Privacy Policy

Myna is operated by Tiago Mouta, operating as Myna in Portugal. For the personal data of account holders described here, we are the data controller. Contact: [email protected].

This policy covers the Myna websites (myna.sh, docs.myna.sh, app.myna.sh), the API, asset delivery, and the official CLI, SDK, and MCP server. It does not cover the personal data that customers store inside their content or receive in bug reports — see Customer content below.

Account data from GitHub

Sign-in is exclusively through GitHub OAuth, with the read:user and user:email scopes. On sign-in we receive and store your GitHub user ID, username, display name, email address, and avatar URL. The OAuth access token is stored encrypted and is used only to refresh this profile information on later sign-ins.

Account activity and security data

• Browser sessions: an opaque session token (stored only as a hash), its creation, expiry, and last-seen times. You can list and revoke your sessions in the dashboard.
• Audit events: security-relevant actions (sign-ins, key creation, content and billing changes) recorded with the actor, the action, a request ID, and a one-way hashed form of the IP address. We do not store raw IP addresses in audit logs.
• Server logs: structured request logs containing the method, path, and request ID. Authorization headers, cookies, tokens, and request bodies are redacted and are not logged.
• Usage metering aggregated per organization (requests, bandwidth, storage).

Website analytics

The marketing and documentation sites record page views using Myna Analytics, our own product, in its storage-free mode. An event carries the page path (query strings are dropped, after any utm_ campaign parameters are read from them), the host of the referring site, a browser and platform family, a device class (desktop, mobile, or tablet), and your browser language. We store no IP address, no raw User-Agent string, no location, and nothing on your device — each visit is a new anonymous visitor, and there is nothing to recognize you by when you return.

Data you provide

• Organizations, projects, schemas, entries, revisions, change sets, and asset files you create or upload.
• API key names and labels, webhook endpoint URLs, and preview links.
• Email addresses of people you invite to an organization, used solely to deliver the invitation.
• Anything you send us in support or other correspondence.

Data your reporters provide

If you run Myna Feedback, people who file reports through your application send us — on your behalf — a title and description, any files they attach, the environment your application chose to include, and optionally an email address so you can reply. Submissions are rate-limited per source address using a keyed one-way hash, never a stored raw IP. See Customer content for who controls this data.

Billing data

Subscriptions are sold through Polar as merchant of record. We share your organization identifier and billing email with Polar and store the resulting subscription state (plan, status, period, and Polar identifiers). Payment card details go directly to Polar and its payment processors; we never receive them.

• No third-party analytics, advertising, or tracking scripts, pixels, or cookies — none.
• No browser fingerprinting, and no use of localStorage or sessionStorage.
• No screen recording, session replay, DOM capture, or console interception — including in Feedback, where a report is only what the reporter typed and chose to attach.
• No raw IP addresses in audit records (only a keyed one-way hash).
• No payment card data.
• No sale of personal data, and no sharing for advertising purposes.

• To provide the Service: authentication, authorization, hosting, and delivery of your content.
• To send transactional email via Resend from [email protected]: organization invitations, and — to whoever filed a bug report, if they gave an address — that their report arrived, that someone replied publicly, that a retest is being asked for, or that it was resolved. Internal notes never trigger a message.
• To operate billing and plan entitlements with Polar.
• To meter usage, enforce plan limits, and prevent abuse.
• To secure the Service and keep auditable records of security-relevant actions.
• To communicate with you about the Service, including changes to it or to these policies.

Where the GDPR or similar law applies, we process account data to perform our contract with you (providing the Service), for our legitimate interests (securing and improving the Service, preventing abuse), and to comply with legal obligations. We do not rely on consent for any current processing: the site analytics described above stores nothing on your device and identifies nobody, and we run no other tracking. The GDPR applies to our processing as an operator established in Portugal; other privacy laws may also apply depending on where you live.

We share personal data only with the infrastructure providers that run the Service, listed with their roles on the Subprocessors page (currently Railway for hosting, database, and storage, and Resend for transactional email), and with:

• Polar, as merchant of record for paid subscriptions, which acts as its own controller for payment processing, tax, and invoicing.
• GitHub, when you authenticate — governed by GitHub’s own privacy policy.
• The webhook endpoints your organization configures, which receive the event payloads you subscribe to.
• Authorities or other parties where required by law, or to protect the rights, safety, or property of Myna and its users.

The content, schemas, assets, and bug reports you store in Myna may themselves contain personal data. For that data, the customer organization is the controller and we process it only to provide the Service — storing it, rendering previews, delivering published content, and sending it to the webhooks the organization configures.

Bug reports are a distinct case, because the person who files one is usually not our user. When a customer collects reports through Myna Feedback, that customer is the controller of whatever the reporter sends — the description, any files attached, the environment the customer’s own application chose to include, and an email address if the reporter gave one for a reply — and we act only as their processor, on their instructions. We do not screenshot pages, record sessions, read the DOM, or fingerprint browsers; a submission is what the reporter typed and chose to attach, and nothing else.

If you filed a report through someone else’s application and want to access, correct, or delete it, contact that organization — they decide what happens to it. If you contact us instead, we will refer you to them and let them know you asked.

Content you publish becomes publicly accessible through the content API and asset delivery, and published assets carry long-lived cache headers, so copies can persist in third-party caches after unpublication. A data Business customers that require a data processing agreement should contact [email protected] before uploading personal data so the requirement can be reviewed and agreed in writing.

The Service runs on Railway infrastructure, including its application, PostgreSQL database, and object storage. Resend processes invitation emails and Polar processes billing data through their respective infrastructure. Where personal data is transferred outside the EEA, UK, or Switzerland, we rely on applicable adequacy decisions, contractual safeguards including Standard Contractual Clauses where appropriate, and the safeguards offered by each provider.

Connections to the Service use HTTPS. Session tokens, API key secrets, and preview tokens are stored only as one-way hashes; OAuth tokens and webhook signing secrets are encrypted at rest with AES-256-GCM; secrets are redacted from logs; and IP addresses in audit records are one-way hashed. The Security page describes our practices and how to report vulnerabilities.

Directly in the product you can:

• View and update your profile (it mirrors your GitHub profile on each sign-in).
• List and revoke browser sessions, and revoke API keys.
• Export an organization’s data (content, schemas, asset metadata, and recent audit events) as an archive from the dashboard.
• Delete organizations you own (30-day recovery window, then permanent deletion).

To delete your user account itself, or to exercise rights of access, rectification, erasure, restriction, portability, or objection that are not covered by the self-service tools, email [email protected]. We will verify the request against your signed-in account or GitHub identity and normally respond within 30 days, subject to extensions permitted by applicable law. If we ask you to remove data that an organization you belong to controls, we may refer you to that organization. You may also lodge a complaint with your local supervisory authority.

The Service is not directed at children and may not be used by anyone under 18. We do not knowingly collect personal data from children; if you believe a child has created an account, contact us and we will delete it.

We will update this policy as the Service evolves — for example, if our site analytics ever left its storage-free mode (which would also require updating the Cookie Policy and adding a consent mechanism). For material changes we will notify you by email or a prominent dashboard notice before they take effect.

Privacy questions and requests: [email protected]. We have not appointed a data protection officer or a separate EU or UK representative. As the operator is established in Portugal, no separate EU representative is currently required.