Privacy policy

marmy ("marmy", "we", "us") runs the website at marmy.dev and the marmy app at app.marmy.dev (together, the "service"). This policy explains what personal information we collect, how we use it, and the choices you have. We are the controller of the personal information described here, except where section 7 says otherwise.

Questions or requests: email privacy@marmy.dev.

Information you give us

• Waitlist. If you join the waitlist, your email address.
• Account. Your email address and password when you sign up with email (we store passwords only as secure hashes), or, if you sign in with Google, your email address, name and profile picture from your Google account.
• Workspace. Your workspace name, your website address, and the choices you make during setup (for example, which Analytics property, Search Console site or repository marmy should use).
• Messages. Anything you send us, such as support emails.

Information from services you connect

marmy only connects to a service when you ask it to, and you can disconnect at any time.

• Google Analytics and Google Search Console (read-only). With your permission we access your Analytics properties and Search Console sites, and the data in them, such as traffic, search queries and rankings, to understand how people find and use your site. We request only read-only access (the analytics.readonly and webmasters.readonly scopes) plus your basic Google account identity.
• GitHub. If you install the marmy GitHub App, we can read the repositories you choose and open pull requests on them with changes for you to review. We store your GitHub username, the installation and the repository you pick. We don't store your GitHub access tokens; we request short-lived ones when needed.

Information collected automatically

• Logs. Like most websites, our hosting provider records technical information when you visit, such as your IP address, browser type, the pages you request and when. We use it to run, secure and debug the service.
• Cookies and local storage. See section 6.

The marketing website does not use analytics, advertising or tracking tools, and it loads its fonts from our own servers.

• To provide the service: create your account, set up your workspace, and run the work you ask marmy to do.
• To analyze the data from services you connect, so marmy can find growth opportunities for your product and act on them with your approval.
• To communicate with you, including account emails (such as confirming your email address or resetting your password) and replies to your messages.
• To tell you when you can get access, if you joined the waitlist. You can ask us to remove you at any time.
• To keep the service secure, prevent abuse and fix problems.
• To comply with the law and enforce our terms.

Where the GDPR or UK GDPR applies, we rely on these legal bases: performing our contract with you (running the service), our legitimate interests (security, improving the service, and communicating about it), your consent (where we ask for it, which you can withdraw), and legal obligations.

marmy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the features you see in marmy, such as analyzing your site's traffic and search performance.
• We don't transfer it to others except as needed to provide those features, to comply with the law, or as part of a merger or acquisition with notice to you.
• We don't use it for advertising, and we don't sell it.
• We don't use it to train or improve generalized AI or machine learning models.
• People at marmy don't read it unless you ask us to (for example, for support), it's needed for security or to comply with the law, or it has been aggregated and anonymized.

We store the Google refresh token that keeps your connection working encrypted at rest. When you disconnect Google in marmy we revoke it with Google and delete it. You can also remove marmy's access at any time from your Google account permissions.

We don't sell your personal information. We share it only:

• With service providers who host and run the service for us under contract, and only to do that work. Today these are Cloudflare (hosting and network) and Supabase (database, sign-in and account emails). If we add providers, for example for email delivery or AI models, we will update this list.
• With services you tell marmy to use. When you approve marmy to publish content or open a pull request, we send what's needed to that service (for example, GitHub).
• For legal reasons, if we believe it's required by law or needed to protect people, our users or marmy.
• In a business transfer, such as a merger or sale of our assets, in which case we'll tell you before your information becomes subject to a different policy.

We use only cookies needed for the service to work. We don't use advertising or analytics cookies.

• Sign-in cookies keep you signed in to the app. The marketing site checks whether one is present (without reading it) so it can show a link to your dashboard.
• Connection cookies protect the steps of connecting Google or GitHub. They expire after 10 minutes.
• Preferences, such as whether the sidebar is open and your light or dark theme, are stored in a cookie or your browser's local storage.

Some features, such as outreach, can involve information about people who aren't marmy users, for example a prospect's name, role, company and work email. We process that information on behalf of the workspace that uses the feature, which decides why it's processed and is responsible for having a lawful basis to contact those people. If you have been contacted through marmy and want your information removed, email privacy@marmy.dev and we will help.

We keep account and workspace information for as long as your account is open. Connection data is deleted when you disconnect a service. If you ask us to delete your account, we delete your account, workspaces and connections within 30 days, except where we must keep something longer to meet a legal obligation or resolve a dispute. Backups expire on a rolling schedule. Waitlist emails are kept until you get access or ask to be removed. Server logs are kept for a short period for security and debugging.

We protect information with encryption in transit, encryption at rest for connection secrets, access controls that keep each workspace's data separate, and the least access we need from the services you connect. No system is perfectly secure, so we can't guarantee it, but if a breach affects your information we will tell you as the law requires.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how we use it, and to withdraw consent. California residents have the right to know, delete and correct their information, and we don't sell or share personal information for cross-context behavioral advertising. We won't treat you differently for using these rights.

To make a request, email privacy@marmy.dev from the address on your account. We may need to verify your identity, and we will respond within 30 days. You can also disconnect any connected service from marmy at any time. If you're in the EU or UK, you can complain to your local data protection authority.

We and our providers may process information in the United States and other countries, which may have different data protection laws than where you live. Where required, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

marmy is for businesses and isn't directed to children. We don't knowingly collect information from anyone under 16. If you believe a child has given us information, email us and we will delete it.

We will update this policy as marmy changes. We will post the new version here with a new date, and if the changes are significant we will tell you by email or in the app before they take effect.

Email privacy@marmy.dev with any question about this policy or your information.