How MYOA handles your data

What is saved

Account details, chats, selected uploads, generated work, mission reports, browser screenshots and connector results are stored so you can return to your work. Passwords are stored as salted hashes. Authenticator secrets are encrypted with a server-held key; recovery codes and email links are stored as hashes.

Services that process your information

• Railway hosts the application and its database.
• OpenAI processes prompts and attachments selected for AI work. Background response storage is currently enabled; MYOA does not promise zero provider retention.
• Composio handles connectors and actions you choose to execute. Retrieved records can be saved in MYOA.
• E2B hosts isolated cloud execution, including working files and browser evidence.
• Resend delivers account verification and password recovery messages when email delivery is configured.

Data needed for these features leaves your device. This is not end-to-end encryption; authorized infrastructure operators and providers can process data needed to run the service.

Access controls

Private work is scoped to your account. Sign-in sessions can be revoked, connector actions require review, and the cloud browser does not inherit your personal browser’s cookies. These controls do not guarantee that every website or generated AI action is safe.

Retention and deletion

Security event records expire after 90 days. Expired account links, sessions and login-rate-limit records are cleaned up automatically. Saved work and external provider copies do not yet have a complete automatic retention policy. Deleting a file or disconnecting an app does not necessarily remove older task outputs, screenshots or provider copies.

You can request account deletion in Security & privacy. This locks access and creates an operator request; completion requires checking application data, cloud workspaces and external providers. Backup retention and independent security verification remain launch prerequisites.

Your choices

Use synthetic or non-confidential data during the pilot. Connect only accounts needed for your work, review each action, and enable two-step sign-in. Public signup remains paused by default.