unauthorised access.

10. Your choices

In Settings you can:

• download a JSON export of your data;
• delete your account and its content;
• disconnect any connected service;
• change your privacy mode and manage memories;
• update your profile and voice preferences.

You can also email joeulam@bu.edu to request access, correction, or deletion, or to ask a question about this notice. We may need to verify that you control the account before acting. If the law where you live gives you additional rights, contact us and we will review your request.

11. Children

Mocha is not directed to children under 16, and you may not create an account if you are under 16. If we learn that an account belongs to someone under 16, we will delete it.

12. International processing

Mocha is operated from the United States. Our providers may process information in the United States and in other countries where they operate. Privacy laws in those places may differ from those where you live.

13. Changes

We may update this notice. The date at the top of the page shows the latest version. If a change materially affects how we use your information, we will give notice by email or in the app where we reasonably can.

14. Contact

Privacy questions or requests: joeulam@bu.edu.