Legal

Privacy at Murmell

Murmell stores your account, your canvases, the links you have shared, and your encrypted provider credentials. With your consent, PostHog measures onboarding in the application and records a masked replay for up to five minutes, stopping when your first agent is ready.

What is stored

• Your account: an email address, a password hash if you set a password, and the identity of the provider you signed in with if you used one.
• Your canvases: their names, what is on them, the arrangement of the windows, and the two share tokens each one carries.
• A code host token, if you connect one. It is encrypted with AES-256-GCM before it is written, under a key that lives in the environment of the server and never in the database, so a database dump on its own yields nothing usable.
• The transcript of a session while the canvas is alive, so that closing a tab and coming back shows you what arrived while you were away.

What is never stored

Your password in readable form. It is hashed with Argon2 when you set it, and the hash is what is compared when you sign in.

Where each secret lives

Murmell runs in two halves and the split is a privacy property rather than a deployment detail. One half holds the accounts, the canvases, the tokens and the encryption key, and it never executes agent code. The other half runs the agents, and it holds no database, no decryption key and no stored credential. An agent that gets out of what it was asked to do finds a project directory and nothing worth taking.

Who else is involved

• PostHog, only after you accept onboarding measurement. It receives journey milestones and a masked replay. Inputs and text are masked; terminal contents, embedded frames, images, video and canvas pixels are blocked. Query strings and URL fragments are removed. The local journey identifier expires after 24 hours. The replay ends after five minutes or when the first agent is ready, whichever comes first. A preference cookie remembers your choice. Consent is requested during onboarding and in application menus until you choose. The landing does not send analytics events.
• The agent you bring. Claude Code, Codex and the rest talk to their own vendor with your own account, exactly as they would on your laptop. What you send an agent is covered by that vendor terms.
• Email. Password resets, security notices and account deletion confirmations are sent through a delivery provider, which receives your email address and the message.
• Dictation, if you use it. The audio goes to a transcription service under a short-lived grant the server mints. The page that records you never holds the key that pays for it, and the grant expires on its own.
• Your code host, if you connect one. Murmell pushes your project to a repository you own, authenticating with the token you connected.

Your side of it

Ask for a copy of what is stored about you, or for the account to be deleted, from your account settings or by writing to hello@murmell.com. Deletion removes the account, its canvases and its stored credentials. A deletion request is confirmed by a one-time link sent to your address, because an action that cannot be undone should not be startable by somebody who is merely signed in on your machine.

Purposes, legal bases, and retention

Intrudr, Paris, France, is the controller. Account and project data is processed to perform the service contract. Security logs are processed for legitimate interests. Billing and accounting records are processed to meet legal obligations. Optional communications use consent where required.

• Account, canvas, credential, and active project data: until account deletion.
• Deleted Azure recovery material: removed within 30 days.
• Security and service logs: 90 days, longer only for an investigated incident.
• Support conversations: 24 months after the last exchange.
• Checkout acceptance evidence: 5 years. Invoices and accounting records: 10 years.

Recipients and transfers

Data is shared only as needed with Microsoft Azure, Stripe, email delivery and optional voice providers, and the code hosts and agent vendors you select. Some providers may process data outside the European Economic Area under their applicable transfer safeguards.

Your rights

You may request access, correction, export, restriction, objection, or deletion at hello@murmell.com. You may also complain to the CNIL.

A read link you have handed out shows your canvas to anybody holding it. Sharing is what the link is for, and it is the one place where what happens next is yours to control.

Straight answers