Privacy Policy — Medellis Coworker

Version 1.0 · Effective 2026-08-13 · Dabra Ventures LLC

This policy covers the Medellis Coworker desktop application and this website. It is written to be checkable: every claim below corresponds to something you can verify in the product, and where the software talks to a server, it says so.

The short version

Your files, prompts, and the work the coworker produces stay on your computer. We do not receive them, store them, or train on them.

Three things can leave your machine, and each is described in full below: the prompts you send to the AI provider you choose, a content-free session ping to us if you switch it on while signed in, and whatever the coworker sends to services you connect at your direction.

1. What stays on your device

The application runs locally. These never reach us:

2. AI model providers

To produce output, the coworker sends your prompt and the context it has gathered to the model provider you have configured — for example Anthropic, OpenAI, DeepSeek, or a model you run yourself. That traffic goes from your machine directly to that provider; it does not pass through us.

Each provider's own privacy policy and retention terms govern that data. Choosing the provider — including choosing a local one that sends nothing anywhere — is your decision, and you can change it at any time in the app's settings.

3. Product telemetry

What it is. If you switch it on, and while you are signed in to a Medellis account, the application tells us when a coworker session starts. Each event contains exactly:

What it never contains: prompts, outputs, session titles, file paths, tool arguments, connector content, or anything you typed.

It is linked to your account. The event is sent with your access token, so we can associate it with the account that is signed in. We describe it as content-free, not anonymous, because the second word would not be true.

It is off unless you turn it on. A new installation sends nothing. The switch is in the application's settings, under General → Privacy, and until you tick it the application does not even generate the installation identifier described above. You can turn it back off at any time in the same place. Signed out, the application sends us nothing at all — there is no unauthenticated telemetry path.

Why we collect it. To know which features are used and which builds are in the field, so we can prioritise work and support pilots.

4. Connected services

When you connect an account — Gmail, Slack, Google Calendar, GitHub, WhatsApp, iMessage, and others — the coworker acts on that account as you, using credentials you supply. That traffic goes from your machine to that service.

We do not store your connector tokens. When you connect an account, the OAuth exchange passes through our servers and the resulting token is handed straight to your device, where it is held in your operating system's credential storage. Refreshing a token works the same way: your device sends us the refresh token, we exchange it with the provider, and we return the new one. We keep no copy — there is no table for it.

We never read the content those connectors retrieve.

If the coworker sends a message, email, or reply on your behalf, you are the sender. Where the law requires the consent of the other participants to record or relay a conversation, obtaining it is your responsibility — see §6(c) of the Terms.

5. Your Medellis account

If you create an account, we store your email address, an account identifier, and sign-in metadata (timestamps, and the IP address of the request, for abuse prevention). Sign-in is by emailed link; we do not store a password.

6. Downloading the application

When you download from this site, we record your email address, which version of the terms you accepted, the time, and your IP address and browser user-agent.

We collect it for two reasons: to have a record that the terms were accepted before the software was distributed, and to be able to reach you about a security issue affecting the build you took.

We do not send marketing to this address unless you separately opt in — the consent checkbox on the download page is not bundled with your acceptance of the terms.

How long we keep it. The acceptance record — your email address, the terms version, the platform, and the time — is kept for seven years after your most recent download, because its whole purpose is to show what you agreed to if that is ever disputed. The IP address and user-agent are erased after twelve months: they corroborate a recent record and add very little to an old one, so they are not worth keeping for its full life.

7. What we do not do

8. Storage and security

Account and download records are held with our infrastructure providers in the United States. Access is restricted to those who need it. No system is perfectly secure, and we do not claim otherwise.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export the personal information we hold, to object to or restrict processing, and to complain to a supervisory authority. Email privacy@medellis.com and we will respond within the period the applicable law requires.

Because the application is local-first, most of your data is already in your hands: it is on your disk, and deleting the application and its state directory removes it.

10. Children

The application is not directed at anyone under 16, and we do not knowingly collect their personal information.

11. Changes

We may update this policy. Material changes will be announced in the application or by email, and every version stays published with its version number and effective date.

Contact: privacy@medellis.com · Dabra Ventures LLC