Privacy Policy

1. Information we collect

Account and profile

We collect your email address, display name, public handle, profile settings, and account preferences. If you use a password, we store a salted password hash. We also maintain sign-in sessions, verification and recovery records, and account security information.

Your workspace and agent activity

We store content you provide or ask your agents to retrieve or create, including conversations, task instructions, documents and files, saved knowledge and memories, agent settings, approvals, results, and usage records. Voice features send audio to the selected voice service and may save transcripts and related task records in your workspace. Tools may retain source material, screenshots, or other evidence used to complete your work.

Connected services and credentials

When you connect an app or provide a service key, we process the connection details and the data needed for the actions you enable. Depending on your selections, this may include messages, calendar events, contact information, documents, or other service records. Service credentials are handled separately from ordinary conversation content; avoid pasting passwords or keys into chats.

Shared activity and technical information

We store friendship and sharing preferences, shared plans, and information you choose to exchange with other users or their agents. We also process technical information such as IP addresses, request and error logs, browser information, timestamps, and security and performance events.

Our application uses cookies for sign-in and security, and browser storage for interface preferences and drafts. Our website may load fonts and images from external hosts, which receive standard network information such as your IP address when those resources load.

2. How we use information

We use information to provide and secure your account; run the agents, tasks, voice sessions, and connections you request; preserve work and selected memories; support sharing you enable; measure service usage; troubleshoot problems; prevent abuse; and respond to support or privacy requests. We may also use records when required to comply with law.

Relevant instructions, conversation history, retrieved information, and tool results may be sent to the AI provider selected for a task. The context sent can include saved workspace knowledge or connected-service information relevant to that task. Review your agent permissions and sharing settings before supplying sensitive information.

We do not sell personal information or use Google user data for advertising. We do not use your private workspace content to train our own general-purpose AI models. AI providers process requests under their applicable terms and data controls; this policy does not promise that every provider or account configuration has identical retention or training settings.

3. Google sign-in and connected Google apps

For Google sign-in, we request basic identity permissions: your Google account identifier, verified email address, and basic profile information such as your name. We use these to authenticate you, prevent account takeover, suggest signup information, and associate your Google account with your Midnight Oil account. For Workspace accounts, we also check the domain claim supplied by Google.

We keep the Google account identifier and the account information needed for sign-in. We do not retain Google sign-in access tokens, refresh tokens, or ID tokens. Short-lived login verification information is encrypted and expires. Our infrastructure may temporarily log callback request information.

Connecting Gmail, Calendar, or another Google service is a separate authorization. We request the permissions shown in that connection flow and use the resulting data to provide the features and actions you select. Composio may manage the connection and tokens on our behalf. Information retrieved for a task may be stored in its records or sent to the AI provider needed to perform that task.

Our use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements where applicable. We do not use that information for advertising, data brokerage, credit decisions, or training generalized AI models. Human access is limited to purposes allowed by that policy, such as your permission for specific support, necessary security investigation, or legal requirements.

You can revoke access through your Google account’s third-party connections settings. Revocation prevents future authorized access but does not automatically delete information already saved in your Midnight Oil workspace. See the deletion choices below.

4. When information is shared

• Service providers: We use Google Cloud for hosting, database storage, and operational services; Temporal Cloud for workflow orchestration; Composio for managed app connections; Resend for account email; and selected AI providers, including OpenAI or Anthropic, to process AI requests. Each receives the information needed for its role. Other tools you choose may involve additional providers.
• Connected services: Information is sent to a service when you authorize a connection or an action, such as sending a message or creating an event. Those services maintain their own records and privacy practices.
• Other users: Your profile may be discoverable according to your settings. Shared plans, approved exchanges, and selected context are made available to the people or agents involved. Copies already received by others may remain after you stop sharing.
• Support, security, and law: The operator and authorized service personnel may access information as needed for requested support, maintaining the service, investigating security or abuse, and meeting legal obligations. Google data remains subject to the limits described above.

We do not publish private workspaces by default. Sending information to an external service or recipient can create a copy outside Midnight Oil’s control.

5. Storage and retention

We retain account and workspace records while needed to provide the service and your saved work. Retention depends on the record: short-lived authentication records expire automatically, task and conversation records can remain with your workspace, and logs, backups, and workflow records have separate retention schedules.

Deleting an account revokes account access and starts cleanup. Permanent workspace erasure is normally scheduled to begin after a one-hour delay and is processed by periodic housekeeping; failures can delay completion. This is not a promise that every copy disappears within one hour. We remove the active workspace and Google sign-in association through that cleanup process, while retaining minimal deletion and security records where needed.

Backup copies, infrastructure logs, and workflow metadata may remain until their retention periods expire. Records in connected services, AI-provider systems, or other users’ accounts are governed by those services and recipients. Contact us if you need help with a specific deletion request.

6. Your choices and rights

You can update available profile and sharing settings, control agent permissions, revoke connected-service access, and request account deletion in Settings. You can also contact logan@themediaside.com to request access, correction, a copy, or deletion of personal information, or to ask about a use of your information. We may need to verify your identity before acting.

Depending on the law that applies to you, you may have additional rights, including objection, restriction, portability, withdrawal of consent, or complaint to a privacy regulator. We will address requests under applicable law. Withdrawing a permission may prevent a feature from working; it does not undo actions already completed.

You can block cookies through your browser, but account and security features may stop working. Ending a voice call or closing a browser window does not necessarily cancel tasks or schedules you separately authorized.

7. Security and international processing

We use access controls, encryption in transit and for stored credentials, and separate workspace access to help protect information. No service can guarantee absolute security. Protect your credentials and contact us promptly if you suspect unauthorized access.

The hosted service operates on infrastructure in the United States. Our providers may process information in other locations according to their services and applicable data arrangements. Contact us about location or transfer requirements before submitting data subject to special restrictions.

8. Children and changes to this policy

Midnight Oil is intended for adults and is not directed to children under 18. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

We may update this policy as the service changes. We will post the revised policy with its effective date and provide additional notice when required. If a new use of Google user data requires renewed consent, we will request that consent before making the new use.