Privacy Policy

Scope

This policy covers the morigraph website, console, hosted MCP service, and related support. morigraph can serve a personal workspace or a team workspace. Information placed in a team workspace may be available to its authorized members and their connected assistants.

Information we handle

• Account and workspace information: sign-in identity, email address, profile details, workspace membership and roles, and authentication records.
• Content you save: memory, workspace context, files, skills, procedures, and the metadata needed to search, version, and display them.
• Connections you enable: service configuration, permissions, credentials or OAuth tokens, tool requests, and results needed to perform calls to your connected services.
• Skill runs and the Telegram assistant: if you run a skill in morigraph or message mori's Telegram bot, the instructions, messages, attachments, and tool results that run or conversation needs.
• Operations and billing: tool usage, credits, audit events, subscription information, support requests, and limited diagnostic reports. Payment card details are entered with our payment processor, not into morigraph's own card form.
• Website activity: request and device information needed to operate and secure the service. On the production website, we may use product analytics and sampled session recordings with text and inputs masked.

How we use it

We use this information to authenticate users, provide the workspace and MCP tools, retrieve saved knowledge, run connections and included capabilities you choose to use, calculate usage and billing, troubleshoot problems, protect the service, and respond to support requests.

When an assistant calls morigraph, the relevant tool request and response pass through morigraph. Content returned by a tool is made available to the assistant or client you connected. That client's handling of the result is governed by its own policies.

morigraph saves what you or your assistant ask it to save, such as a memory, file, or skill. It does not read your assistant's own memory, chat history, or conversation summaries, and it does not collect conversation content beyond what a tool request contains.

Connected services use your own account

When you connect a service such as GitHub, Google Drive, Google Docs, Google Sheets, Google Forms, Gmail, Grafana Cloud, PostHog, X, Instagram, LinkedIn, or CapCut, morigraph acts as the account that was connected, never as an account of its own. It calls the service's official API or MCP server with the authorization that account granted, usually an OAuth sign-in on the provider's own consent screen, or a credential entered for that service. A personal connection is your own account. A shared team connection is the account a workspace administrator connected for the team.

• morigraph calls a connected service when you, an assistant you connected, or a skill run you started or scheduled uses one of its tools. It also makes the checks needed to list the service's tools and confirm the connection works. It does not crawl, copy, or sync your data on that service in the background.
• A call can reach only what the connected account can reach, within the permissions it approved. A personal connection is used only for you, even inside a team workspace.
• The service receives the request needed for that call and handles it under its own terms and privacy policy. morigraph keeps the connection's credentials and a record of each call, including a short excerpt of the request and response (see Retention). It does not keep a copy of your data on that service.
• Some connected services, such as X, have API usage that morigraph pays for and meters in workspace credits. The calls are still made as your account.
• You can disconnect a service in the morigraph console at any time, and revoke morigraph's access from the provider's own account settings.

When information is shared

morigraph sends data to a connected service when you enable its connection and a tool is invoked, as described above. Included capabilities send the query, web address, prompt, or image you supply to the provider that serves the request. Current providers include Exa, Tavily, and TinyFish for web search and reading web pages, and Stability AI for images. The console shows which capabilities are available and their prices before they are switched on.

We also use these service providers, each receiving only what its part of the service needs:

• Anthropic: runs skills you start in morigraph and the Telegram assistant on Claude models. It receives that run's instructions, messages, and tool results.
• Google: handles “Sign in with Google”. It shares your name, email address, and profile picture with morigraph.
• Telegram: delivers messages between you and morigraph's bot, if you use it.
• Grafana Cloud: stores the service logs and metrics used to operate and troubleshoot morigraph, such as requests, errors, and timings.
• Stripe: processes payments.
• Resend: delivers morigraph's emails, such as invitations.
• PostHog: production-site analytics, with text and inputs masked in session recordings.
• Discord: receives a limited diagnostic when an assistant submits a morigraph defect report. The report text is kept in morigraph for a limited period.
• Hosting and operations: the infrastructure that runs morigraph and stores its data.

We do not sell personal information or use your content to train AI models. We may also disclose information when required by law or to protect the service and its users.

Public file links are accessible to anyone who has the URL until they expire or are revoked. Only create or share such links for content you intend to make accessible in that way.

Retention and deletion

Saved workspace content remains available while it is kept in the workspace. You can remove individual memories, files, skills, and connections using the available controls. Audit history is retained for the period shown by the workspace's plan. Limited agent defect reports are pruned after 30 days. Billing and security records may be retained longer when needed for accounting, fraud prevention, or legal obligations; backup copies, where used, may take additional time to expire.

To delete your account or a workspace you own, email us from the address on the account using the contact below. We delete the account and its workspace content, including memories, files, skills, and connection credentials, within 30 days of verifying the request. Backup copies expire within a further 30 days. We keep only the billing and security records described above, for as long as those obligations require.

Your controls

• Choose which connections and included capabilities to enable, and disconnect services you no longer want morigraph to access.
• Review and edit workspace context, memories, files, and skills in the console, subject to workspace permissions.
• Ask us for help accessing, correcting, exporting, or removing your information.

Security

morigraph uses workspace access controls and protects stored connection credentials. No online service can guarantee absolute security. Please avoid placing passwords or other secrets in memory, files, support messages, or bug reports unless the feature explicitly requires them.

Changes and contact

We may update this policy as morigraph changes. The date above identifies the current version. For privacy questions or data requests, email joven@joinbrainlet.com. See our support page for help.