Privacy Policy

Meldrix Agent ("Service", "We", "Our") respects your privacy and is committed to protecting the personal data you share with us. This Privacy Policy outlines what information we collect, how we process and store it, and your rights regarding your data.

We collect information necessary to provide AI chat assistance, repository context inspection, image generation, developer tool integrations, and account authentication:

• Account identifiers (email address, full name, avatar URL).
• Chat prompts, queries, and conversational message history.
• Uploaded context files, image attachments, and repository metadata.
• Developer tool connection credentials (Vercel Personal Access Tokens, Neon PostgreSQL connection keys, Slack OAuth tokens, Custom MCP server configurations, and Web API headers/keys encrypted server-side).
• Token usage analytics and subscription status records.

When you register, your primary email and profile data are stored securely in Google Firebase Authentication and Google Cloud Firestore. This information is used strictly to identify your account, manage subscriptions, and restore your chat history.

If you sign in using Google OAuth, Firebase requests permission to access your basic Google profile (email, name, and profile picture). We use this information exclusively to create and verify your user profile.

Meldrix also offers separate, optional Google service connections for Gmail, Google Drive, and Firebase Project Tools. These connections are independent from Meldrix/Firebase sign-in, so the Google account used for Gmail, Drive, or Firebase may be different from the account used to sign in to Meldrix.

• Gmail Data: Used only when you explicitly connect Gmail and request email actions such as searching, reading, drafting, or sending messages.
• Google Drive Data: Used only for requested file actions such as searching, reading, uploading, downloading, or organizing Drive files.
• Firebase Project Tools & Firestore Data: Used only when you explicitly connect your Firebase account via Google OAuth (requesting scopes https://www.googleapis.com/auth/firebase, https://www.googleapis.com/auth/datastore, and https://www.googleapis.com/auth/cloud-platform) or provide Service Account credentials. We access only the authorized projects and Cloud Firestore databases requested by you to inspect project metadata, list collections, read or query documents, and execute developer commands initiated by you in the chat interface or Firebase panel.
• No Commercial Exploitation: We do not use Gmail, Drive, or Firebase project data for advertising, sell it to third parties, or use it to determine creditworthiness or subscription eligibility.
• Security & Revocation: OAuth credentials and tokens are encrypted server-side with AES-256-GCM. You may revoke access at any time through your Google Account security settings (https://myaccount.google.com/permissions) or disconnect the service in Meldrix to immediately purge stored credentials.

Meldrix Agent provides workspace features that allow reading files, committing code changes, or creating repositories.

Meldrix Agent provides an optional Vercel integration that allows you to link your Vercel projects directly to your agent workspace. This integration is designed for developers who wish to monitor deployments, inspect build logs, view project environments, and trigger production or preview deployments from the chat interface and Vercel panel.

• Personal Access Token (PAT) Usage: When connecting Vercel, you provide your personal access token. This token is used exclusively to make authorized requests to Vercel's REST API on your behalf.
• Strictly User-Directed: Meldrix only queries deployment lists, triggers new builds, or retrieves deployment URLs when explicitly prompted by you or requested via the tools slider. We never modify project settings or deploy code without your authorization.
• Token Encryption & Storage: Your Vercel API tokens are encrypted server-side using AES-256-GCM prior to storage. Plaintext secrets are never stored in client-side web storage or accessible to other platform users.
• Zero AI Model Training: Source code, environment variables, build outputs, and deployment metadata received from Vercel APIs are never used to train, fine-tune, or improve foundational machine learning models.
• Revocation & Disconnect: You can disconnect your Vercel integration at any time directly in the tools slider. Disconnecting immediately purges all encrypted tokens from our servers. You can also revoke the personal access token at any time in your Vercel Dashboard (https://vercel.com/account/tokens).

Meldrix Agent features a dedicated Neon Serverless Postgres integration enabling users to connect their serverless Postgres databases, inspect table schemas, view database structures, and run analytical or developer queries via natural language.

• Connection Information & Secrets: You connect your database by providing a Neon API Key or PostgreSQL connection string (pooler/direct URL). These credentials are encrypted with AES-256-GCM before being stored in our database.
• Query Execution on Demand: Database queries, schema examinations, and table inspections are performed solely upon your direct prompt or action in the Neon panel.
• Ephemeral Data Handling: Query results and table preview rows returned by Neon are handled transiently in memory for the active conversation turn to assist with code and query generation. Meldrix does not copy, mirror, or permanently store your database rows.
• No Model Training on Database Contents: Data extracted from your Neon databases, including table structures, schemas, and row values, is never sold, shared, or used to train public AI/LLM models.
• Immediate Disconnect: You can disconnect your Neon database anytime from the tools panel. Disconnecting wipes the connection credentials from our servers permanently.

The optional Slack integration enables Meldrix Agent to interface with your Slack workspace, allowing you to send messages to channels, share generated code summaries, dispatch alerts, or interact with team conversations where authorized.

• OAuth Permissions & Minimal Scopes: We connect using standard Slack OAuth protocols requesting only the scopes strictly necessary for posting messages and reading public channels you explicitly authorize (such as chat:write and channels:read).
• Strict Privacy & No Passive Scraping: Meldrix does not passively read, crawl, or store your team's workspace messages or private communications. The agent only responds when invoked or when dispatching user-directed notifications.
• Token Security: All Slack OAuth bot tokens and team identifiers are encrypted with AES-256-GCM on our backend infrastructure.
• No Commercial Use or AI Training: Slack conversation snippets and team data are never shared with advertisers, sold, or used to train foundational AI models.
• Revocation & Bot Removal: You can disconnect Slack from the tools sidebar slider at any time. You can also revoke Meldrix's access immediately through your Slack Workspace App Management directory.

Meldrix Agent embraces the open Model Context Protocol (MCP) standard, allowing developers to connect custom or third-party MCP servers via Server-Sent Events (SSE), HTTP, or local transports to provide customized tools, databases, and enterprise data sources to the AI.

• Server Endpoints & Custom Headers: When configuring an MCP server, you provide the endpoint URL and optional authentication headers or API keys. These credentials are stored encrypted at rest (AES-256-GCM) and transmitted only to your designated server.
• User-Governed Tool Invocation: The agent only executes tools exposed by your connected MCP servers during chat when the conversation specifically requires that tool or when instructed by you.
• Payload Privacy: Payloads and schema definitions returned by your MCP servers are processed exclusively to answer your prompt. Meldrix does not retain MCP tool execution results or use them for machine learning model training.
• Endpoint Security Responsibility: Because MCP servers run on your own infrastructure or third-party hosts, you are responsible for ensuring your endpoints are secure and handle authentication properly.
• Total User Control: You can add, edit, disable, or delete any custom MCP server at any time from the MCP panel in the sidebar slider. Deleting a server immediately removes all its URLs and encrypted headers.

The Custom Web API tool allows you to register custom REST/HTTP endpoints with configurable HTTP methods (GET, POST, PUT, PATCH, DELETE), request headers, query parameters, and authentication tokens, enabling the agent to communicate with your internal or external web services.

• Credential & Header Encryption: All sensitive authentication headers (e.g. Bearer tokens, Basic Auth, custom API keys) registered with your custom endpoints are encrypted with AES-256-GCM before database storage.
• Execution Upon Explicit Need: Endpoints are only invoked when you test them directly in the Web API panel or when your chat prompt instructs the agent to query that specific API.
• Zero Payload Retention: Request bodies and API responses are processed transiently in memory for the active conversation turn. We do not index, retain, or store response payloads, nor do we use custom API response data for AI training.
• Full Management: You can create, edit, disable, or permanently delete custom API tools at any moment. Deleted endpoints are immediately purged from our servers.

Uploaded context files (code files, `.txt`, `.pdf`, `.doc`, images) are processed solely to provide requested AI completions and assist you with code editing.

Uploaded files are cached on high-speed CDN storage (Bunny Storage CDN) and passed to AI language model endpoints to generate answers.

When you submit a prompt, text, image, or repository snippet, the data is routed through secure HTTPS API pipelines to process the completion request using AI partners including Google AI, Vertex AI, Anthropic Claude, Alibaba Cloud (DashScope), OpenRouter, and Kie.ai APIs.

We calculate prompt length, token usage estimates, and message counts in your dashboard to help you track usage and active plan limits.

We use browser local storage and essential session cookies strictly to maintain authentication sessions, theme preferences (Dark/Light mode), and locally connected GitHub access tokens.

Our application services and API routes operate on secure, dedicated cloud infrastructure with industry-standard encryption protocols in transit and at rest. User data is stored in managed, access-controlled data stores hosted within secure cloud environments. For security reasons, we do not publicly disclose internal infrastructure identifiers, hostnames, or network architecture.

We implement industry-standard encryption protocols (HTTPS/TLS 1.3), AES-256-GCM encryption for integration secrets (Vercel, Neon, Slack, MCP, Custom APIs), token authorization checks, and Firebase Admin SDK verification on API routes to protect your communications against unauthorized access.

Meldrix Agent connects to state-of-the-art AI API providers and developer services to provide real-time assistance:

Depending on your location, you have rights to access, update, correct, export, or request the permanent deletion of your personal data and integration credentials stored on Meldrix Agent.

You can delete individual chat conversations at any time directly from the sidebar. You can also disconnect any integration (Vercel, Neon, Slack, Custom MCP, Custom Web API) directly from the tools slider to immediately purge all associated keys. If you wish to request full deletion of your account and associated Firestore user records, please email support@meldrix.com.

Meldrix Agent is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13.

We may update this Privacy Policy periodically. Any updates will be published on this page with an updated "Last Updated" date.

For privacy inquiries, account deletion requests, or data protection questions, please contact us: