Privacy policy

MoggingLabs makes MoggingLabs Workspace, a desktop app for running AI coding agents. MoggingLabs is the data controller for the processing described in this policy. You can reach us at hello@mogginglabs.com for anything privacy related.

We process very little, and only for these purposes:

• Visiting this website. There are no accounts here. We measure traffic ourselves, first-party and cookieless: your browser tells us which page was viewed, and we count it under a code derived from your IP address and browser with a salt that rotates every day. The raw IP address is never stored, the code cannot be linked from one day to the next, and it cannot be reversed into you. If your browser sends Do Not Track or Global Privacy Control, we count nothing at all. Raw counts older than 90 days are reduced to daily aggregates. The legal basis is our legitimate interest in understanding site usage without surveilling anyone (GDPR Article 6(1)(f)). Separately, our hosting provider briefly processes standard server logs, including your IP address, to deliver pages and protect the site from abuse; those logs are kept for a short period and are not used to identify you.
• Subscribing to the newsletter. If you sign up, we process your email address to send you the newsletter you asked for, on the basis of your consent. We use double opt-in, so nothing is sent until you confirm from your inbox, and every email carries an unsubscribe link that works immediately. The form is protected by a bot check (Cloudflare Turnstile) that runs only when you use it and sets no cookies.
• Using the contact form. If you write to us through the contact page, we receive your message, your email address, and any name you choose to give, and we use them only to answer you. The form is protected by the same cookieless bot check (Cloudflare Turnstile) as the newsletter, and it runs only when you use the form. The legal basis is our legitimate interest in responding to people who contact us (GDPR Article 6(1)(f)). Messages are kept only as long as the conversation needs.
• Requesting early access. If you email us or use the request form, we receive your email address and whatever you choose to include. We use it to send you builds and release notes you asked for, and for nothing else. The form is protected by the same cookieless bot check (Cloudflare Turnstile) as the others, and it runs only when you use it. The legal basis is taking steps at your request before entering a contract (GDPR Article 6(1)(b)) and, for further updates, your consent, which you can withdraw at any time. Every email we send tells you how to opt out.
• Using the app. MoggingLabs Workspace is local-first. Your workspaces, command history, code, and API keys stay on your machine and never reach us. Telemetry is off unless you explicitly opt in, and if you do, it covers app health only: crashes and performance budgets, never terminal contents, code, or credentials.

This website sets no cookies on visitors. None: not for analytics, not for advertising, not for anything else. The newsletter form’s bot check runs without cookies too. That is why you do not see a cookie banner, since there is nothing to consent to.

The one cookie that exists at all is a strictly necessary session cookie for site administrators, set only after an administrator signs in to the site’s private admin area. If you are reading this as a visitor, you never receive it.

If we ever introduce cookies or similar technologies that are not strictly necessary, we will ask for your opt-in consent first, through a clear accept-or-decline choice, before anything is stored on your device. Declining will never block you from the site.

We do not sell personal information, we do not share it for advertising, and we run no third-party trackers. The only parties that touch data on our behalf, all acting as processors under contract, are the infrastructure providers that host this website and our email, the platform that delivers the newsletter, and Cloudflare for the signup form’s bot check. Fonts and all other assets are served from our own deployment, so simply viewing this site triggers no third-party requests; the one exception is the newsletter form, which contacts Cloudflare only when you use it.

We measure traffic ourselves, on our own infrastructure, with no third party involved: no cookies, nothing stored on your device, no persistent identifiers, and no fingerprinting beyond a visit code that rotates daily and cannot follow you from one day to the next. Everything we keep long-term is aggregate counts, which is why no consent banner is needed for it.

Early-access correspondence is kept while we are in touch with you and deleted when it stops being relevant, or immediately when you ask. Newsletter addresses are kept until you unsubscribe, which every email lets you do in one click. Raw traffic counts are kept for 90 days, then reduced to daily aggregates with nothing visitor-level in them. Server logs are retained briefly by our hosting provider on a rolling basis. Opt-in app telemetry, if you enabled it, is kept in aggregate form only.

Our website and email may be hosted on infrastructure in the United States. Where personal data of EU, EEA, UK, or Swiss residents is transferred there, we rely on providers that participate in the EU-U.S. Data Privacy Framework or that offer Standard Contractual Clauses.

If you are in the EU, EEA, UK, or Switzerland, you have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to our processing of it, and to withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority.

If you are a California resident, you have the right to know what personal information we collect (it is all described above), to request its deletion or correction, and to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. We never discriminate against you for exercising any right.

To exercise any of these rights, email hello@mogginglabs.com. We will verify the request using the email address you contacted us from and respond within the legally required time, which is 30 days in most cases.

Do Not Track and Global Privacy Control are honored in full: when your browser sends either signal, our traffic counter sends and stores nothing at all, and there is nothing else to opt out of.

This site and the app are not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has sent us personal information, contact us and we will delete it.

If this policy changes in any material way, we will post the updated version on this page with a new effective date at the top. For significant changes affecting early-access users, we will also tell you by email.