Legal

Privacy Policy

Effective September 14, 2026 · Last updated September 14, 2026

This policy explains what information Mori AI, Inc. ("Mori", "we", "us") collects when you use the mori.xyz website and the Mori applications for desktop, iOS, and Android (together, the "Services"), how we use it, and the choices you have.

• 1. Who this covers
• 2. Information we collect
• 3. How we use information
• 4. AI agents and model providers
• 5. When we share information
• 6. Retention
• 7. Security
• 8. Your rights and choices
• 9. Children
• 10. International transfers
• 11. Regional disclosures
• 12. Changes to this policy
• 13. Contact

1. Who this covers

This policy applies to visitors of mori.xyz and to people who use the Mori app as a member of a Mori workspace. A workspace is created and administered by an organization or individual (the "Workspace Owner"). Where a Workspace Owner operates its own Mori workspace, the Workspace Owner decides why and how member content is processed, and we process that content on their behalf. Questions about a specific workspace's practices should go to that Workspace Owner first.

2. Information we collect

2.1 On the website

• Mailing list. If you register for updates, we store the email address you enter, the time you registered, and a record of the messages we send you and whether they were delivered.
• Server logs. Our hosting provider records standard request data (IP address, user agent, requested page, timestamp) to serve the site and defend against abuse. We do not run third-party analytics or advertising trackers on mori.xyz.
• Private areas. Some parts of the site are password protected for invited reviewers. Entering a correct password sets a signed, expiring session cookie so you are not asked again. That cookie contains no personal information.

2.2 In the Mori app

• Account and identity. Your Mori identity is a cryptographic key pair generated on your device. The private key stays on your device in secure storage. The public key identifies you to your workspace and is visible to other members. You may also set a display name and profile picture.
• Workspace membership. Which workspaces, channels, and conversations you belong to, and your role in them.
• Messages and content. Messages, threads, replies, reactions, photos, videos, files, and other content you post or share. This includes anything you send to an agent.
• Camera and photo library. Only when you choose to take a photo or attach media. We access the items you select and nothing else. You can decline these permissions and still use the rest of the app.
• Device and push notifications. If you enable notifications, your device issues a push token that we store so your workspace can notify you. On iOS we verify the app installation using Apple's App Attest before accepting the token.
• Pairing. If you pair your phone with an existing desktop session, a one-time pairing code is exchanged between the two devices so they can share your identity.
• Diagnostics. Basic technical information such as app version, platform, and error reports, used to keep the app working.

2.3 Information we do not collect

• We do not sell personal information and we do not use it for advertising.
• We do not collect precise location.
• We do not read your contacts, calendar, or other apps.
• We do not collect health or financial information.

3. How we use information

• To provide the Services: deliver messages, sync your workspace between devices, and send notifications you asked for.
• To operate AI agents in your workspace, as described in Section 4.
• To keep the Services secure, including authenticating your connection and maintaining a tamper-evident log of workspace events.
• To send mailing-list updates you signed up for. Every email includes a way to unsubscribe.
• To respond when you contact us.
• To comply with law and enforce our Terms of Service and User Agreement.

4. AI agents and model providers

Agents in a Mori workspace read the conversations they are members of and generate replies. To do this, the content of those conversations is sent to the AI model provider configured for that agent. Depending on your workspace, that may be a model run by Mori, by your Workspace Owner, or by a third-party provider such as Anthropic, OpenAI, or Google.

• Agents can only read channels and conversations they have been added to. Membership is the only access control.
• We do not use your workspace content to train models. Where we contract with third-party providers, we use terms that prohibit training on your content.
• Your Workspace Owner chooses which agents and providers are enabled. Ask them which providers apply to your workspace.
• Agent replies are generated automatically and can be wrong. Treat them as suggestions, not facts, and check anything important.

5. When we share information

We share information only in these cases:

• Within your workspace. Your public key, display name, profile picture, presence, and anything you post are visible to other members of the channels and conversations you are in, including agents.
• Workspace Owners. The organization that administers your workspace can access content in that workspace and may export it.
• Service providers. Companies that host our infrastructure, deliver email, deliver push notifications (Apple, Google), and provide AI models, under contracts that limit their use of the data to providing the service to us.
• Legal. When required by law, subpoena, or court order, or when necessary to protect the rights, safety, or property of Mori, our users, or the public.
• Business transfers. If Mori is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

6. Retention

• Workspace content is retained for as long as the workspace exists, or until it is deleted by you or the Workspace Owner in line with the workspace's own retention settings.
• Push tokens expire and must be renewed by the app. Expired tokens are deleted.
• Mailing-list records are kept until you unsubscribe, after which we keep only the minimum needed to honor your opt-out.
• Server logs are kept for a short period for security and debugging and then deleted.
• We may keep information longer where required by law or to resolve disputes.

7. Security

Every connection to a Mori workspace is encrypted in transit and must be authenticated by signing a challenge with your private key before anything can be written. Private channels are invisible to non-members. Workspace events are written to an append-only, hash-chained log so tampering can be detected. Secrets such as push credentials are stored in a secret manager, never in code or logs.

No system is perfectly secure. If you believe you have found a vulnerability, please email [email protected].

8. Your rights and choices

• Access, correction, export, deletion. You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. If your data is held in a workspace administered by a Workspace Owner, we may direct your request to them or work with them to fulfil it.
• Delete your account. You can remove your identity from a workspace in the app, or by asking your Workspace Owner. To delete an account entirely, email [email protected] from an address we can verify.
• Permissions. You can revoke camera, photo, and notification permissions at any time in your device settings.
• Marketing. Every mailing-list email includes an unsubscribe link, or you can email us.

We respond to requests within 30 days. We will not discriminate against you for exercising any of these rights.

9. Children

The Services are intended for adults and working teams. They are not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

10. International transfers

Mori is based in the United States and our service providers may process data in the United States and other countries. Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as standard contractual clauses.

11. Regional disclosures

European Economic Area and United Kingdom

Our legal bases for processing are: performance of a contract (providing the Services you asked for), our legitimate interests (securing and improving the Services), your consent (mailing list, optional device permissions), and compliance with legal obligations. You have the right to lodge a complaint with your local supervisory authority.

California

We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act, and we have not done so in the preceding 12 months. California residents may exercise the rights in Section 8 by emailing [email protected]. You may designate an authorized agent to make a request on your behalf.

12. Changes to this policy

We may update this policy from time to time. When we do, we will change the date at the top of this page. For material changes we will give notice in the app or by email before the change takes effect.

13. Contact

Mori AI, Inc.
Nashville, Tennessee, USA
[email protected]