Legal

Privacy Policy

Last updated: April 2025

Mycelium is built on a simple principle: your data belongs to you. We collect as little as possible, store nothing we don't need, and will never sell, share, or monetize your information. This document explains exactly what we do — and don't do — with your data.

1. What we collect

To provide the service, we store the following data when you create an account:

  • Email address — used for authentication and account recovery only.
  • Username — chosen by you, displayed to other users.
  • Password — stored as a salted hash. We cannot read it.
  • Messages and files — stored to deliver the messaging and drive features.
  • Device tokens — used solely to deliver push notifications if you opt in.

We do not collect your real name, phone number, location, IP address logs, or any behavioral analytics.

2. What we don't do

  • We do not run ads, ever.
  • We do not sell or share your data with third parties.
  • We do not track you across the web.
  • We do not use third-party analytics (no Google Analytics, no tracking pixels).
  • We do not read your private messages.

3. Cookies & sessions

Mycelium uses a single session cookie (jwt) to keep you authenticated. This cookie contains a signed token that identifies your session — it holds no personal information and is never shared with third parties. No tracking cookies are used.

4. Data retention

Your data is kept for as long as your account is active. When you delete your account, your profile, messages, and files are permanently deleted from our servers. Backups are purged within 30 days.

5. Security

All data is transmitted over HTTPS. Passwords are hashed using bcrypt before storage. Mycelium is open source — you can audit the full codebase on GitLab.

6. Your rights

You have the right to:

  • Access all data we hold about you.
  • Correct any inaccurate information.
  • Delete your account and all associated data at any time.
  • Export your data on request.

To exercise any of these rights, contact us at the address below.

7. Contact

Questions about this policy or your data? Reach us at carbonlab.dev or open an issue on our GitLab repository.