Privacy policy

This privacy policy (the "Policy") describes how Isomorphic Intelligence, LLC ("Isomorphic", "we", "us") collects, uses, shares, and deletes personal information when you visit isomorphic.sh (the "Website") or use the hosted Isomorphic service at mcp.isomorphic.sh, including its Model Context Protocol connector and web app (the "Service"). It also describes the rights you may have under the law where you live and how to exercise them.

Isomorphic is open-source software. Anyone may run their own copy (a "self-hosted instance"). This Policy does not apply to self-hosted instances. The software contains no telemetry, and a self-hosted instance sends no information to us. Whoever operates that instance is responsible for the information it processes.

For account information, we act as the data controller. For the content of a brain that belongs to an organization, we process that content on the organization's behalf, as described in "Organizations and their content" below.

Website visitors. The Website uses no cookies, analytics, or tracking scripts. Our hosting provider, Cloudflare, processes technical information about each request, such as your IP address, browser, and the page requested, to deliver the Website and protect it from abuse.

Account information. When you sign in to the Service, we collect your email address, and your name if you provide it. Sign-in works by an emailed link. If you connect a GitHub account or a GitHub organization, we also store your GitHub username and the identifier of the GitHub App installation you authorize.

Content. The Service stores the pages, files, and media that you, your teammates, and your AI assistant write to a brain ("Content"). Content is kept in a Git repository on GitHub, either in an organization we operate or in a GitHub organization you control. We also keep a copy of page text in a search index so the Service can search and link your pages. Git records the author and time of every change, which is how the Service shows a brain's activity history.

Organization information. We store the organizations and brains you create or join, your role in each, and invitations you send or receive, including the invitee's email address. Invitation links are stored only in hashed form.

Authorization information. When you connect an AI assistant to the Service, we store the registration of that client and the access grants and tokens that let it act on your behalf.

Usage information. We record, per day, how many times each person called each tool of the Service in each brain, and how many of those calls failed. Your organization's administrators can view these counts.

Sensitive-data detections. When Content written to a brain looks like a credential or other sensitive data, the Service records the type of detection, its position in the page, and who wrote it, so that administrators can review it. It does not record the matched text itself.

Feedback and support. If you send feedback through the Service, it is published as an issue on our public GitHub repository, after you have been shown the exact text that will be posted. The public issue carries your words and an opaque reference number. Your email address, account, and organization are stored privately and are never published. If you email us, we keep that correspondence.

We do not sell or rent personal information, share it for cross-context behavioral advertising, or use third-party tracking or advertising cookies. We do not use Content to train machine learning models, and we do not permit others to.

We do not intentionally collect sensitive categories of personal information, such as health, biometric, or genetic data. Do not store such information in a brain unless you are permitted to.

The Service is not directed to anyone under 18, and we do not knowingly collect information from them. If we learn that an account belongs to someone under 18, we will close it.

The Service is used through an AI assistant you choose, such as Claude. When your assistant searches, reads, or writes a brain, the Content involved is sent to that assistant and processed by its provider under the provider's own terms and privacy policy. We do not control what that provider does with it. Isomorphic itself does not send Content to any AI model provider.

We use personal information on the following legal bases.

To provide the Service under our agreement with you:

• to sign you in and verify your identity;
• to store, index, search, and display Content;
• to manage organizations, memberships, roles, invitations, and sharing;
• to send sign-in, invitation, and other service emails; and
• to provide support.

For our legitimate interests:

• to keep the Service secure and prevent abuse and fraud;
• to find and fix errors, and to understand which features are used;
• to respond to feedback; and
• to enforce our terms and defend legal claims.

With your consent, where we ask for it, for the purpose we explain at the time. You may withdraw consent at any time. Withdrawal does not affect processing that has already taken place.

To comply with the law, where we are required to keep or disclose information.

We access the Content of a brain only when you ask us to (for example, for support), when needed to keep the Service secure and running, or when the law requires it.

When you use the Service as a member of an organization, the organization controls the Content of its brains and decides who can read and edit it. We process that Content on the organization's behalf and according to its instructions. Other members can see Content according to their roles, along with your name or email address as the author of changes you make. Administrators can also see usage counts and sensitive-data detections for the organization.

If you ask us to access or delete Content that belongs to an organization, we may refer your request to that organization's administrators.

We share personal information only with the following service providers, which process it on our behalf and under our instructions:

• Cloudflare: hosting, network, databases, and key-value storage.
• GitHub: storage of brain repositories and publication of feedback issues.
• Resend: delivery of sign-in and invitation emails.

If we add or replace a service provider, we will update this list. Beyond these providers and the organization sharing described above, we disclose personal information only:

• when required by law, such as a subpoena or court order, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of our users, the public, or us; and
• in connection with a merger, acquisition, or sale of assets, in which case this Policy continues to apply to the information transferred.

Isomorphic is based in the United States. Our service providers may process information in the United States and in other countries where they operate. Where we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, we rely on safeguards such as the Standard Contractual Clauses. You may request a copy by contacting us.

The Website sets no cookies. The Service uses strictly necessary first-party cookies to keep you signed in and to complete sign-in securely. We use no analytics, advertising, or third-party cookies. Because we do not track you across other websites, we do not respond differently to browser "Do Not Track" signals.

We use reasonable technical and organizational measures to protect personal information, including encryption in transit, hashed storage of invitation links, role-based access to brains, and narrowly scoped GitHub permissions. The Service's source code is public. No system is perfectly secure, and we cannot guarantee the security of information sent to us. Report security issues to security@isomorphic.sh.

We keep personal information while your account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

You may ask us to delete your account at any time by emailing privacy@isomorphic.sh from the address you sign in with. Within 30 days we will delete your account, memberships, authorization grants and tokens, usage records, and the private records linked to any feedback you sent. Backups expire on their own schedule, within a further 30 days.

Content in a repository your organization controls stays with your organization. Content in a repository we operate on your behalf will be deleted, or transferred to you first if you ask. Changes you made to a brain shared with others belong to that brain's organization and are not removed when you leave it. Feedback issues already published on GitHub contain nothing that identifies you. We will remove one on request.

Content is stored as markdown files in a Git repository, so you or your organization can export a complete copy at any time.

Depending on where you live, including in the European Economic Area, the United Kingdom, Switzerland, California, and other US states with privacy laws, you may have the right to:

• know what personal information we hold about you and receive a copy;
• correct inaccurate or incomplete information;
• delete your information;
• receive your information in a portable format;
• object to or restrict our processing;
• withdraw consent where we rely on it; and
• lodge a complaint with your data protection authority.

We do not sell or share personal information as those terms are defined under California law, and we will not discriminate against you for exercising any of these rights. To make a request, email privacy@isomorphic.sh. We may need to verify your identity first, and we respond within 30 days. These rights can be limited, for example where a request would reveal another person's information or where we must keep information by law.

We may update this Policy. The date at the top shows when it last changed. Changes take effect when posted here.

Isomorphic Intelligence, LLC is responsible for the processing described in this Policy. Send questions and requests to privacy@isomorphic.sh.