Privacy Policy

Last updated: 2026-07-21

This Privacy Policy explains how Desiderata LLC ("Desiderata," "we," "us," or "our") collects, uses, and shares information when you use Moldable (the "Service").

Capitalized terms not defined in this policy have the meanings given in our Terms of Service.

Moldable is designed as a local-first application—most of your data stays on your machine. This policy describes what limited information we may collect and how we handle it.

TL;DR (friendly summary)

This section is a convenience summary. The full Privacy Policy below controls.

Moldable is local-first by default: your apps, data, and configurations are stored on your machine unless you choose a hosted feature.
A Moldable account stores basic identity, authentication, session, device, and service records needed to provide account-based features.
Sync is currently in beta. If you enable it, the files and data covered by your Sync setup are copied to hosted systems so they can be restored and synchronized across your devices. Sync data is encrypted in transit and at rest with server-managed encryption; it is not end-to-end encrypted.
Sync can include apps, workspaces, conversations, settings, app data, and other folders you add. Common secrets and machine-only files are excluded where possible, but you remain responsible for what you place in synced locations.
We do not currently offer paid services or collect payment information. If that changes, we will update this policy and identify the payment processor before collecting billing information.
Moldable Artifacts is a hosted publishing feature. If you publish an Artifact, the Artifact files and metadata are stored online and served at a public, unlisted URL.
Our website (moldable.sh) uses Plausible Analytics (cookie-less, privacy-respecting) to understand basic website usage.
We don't receive your locally stored apps, code, or personal data unless you choose to transmit them through Sync, another hosted feature, a support request, or a third-party integration.
When you connect third-party services (AI providers, MCPs, etc.), those interactions are governed by each service's privacy policy.
Google API data (like Google Calendar) is stored locally on your device, not on our servers. Our use of Google data complies with Google's Limited Use requirements.
You can contact hello@moldable.sh to exercise privacy rights or ask questions.

1. Who We Are (Data Controller)

Desiderata LLC is the entity responsible for processing personal information described in this Privacy Policy (the "data controller" in some jurisdictions).

2. Local-First Architecture

Moldable is designed to keep your data on your machine:

Apps and code you create are stored locally in ~/.moldable/
App data (databases, files, etc.) is stored locally
Configurations and preferences are stored locally
Conversation history with the AI assistant is stored locally

We do not receive this locally stored data by default. It leaves your machine only when you choose or configure a feature that transmits it (for example, enabling Sync, pushing to GitHub, publishing an Artifact, contacting support, or connecting a third-party service).

3. Information We Collect

3.1 Information you provide

Contact information: If you contact us for support, we may collect your email address and the content of your communications.
Account information: If you create an Account, we collect your name, email address, password hash, Account identifiers, and the information needed to authenticate and administer your Account. We do not store your plaintext password.
Sync content and configuration: If you enable Sync, we collect and host Synced Content together with filenames, folder paths, workspace, app and device identifiers, versions, conflicts, storage usage, exclusions, and other information needed to back up, restore, and synchronize it.
Future billing information: We do not currently offer paid services. If we introduce them, we may collect the plan, billing period, storage allowance, subscription status, payment-processor customer identifiers, invoice identifiers, amounts, currency, payment status, and transaction history needed to administer the purchase. Payment-card details would be collected by the payment processor; we do not intend to store full payment-card numbers.
Feedback: Suggestions or feedback you voluntarily submit.
Published Artifact content and metadata: If you publish through Moldable Artifacts, we collect the files, title, artifact type, entrypoint, file manifest, versions, public slug, source app/workspace metadata you provide, and other metadata needed to host and serve the Artifact.
Publishing credentials and security data: To authenticate publishing, we may store public keys, key identifiers, labels, request timestamps, nonces, signatures, upload session data, file hashes, and audit or abuse-prevention records.

3.2 Information we may collect automatically

Website analytics: Our website (moldable.sh) uses Plausible Analytics to measure aggregate website usage (for example, page views and referrers). Plausible is designed to be cookie-less and to avoid collecting personal data. Learn more: https://plausible.io/data-policy.
Download metrics: When you download the application from GitHub or other distribution platforms, those platforms may collect basic metrics (such as download counts).
Artifact Service operational data: When you publish, update, unpublish, or access hosted Artifacts, we and our infrastructure providers may process technical and operational information such as IP address or derived approximate location, user agent, request path, timestamps, referrer, response status, bandwidth, rate-limit events, security events, and similar server/CDN or service records.
Account and Sync operational data: When you sign in, connect a device, sync, restore, or manage hosted data, we and our infrastructure providers may process IP address, user agent, request and event timestamps, session and device identifiers, token and grant identifiers, file or folder paths, object identifiers and hashes, byte counts, change types, synchronization status, errors, rate-limit events, security events, and similar service records.

3.3 Information we do NOT collect

The content of apps you create, unless you sync, publish, or otherwise transmit that content through the Service
Your code or generated code, unless you sync, publish, or otherwise transmit it through the Service
Your local files or databases, unless you sync, publish, or otherwise transmit them through the Service
Your conversation history with the AI assistant, unless you enable a hosted feature that includes it or otherwise choose to share it
API keys or credentials you configure locally, except where a hosted feature requires server-side credentials that you intentionally provide to us

3.4 Third-party AI services

When you use AI features in Moldable, your prompts and queries are sent to third-party AI providers. These interactions are governed by the third-party provider's privacy policy. We recommend reviewing their policies:

Anthropic: https://www.anthropic.com/privacy
OpenAI: https://openai.com/privacy
OpenRouter: https://openrouter.ai/privacy

Be mindful of what you share with AI providers. Avoid including sensitive information (passwords, API keys, personal data) in prompts unless you understand how the provider handles that data.

4. How We Use Information

We use the limited information we collect to:

Provide and improve the Service
Create and administer Accounts; authenticate users and devices; maintain sessions; and prevent unauthorized access
Back up, synchronize, restore, meter, troubleshoot, and secure Sync data across authorized devices
If we introduce paid services, administer plans, process purchases, issue invoices, prevent payment fraud, handle cancellations, and maintain financial records
Respond to support requests
Send important updates about the Service (if you've provided contact information)
Host, cache, serve, version, update, unpublish, and secure Artifacts
Authenticate publishing requests, prevent replay, enforce limits, troubleshoot, measure basic service usage, investigate abuse, and protect the Service and users

4.1 Legal bases where required

Where a law such as the GDPR requires a legal basis, we generally process information:

To perform a contract with you, including providing Accounts, Sync, Artifacts, support you request, and any future paid service you choose to purchase
For our legitimate interests, including securing and improving the Service, preventing fraud and abuse, troubleshooting, and understanding basic service usage, where those interests are not overridden by your rights
With your consent where we specifically ask for it, in which case you may withdraw consent for future processing
To comply with legal obligations and establish, exercise, or defend legal claims

5. How We Share Information

We may share information:

With service providers that help us operate the Service (for example, hosting, support tools)
With infrastructure providers that host, store, cache, route, secure, or deliver the Service, including Moldable Artifacts
Across your authorized devices when you enable Sync, so Synced Content and its current state can be restored and synchronized
With a future payment processor such as Stripe if you choose to buy a paid service
Publicly when you publish Artifacts: Artifact content and metadata may be made available to anyone with the Artifact URL and may be copied, shared, indexed, archived, or cached by third parties
For legal reasons if required to comply with law, or to protect rights, safety, and security
In connection with a business transfer such as a merger, acquisition, or sale of assets

We do not sell your personal information.

6. Third-Party Services

Moldable may integrate with third-party services. When you use these integrations, your data is subject to the third party's privacy policy:

AI providers: Anthropic, OpenAI, OpenRouter, or other AI services you configure
Infrastructure providers: Cloudflare and other providers we use for hosting, storage, databases, CDN, security, rate limiting, and related infrastructure
Future payment processors: Stripe or another processor identified before you purchase a paid service
MCPs: Model Context Protocol servers you connect
Other services: Any third-party services you choose to integrate (e.g., calendar APIs, databases)

We encourage you to review the privacy policies of any third-party services you use.

7. Moldable Accounts and Sync

7.1 Accounts and authentication

Accounts use email and password authentication. We store a password hash rather than your plaintext password. We also process session cookies, device-bound credentials, authorization grants, and security records to keep you signed in, connect authorized devices, and protect hosted features.

7.2 What Sync stores

When you enable Sync, the Service may host apps, workspace data, conversations, settings, app data, other files or folders you add, and related metadata covered by your Sync configuration. Sync is designed to exclude certain environment files, credentials, certificates, dependencies, caches, logs, temporary files, and machine-specific state, but those rules cannot identify every sensitive file. You remain responsible for reviewing what you place in synchronized locations and avoiding secrets or regulated data unless the Service is expressly designed for them.

7.3 Encryption and access model

Sync encrypts data in transit and at rest using server-managed encryption. Sync is not end-to-end encrypted: our systems and infrastructure providers may be technically capable of processing plaintext when necessary to operate, secure, troubleshoot, restore, or comply with law. Access is limited to authorized purposes and personnel, but no storage or transmission system is completely secure.

7.4 Your choices and deletion

You can use available local features without creating an Account and can choose whether to enable Sync. These choices have different effects:

Turn off Sync for a location: Local files are designed to remain on that device. After any undo period shown in the Service, the current Hosted Copy for that location may be permanently removed.
Disconnect or sign out a device: Sync stops on that device, but local files already on it and the Hosted Copy in your Account normally remain.
Add an ignore or exclusion rule: Matching files normally remain local but may be removed from the current Hosted Copy. That hosted deletion may reach other connected devices.
Make a file or folder online-only: Where this feature is available, a verified local copy may be removed while the Hosted Copy remains.
Delete your Account or hosted data: You may request deletion at hello@moldable.sh or use an in-product deletion control where available.

Deletion may take time to propagate through limited history, backups, logs, security records, deletion records, and disaster-recovery systems. We may retain limited records where reasonably necessary for legal compliance, fraud prevention, dispute resolution, or security. A retained log or historical record is not a recovery service and may not be available to you.

7.5 Storage limits and incomplete uploads

If a storage or other limit prevents a file or change from being hosted, it may remain only on the device where it was created. We process storage usage, pending-item status, and error information to enforce limits and show Sync status. You should not assume that every local change has a Hosted Copy merely because Sync is enabled.

8. Future Billing and Payments

We do not currently offer paid subscriptions, storage add-ons, or other paid services and do not currently collect payment information for the Service.

If we introduce paid services, we will update this policy before collecting billing information. A payment processor such as Stripe may collect payment-card and billing details directly and provide us with limited customer, subscription, invoice, amount, currency, and payment-status information. We would use and share that information only as needed to administer the purchase, prevent fraud, provide support, maintain financial records, and comply with law. The processor's privacy policy would govern its own collection and use of payment information.

9. Moldable Artifacts

Moldable Artifacts is a hosted feature for publishing static web artifacts such as slides, HTML/CSS/JavaScript prototypes, generated media, reports, and exported static bundles.

9.1 Public unlisted URLs

Published Artifacts are served from public, unlisted URLs. Unlisted URLs reduce casual discovery, but they are not access control. Anyone with the URL may view, download, copy, share, index, archive, or cache the Artifact.

9.2 What is stored

When you publish an Artifact, we may store:

Artifact files and asset bytes
Artifact title, type, entrypoint, description, social preview metadata, source app identifiers, workspace metadata, public slug, and version information
File manifests, file paths, content types, sizes, hashes, upload session records, and publication status
Publishing key records, nonces, signatures, timestamps, rate-limit records, and security/audit logs

9.3 What not to publish

Do not publish passwords, API keys, credentials, private keys, confidential business information, regulated data, personal information, or other sensitive information unless you have the right to do so and understand that the Artifact may become public.

9.4 Unpublishing and deletion

When you unpublish an Artifact, we intend to remove it from active public hosting and delete the associated stored files from the Artifact Service. However, unpublishing may not remove copies already downloaded, shared, indexed, cached, archived, or stored by visitors, search engines, browser caches, infrastructure caches, backups, logs, or other third parties. We may retain metadata, security logs, audit records, and abuse-prevention records as reasonably necessary to operate, secure, enforce, or comply with legal obligations.

10. Google API Services

When you connect Google services (such as Google Calendar) to Moldable, we access your Google data only as described below. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10.1 Google Calendar

When you connect your Google Calendar:

What we access: Calendar event data (event titles, times, locations, descriptions, attendees) from calendars you have access to.
How we use it: To display your calendar events within the Moldable Calendar app and enable you to create, edit, and delete events.
Where it's stored: Calendar data is cached locally on your device in ~/.moldable/. We do not store your calendar data on our servers.
How long we keep it: Cached data is refreshed each time you use the app. You can disconnect your Google account at any time to remove stored tokens and cached data.

10.2 Limited Use Disclosure

Moldable's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements:

We only use Google data to provide and improve the calendar features visible in Moldable.
We do not transfer Google data to third parties except as necessary to provide the service, for security purposes, or to comply with law.
We do not use Google data for advertising or to build advertising profiles.
Humans do not read your Google data unless you provide explicit consent, it's required for security/abuse investigation, or required by law.

11. Cookies and Tracking

The Moldable desktop application does not use advertising cookies or cross-site tracking. Our Account service uses cookies that are necessary to create and maintain authenticated sessions and protect Account-based features.

Our website (moldable.sh) uses Plausible Analytics, which is designed to operate without cookies and without tracking you across sites. Moldable Artifacts may use standard server/CDN logs, security controls, and rate-limit records to deliver and protect published Artifacts. If we materially change our analytics or tracking practices, we will update this policy.

12. Data Retention

Local data: Data stored on your machine is retained until you delete it.
Account data: Account profile and authentication records are generally retained while your Account remains active and for a reasonable period afterward where needed for security, legal compliance, dispute resolution, or backup rotation.
Current Sync data: Synced Content and synchronization metadata are generally retained while Sync remains enabled for that location or until you delete the hosted data or Account. Turning off Sync for a location may remove its current Hosted Copy after the undo period shown in the Service. Disconnecting or signing out a device does not normally delete the Hosted Copy.
Sync history: Older versions may be retained according to current technical or plan limits and may be pruned as those limits are reached. Unless a specific plan says otherwise, history is not kept for a guaranteed period and should not be treated as an independent backup.
Sync audit records: Hosted object-action audit records are generally configured to expire after 30 days. Other security, rate-limit, deletion, and operational records may be retained for a reasonable period based on security, fraud-prevention, troubleshooting, legal, and dispute-resolution needs.
Deleted Sync data: Limited backups, logs, security records, deletion records, and disaster-recovery copies may remain for a reasonable period after active hosted data is removed. Their handling depends on the relevant retention system, and they are not ordinarily available through the Service.
Future billing data: If we introduce paid services, subscription and transaction records may be retained while the service is active and afterward as reasonably necessary for accounting, tax, fraud prevention, chargebacks, legal compliance, and dispute resolution.
Support communications: We retain support communications for as long as reasonably necessary to provide support and maintain records.
Published Artifacts: Published Artifact files and metadata are retained while the Artifact remains published, unless removed earlier by you or us.
Historical Artifact versions: Prior versions may remain available while the Artifact is published, depending on the feature's versioning behavior.
Unpublished Artifacts: After unpublishing, active hosted files are intended to be deleted, but metadata, logs, audit records, security records, and backups may be retained for a reasonable period.
Publishing and operational records: Publishing keys, nonces, request records, rate-limit records, service usage records, security records, and abuse-prevention records may be retained as needed to operate, secure, troubleshoot, and enforce the Service.

13. Security

We implement reasonable security measures to protect information we collect. However, no method of transmission or storage is 100% secure.

Your local data is protected by your device's security measures. We recommend:

Keeping your operating system and software updated
Using strong device passwords/encryption
Being cautious about which apps and skills you install
Reviewing Artifacts before publishing and avoiding publication of secrets or sensitive information

14. Your Rights and Choices

14.1 Local data

You have full control over your local data. You can:

View, modify, or delete any data in ~/.moldable/
Export your data at any time
Uninstall the application and delete all local data

14.2 Accounts and Sync

You may choose not to create an Account, turn Sync off, disconnect devices, change exclusions, or request deletion of your Account and hosted Sync data. Turning Sync off is designed to preserve local files but may remove the Hosted Copy; disconnecting a device normally preserves both. Contact hello@moldable.sh if an in-product control is unavailable.

14.3 Published Artifacts

You can unpublish Artifacts through the Service where that feature is available. You may also contact us at hello@moldable.sh for help with Artifact deletion or privacy requests. Unpublishing does not guarantee removal of copies already shared, cached, indexed, downloaded, archived, or stored by third parties.

14.4 Future telemetry

If we add anonymous telemetry in the future, it will be opt-in and you will be able to control it in Moldable settings.

14.5 Privacy rights

Depending on where you live, you may have rights to:

Access information we hold about you
Request correction of inaccurate information
Request deletion of your information
Request a portable copy of certain information
Ask us to restrict certain processing
Object to certain processing
Withdraw consent where processing is based on consent

To exercise these rights, contact us at hello@moldable.sh.

14.6 EEA/UK residents

If you are in the European Economic Area or United Kingdom, you may have additional rights under applicable data-protection law, including the right to lodge a complaint with your local data protection authority. Providing Account, Sync, Artifact, or future paid-service information may be necessary for us to provide the feature you request; without it, the feature may not work.

14.7 California residents

If you are a California resident and the California Consumer Privacy Act (CCPA) applies to us, you may have rights to know, access, correct, or delete personal information and to receive information about how it is used and disclosed. We do not sell personal information or share it for cross-context behavioral advertising, and we do not discriminate against you for exercising applicable privacy rights.

15. International Transfers

We are based in the United States, and our service providers may process information in the United States and other countries. Those countries may have different data-protection laws than your country. Where applicable law requires a transfer mechanism, we take the steps required by that law, which may include using an adequacy decision, standard contractual clauses, or another lawful safeguard.

16. Children's Privacy

The Service is not directed to children under 18, and we do not knowingly collect personal information from children.

17. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date indicates when changes were made. We will take reasonable steps to notify you of material changes.

18. Contact

Desiderata LLC
4607 Library Road, Ste 220 PMB 630
Bethel Park, PA 15102
United States

Email: hello@moldable.sh