privacy policy

Effective 2026-08-17. Mossbear is in private beta.The entity that operates Mossbear is being formed and is not yet named here. The practices below describe what the software actually does today, which does not depend on that filing — but if you need a named data controller before entrusting anything to it, ask before signing up.

what Mossbear syncs

Mossbear syncs account information, guides, guide files you choose to manage, evaluation verdicts, run metadata, token usage, and CLI connection state so the dashboard can show whether your agents followed your guidance.

what stays local

Mossbear's CLI is designed to keep raw hook logs, code file contents, and full conversation transcripts on your device. The dashboard receives verdicts and metadata, not your whole working session. See the live sync inventory.

service providers

—Fly.io hosts the application and database infrastructure.

—OpenRouter and OpenAI may process guide and evaluation context.

—Resend sends transactional email.

—PostHog provides product analytics and error tracking.

—GitHub provides OAuth login if you choose to sign in with it.

analytics

Product analytics are cookieless and anonymous by default. Persistent, identified analytics run only after you opt in. Server-side error reporting runs regardless, to keep the service working — it records what failed, not what you were writing.

retention and your rights

We keep account and product data while your account is active or as needed for security, operations, and legal obligations. You can export your data as a JSON download from Settings → Export my data, or permanently delete your account and all its data from Settings → Delete account. Both are self-serve and take effect immediately — you do not have to ask us.If you are in the EU, UK, or California, you have further rights — access, correction, portability, objection, and complaint to your local regulator. The export and delete controls above already satisfy access, portability, and erasure. For anything else, contact us.

contact

Beta testers were invited directly — reply on the channel you were invited through and it reaches a person, usually the same day. A published privacy address goes here when the operating entity is named.