Privacy Policy

1. Who we are and what this covers

Melvin (“we”) is operated by Lachlan Allen, 3133 N Alafaya Dr, Orlando, FL 32826, United States, who is the controller of the personal data described here. This policy covers the Melvin macOS application, the Melvin iPhone app, trymelvin.com, the Melvin account and billing services, and the connection that lets AI apps such as ChatGPT use Melvin.

It does not cover third-party services you connect to Melvin, or websites Melvin visits on your instruction. Those are governed by their own policies.

2. What we collect

Account and billing

• Your email address, and a display name (which defaults to the part of your email before the @, and which you can change).
• Authentication identifiers and session tokens.
• Your plan, subscription status, plan start date, and how many runs you have used.
• Payment details are collected and stored by Stripe, not by us. We never see or store your card number. Stripe holds your billing address, and a tax ID if you provide one; we store only Stripe’s customer and subscription identifiers.

Task content

• The text of tasks and questions you, or an AI app you connected, give Melvin.
• The context needed to carry a task out: the contents of the app window or web page you point Melvin at, the accessibility structure of that interface, and, when you ask Melvin about your screen, a screenshot of it.
• Content from services you explicitly connect, such as mail, calendar, reminders, or contacts, limited to what a task requires.

Usage and diagnostics

• Product analytics tied to a per-installation identifier and, once you sign in, to your account. These records include the text of your prompts (up to the first 4,000 characters), which model was used, how many steps a run took, what it cost, whether it succeeded, and error categories. We use this to find where Melvin is failing people.
• Run counts and cost totals, used to enforce plan limits.
• Anonymous, aggregated learning contributions: when Melvin works out how to do something, it may contribute a generalised pattern to a shared library. A contribution can include up to 200 characters of your task text. You can turn this off in Settings.

trymelvin.com

The marketing site uses Vercel Web Analytics for page views, plus a first-party event stream we store ourselves: an anonymous visitor id, a 30-minute session, pages, funnel steps (pricing, download, sign-in, checkout, waitlist), time on page, form start/abandon, and friction (rage clicks, dead clicks, script errors). We do not record the screen, field values, or your email in that stream, we do not use advertising cookies, and we do not sell the data. It is separate from the product analytics in the Mac app.

Approximate location

For weather and “near me” style questions, Melvin may look up your approximate location from your IP address using ipapi.co. You can set a manual location in Settings instead, which stops these lookups.

3. What stays on your Mac

Work Melvin does inside your Mac applications happens on this machine, through the macOS accessibility layer. The contents of your mail, files, notes and messages are read locally and are not uploaded to run a task. Web tasks are the exception and are covered in section 4.

A large part of what Melvin knows about you never leaves your machine. It is stored under Melvin’s Application Support directory and in ~/.melvin:

• Activity history. While observation is enabled, Melvin records which application you are in, the window title, and the full address of the page you are viewing, along with file paths in editors. It records the length and a coarse category of text you select, but not the text itself.
• Learned patterns. Models built from that history. These retain application names and the domains you visit as part of their structure.
• Run logs. A detailed record of each run, including the plan, the steps, tool inputs and outputs, and anything you were asked and answered. Email addresses, phone numbers and credentials are masked in these logs, but they are otherwise complete.
• Workflows, schedules, templates and learned UI handles for the apps and sites you use.
• Credentials. Account, mail and integration tokens are held in the macOS Keychain. Note that if you enter your own API keys for optional third-party search providers, those are stored in a settings file on disk rather than the Keychain.

Voice input is transcribed locally on your Mac. Audio is held in memory and is not written to disk or uploaded. Your chat history with the Ask surface is kept in memory only.

4. Service providers, and what they receive

These companies run parts of Melvin for us, and receive only what that part needs. They are service providers, not buyers: we do not sell your data to them or anyone else, and we do not share it for advertising. They are active by default, because the product does not work without them.

Only if you choose it

These are off unless you connect an account, supply your own API key, or enable a feature: Google (sign-in, Gmail, Docs and Drive), Apple and Microsoft sign-in, Slack, mail servers you connect over IMAP, Anthropic, OpenRouter, Alibaba DashScope, Brave Search, Exa, a CAPTCHA-solving provider, any Model Context Protocol servers you install, and any diagnostics endpoint you configure yourself. Where you supply your own key, your Mac contacts that provider directly. Any AI app you connect to Melvin, such as ChatGPT, receives what section 5 describes.

Crash reporting

Melvin includes crash reporting and the setting is on by default, but no reporting endpoint is configured in the released build, so no crash reports are currently transmitted. If that changes, this page will be updated before it does. You can turn the setting off regardless.

5. When an AI app uses your Mac or iPhone

You can connect Melvin to an AI app such as ChatGPT. The AI app then asks Melvin to do things on your Mac or iPhone, and Melvin sends it back the result. This section says exactly what passes each way, what is kept, and how to take it back.

What the AI app sends to Melvin

• The request: what to do and its details, such as words to look for in file names, a folder, a date range, or the name of a shortcut.
• Proof that it is acting for you, from the sign-in you approved when you connected it. The AI app never chooses your account or names one of your devices for Melvin to trust; Melvin works that out from your own account.

What Melvin sends back to the AI app

For finding and organizing files, storage and device status:

• File names, sizes, kinds and dates, and where the files are, written from your home folder (for example ~/Downloads/report.pdf). Never what is inside a file.
• The status of your devices: which are connected, whether each is online, battery level, free storage on your Mac, and the system and Melvin versions. Your iPhone’s storage figures stay on your iPhone.
• What a task did: what was asked, what was done, what was left alone and why, and whether it can be undone.
• Never your email address, your account or device identifiers, or any password.

When it runs one of your shortcuts: whatever that shortcut returns, up to the first 2,000 characters. A shortcut can read things Melvin itself never does, such as a note, a file or where you are, and what it returns goes to the AI app and is kept with that task in the activity log. Approve a shortcut only if you are happy for the AI app to see its result.

When it runs an action one of your apps offers to Shortcuts, for an app you added in Melvin: whatever that action returns, up to the first 2,000 characters, with codes Melvin can recognize hidden, kept with that task in the activity log the same way. When Melvin makes an app action shortcut on your Mac, Apple’s signing service receives a copy, and the file carries your Apple Account’s identity. Melvin deletes the file once you have added it. So that your AI app can tell you what your apps could do, your Mac can also send Melvin a list of the actions its apps offer: each app’s name, and each action’s name, description and inputs. Nothing on that list runs until you add the app in Melvin.

When it works in one of your apps, such as Mail, Notes, Calendar, Reminders, Contacts or Music: what it was asked to read there, such as an email, a note or an event, with codes Melvin can recognize, such as sign-in codes, hidden. When it reads what is inside files in a folder: the text it reads there. Scanned documents and pictures are read on your Mac by Apple’s Vision framework, and the file itself never leaves your Mac.

What reaches the AI app becomes part of your conversation there, and that app keeps it under its own privacy policy. For ChatGPT, that is OpenAI’s.

What stays on your device

Searching, measuring, comparing and moving files happens on the device itself. To find duplicates, your Mac compares the files there; their contents are never uploaded. For file requests, Melvin reaches only the folders you allow (Desktop, Documents, Downloads, Pictures, Movies, Music, iCloud Drive with the Pages, Numbers, Keynote, Preview and TextEdit folders in it, and the cloud storage folders synced to your Mac, each allowed separately), never your keychain, browser data or other private app data. A file kept online only, in iCloud Drive or a cloud storage folder, is not downloaded unless you or your AI ask for it.

Automations

An automation is a rule your AI writes and you approve on your Mac, which then acts on files as they arrive. The rule, and its memory of which files it has handled, stay on your Mac. Your Melvin account keeps its name, the sentence you approved, a short description of what starts it, whether it is on, and when it last ran, so your Devices page can show it and pause it. Each run is kept in the activity log like any other task: the file it ran on, what was done, and up to 10 values the rule read from the file, such as a date or an invoice number, each at most 100 characters. Never the file’s text.

When a rule lets Melvin choose for you, such as which client a document belongs to, a model on your Mac makes the choice, and nothing leaves your Mac. Only if you also allow Melvin’s model in the cloud, which Melvin asks you about separately, does a choice your Mac cannot make go to Melvin’s server: at most 4,000 characters of that file’s text, passed to the AI model provider in section 4 for that one choice. Melvin keeps none of it.

An automation on your Mac can also start when your iPhone arrives at or leaves a place you asked Melvin to watch, if you switch on Tell my Mac when I arrive or leave in Melvin on your iPhone. It is off until you do. Then, each time you arrive or leave, your iPhone sends Melvin’s server the name you gave that place, whether you arrived or left, and when, and never its coordinates. Your Mac picks it up from there, and Melvin deletes it about a day after it arrived.

The activity log

Every task is stored in your Melvin account as a record: what was asked, which device, when, how it ended, what changed and what was left alone. It is how the AI app checks on a task, how a task can be undone, and what your Activity page shows. It is kept while your account is open and deleted with it. A preview of a file change can be carried out for 15 minutes, and what is carried out is exactly what the preview listed. The stored copy of the preview is deleted about a day later, but the file names and folders it listed stay in the activity log as part of that task’s record.

Files sent between your devices

When you send files or photos from one of your devices to another, they pass through private Melvin storage that only your account can open, encrypted in transit. They are deleted as soon as the other device has them, and anything not collected is deleted about a day after it was sent. A file can be up to 200 MB, and one transfer up to 1 GB.

Permissions, and taking them back

• Your AI app asks you to approve changes Melvin makes for it, such as moving files to the Trash or running one of your shortcuts. Melvin reaches only what macOS and iOS let it on each device, which you choose when you set it up. An automation runs only after you turn it on, on your Mac.
• On your iPhone, nothing goes back to an AI app until you have said yes once, on that iPhone, to sharing results with your AI apps.
• On your Devices page you can see and remove each permission, rename or disconnect a device, disconnect every AI app at once, and sign out everywhere, which also ends every sign-in on every device. You can also disconnect AI apps from the Melvin menu on your Mac.
• A disconnected device stops receiving tasks straight away, and anything it was doing is asked to stop after the step it is on. You can reconnect it from the same page. Disconnecting AI apps stops them working with Melvin straight away, and tasks that had not started are cancelled.

When a device is offline

Nothing on your Mac or iPhone listens for connections from the internet; each device reaches out to Melvin. A request to look at files on a Mac that is asleep is turned down straight away, with when it was last seen, rather than saved to run later without you. A request for your iPhone waits up to 10 minutes for you to open Melvin there. If a device loses its connection during a task, it carries on and reports what it did when it is back.

6. Why we process your data, and our legal basis

For users in the UK and European Economic Area, we rely on the following bases under the UK and EU GDPR:

We do not use your data to train general-purpose AI models, and we do not sell it or use it for behavioural advertising. Data received through Google APIs is handled under the Google API Services User Data Policy, including the Limited Use requirements.

We do not make decisions about you by automated means that produce legal or similarly significant effects.

7. How long we keep it

• Account and billing records: while your account is open, and afterwards only as long as tax and accounting law requires.
• Product analytics: retained while your account is open. Deleting your account deletes them.
• Activity log of AI app tasks: while your account is open. Deleting your account deletes it.
• Automations: the record of each automation is kept while your account is open, including one you deleted, so its past runs still show its name. Its runs are part of the activity log. Deleting your account deletes them.
• File change previews: can be carried out for 15 minutes, and the stored preview is deleted about a day after that. The file names and folders a preview listed stay in the activity log, with that task, while your account is open.
• Files sent between your devices: deleted once delivered, and anything not collected about a day after it was sent.
• Arrivals and departures told to your Mac: deleted about a day after they arrived.
• Data on your Mac: kept until you clear it. Observation history follows the retention period you set in Settings, and everything can be erased at once with “Wipe all data”.
• Shared learning contributions: generalised patterns are retained without a link to your account.
• Backups: may persist for a short period after deletion before being overwritten.

8. Your rights

Wherever you live, you can ask us to give you a copy of your data, correct it, or delete it. In the app you can additionally pause observation, exclude individual applications, change how long local history is kept, disconnect any integration, and erase local data yourself. On your Devices page you can remove any permission, disconnect a device, and disconnect every AI app.

UK and European Economic Area

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests (including our product analytics). Where processing rests on consent, you can withdraw it at any time without affecting what came before. You also have the right to complain to your local supervisory authority.

California

Under the CCPA as amended by the CPRA, you have the right to know what personal information we collect and why, to delete it, to correct it, and to not be discriminated against for exercising those rights. In the last twelve months we have collected the categories described in section 2: identifiers, commercial information, internet activity, geolocation inferred from IP address, audio while you are dictating, and the contents of your tasks.

We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. We do not knowingly collect or sell the personal information of minors.

To exercise any of these rights, write to privacy@trymelvin.com, or follow the account deletion instructions. We will verify your request against your account and respond within the period the law allows, normally 30 days. You may use an authorised agent.

9. International transfers and security

Our service providers are located in several countries, including the United States. Where personal data leaves the UK or EEA, we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, together with the safeguards those providers operate.

We use transport encryption, account-scoped authorisation, operating-system credential storage, least-privilege integrations and redaction in diagnostic logs. No system removes all risk, and you should avoid putting secrets you would not want processed into a task prompt.

10. macOS permissions

macOS asks your permission before Melvin can use any of the following, and you can withdraw each one in System Settings at any time:

• Accessibility: to read interface structure and act in apps for you.
• Automation (Apple Events): to control apps such as Mail, Calendar, Notes and Safari.
• Microphone: for voice input, transcribed on your Mac.
• Calendars, Reminders and Contacts: to read and create items when a task needs it.
• Location: for location-relevant answers, if you grant it.

Screen Recording and Full Disk Access are not on that list, and Melvin never asks for either. It reads app structure through Accessibility rather than watching your screen. Screen capture ships turned off and there is no switch in the app that turns it on.

11. Children

Melvin is not intended for, or directed to, anyone under 18, and we do not knowingly collect their personal data. If you believe a child has provided us with data, write to us and we will delete it.

12. Changes to this policy

We will update this page when what we do with your data changes, and revise the date at the top. If a change materially affects you, we will tell you in the app or by email before it takes effect.

13. Contact

Privacy questions and rights requests: privacy@trymelvin.com.
Security reports: security@trymelvin.com.