Your data, explained plainly.

1. What we collect

We only collect what is necessary to provide and improve the service.

• Account information: email address and display name when you create an account or sign in via SSO.
• Usage data: pages visited, features used, timestamps — to understand how the platform is used.
• Technical data: IP address, browser type, device type — collected automatically for security and debugging.
• Content you create: projects, settings, and configurations you save while using Melyx tools.

2. How we use your data

• To authenticate you and maintain your session securely.
• To provide and personalise the features and tools you use.
• To send transactional emails (account verification, important notices) — no marketing email without consent.
• To monitor for abuse, security incidents, and service reliability.
• To improve the platform based on aggregate, anonymised usage patterns.

We do not sell, rent, or share your personal data with advertisers or data brokers.

3. Cookies & local storage

We use a minimal set of cookies required for the service to function.

• auth_token — an authentication cookie set after login. Expires in 7 days. HttpOnly and Secure. Required for access.
• refresh_token — keeps you logged in across sessions without re-entering your password. Expires in 30 days.

We do not use tracking cookies, advertising cookies, or any third-party analytics cookies that profile you.

4. Third-party services

Melyx uses a small number of external services to operate:

• OpenAI / Gemini / Groq / DeepSeek / xAI — AI generation. Your content is sent to these APIs to produce output. Each provider has their own data retention policy.
• Vultr — VPS infrastructure provider hosting all Melyx services. Data is stored on servers in Tokyo and Singapore.
• Emailit — transactional email delivery for account notifications.
• Stripe / PayPal — payment processing. We never see or store your card details.

We do not embed Google Analytics, Facebook Pixel, or any advertising SDKs.

5. Data storage & retention

• Account data is stored in a PostgreSQL database on Vultr VPS (Tokyo region).
• Backups are taken regularly and stored securely.
• Inactive accounts may be deleted after 12 months of inactivity with prior notice.
• Content you delete is removed from active storage promptly; it may persist in encrypted backups for up to 30 days before being purged.

6. Your rights

• Access: request a copy of all personal data we hold about you.
• Correction: ask us to correct inaccurate data.
• Deletion: request that your account and all associated data be permanently deleted.
• Portability: receive your content in a structured, machine-readable format.
• Objection: opt out of any non-essential processing.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

7. Contact & updates

Questions about this policy or how your data is handled:

• Email: [email protected]
• This policy may be updated from time to time. Changes will be posted here with an updated date. Continued use of the service constitutes acceptance.