Privacy policy

This policy has two parts, because Murage has two very different sides.

• The Murage desktop app runs on your computer. Your bots, their memory, your files and your conversations are stored there, not on our servers. Data leaves your computer when you connect something that needs it: the AI provider you choose, and optional services such as Flux Router, connected apps, voice or a cloud computer. Those services process what is sent to them under their own terms. The app also checks GitHub for updates. Today’s releases send no usage analytics; we plan to add usage analytics that you can switch off (see below).
• The murage.ai website works like most websites. If you join the waitlist or send us a message, we hold the details you give us. Our hosting keeps short-lived server logs. We count page visits with a cookie-free analytics service that does not identify you or track you across sites. The site does not run advertising trackers. You do not need an account to browse the site, download the app or use the desktop app. Setting up secure phone access does create a small account, described in the phone section below. Murage Cloud customers have an account; other Murage accounts for the website are not open yet.
• Flux Router is an optional, credit-billed service from Ferrox Labs. If you choose to use it, requests you send through it pass through Ferrox Labs on their way to the model, search, voice or app provider that serves them.
• Murage Cloud is an optional paid service from Ferrox Labs that runs your own copy of Murage on a private server we look after, in the EU. If you subscribe, we hold your server and what is on it for you, as set out in the Murage Cloud section below.

We don't sell your data and don't use it for advertising.

Murage is made by Ferrox Labs. For the website, the announcement emails and the other services we run that are described below, the data controller is Ferrox Labs, LLC, a Florida limited liability company, 1000 Brickell Ave, Suite 715, Miami, Florida 33131, USA.

For the desktop app, most of your data never reaches us at all. It is on your computer and you control it. Where the app sends data to a third-party service you connected (for example your AI provider), that service handles it under its own privacy policy, and in most cases your agreement is directly with them.

Send questions about privacy through our contact form, by email to privacy@murage.ai, or by post to Ferrox Labs, LLC, a Florida limited liability company, 1000 Brickell Ave, Suite 715, Miami, Florida 33131, USA.

Ferrox Labs is based in the United States and has no establishment in the European Union or the United Kingdom. Anyone, wherever they live, can reach us directly through our contact form, by email to privacy@murage.ai, or by post to Ferrox Labs, LLC, a Florida limited liability company, 1000 Brickell Ave, Suite 715, Miami, Florida 33131, USA.

Murage is local-first. The following are stored in Murage’s data folder on your own computer and are not uploaded to Ferrox Labs:

• Your bots, teams, projects, channels and their settings
• Conversations and the results bots produce
• Memory: what bots remember about you, your business and your work, each bot’s own notes, and learned skills
• Files you attach and files bots create in their folders
• House Rules, routines, and your approval choices
• API keys and sign-ins you add for AI providers and other services

Backups are also yours. Murage can make encrypted backups on your computer or copy them to storage you own, such as an S3-compatible bucket or your own server over SFTP. We do not receive them.

The app is open source under AGPL-3.0, so you can read exactly what it stores and sends in the source code.

Apart from the update check, the free built-in web search, the team library list and the optional welcome email step, nothing below happens until you set it up. When you connect a service, Murage sends it what the job needs, and that service processes it under its own terms.

Flux Router and your data

Flux Router forwards each request to the AI provider that serves it, and that provider handles it under its own terms. To run, secure and protect the service, Flux keeps a copy of each request with personal details removed for up to 30 days, then deletes it, and never keeps the raw content. It also keeps request records that contain no prompt content, such as token counts, cost and timing. Flux does not use your prompts or responses to train its models and does not sell or share your personal information. Transcription is done by Groq. On Murage Cloud, to keep costs predictable, Flux may resize images, turn PDFs into text and page images, and convert audio before sending them to the model you picked.The Flux Router privacy policy at fluxrouter.ai has the full details.

You can remove or disconnect most connections in Settings.

Today’s releases of the desktop app send no usage analytics.

We plan to add usage analytics in a future release, so we can see which features people use and where they get stuck. When we do:

• It will be product events only, such as the app being opened, a bot or team being created, or a voice call starting, tied to a random install identifier. If you gave your email in first-run setup, it can be attached to that identifier, and the same switch turns this off
• It will never include your conversations, prompts, bot output, file contents, memory or API keys
• You will be able to switch it off at any time in Settings → General → Usage analytics, and when it is off nothing is sent
• Before the release that turns it on, we will explain in this policy and in the release notes exactly which events are sent, which identifiers they carry, whether your email is linked, how long we keep them and the choices you have

The welcome email step

During first-run setup, Murage asks for your name and email so your Chief of Staff knows who you are. You can skip the email. If you give it, your name and email are saved locally, and sent to our website (murage.ai), which passes them to our account service to sign you up for product announcements, which are delivered through our email provider, Resend. The setup screen says what the email is for before you type it, and skipping the step sends nothing. Every announcement email includes an unsubscribe link.

• Update checks. The installed app checks our public GitHub releases (github.com/FerroxLabs/murage-releases) shortly after it starts and then about once an hour. GitHub sees that request, including your IP address, under GitHub’s privacy statement. Downloading and installing an update is always your choice.
• Crashes. When the app hits an unexpected error it writes the details to a log file on your computer. We found no automatic crash upload in the app: crash details are not sent to us.
• Bug reports. The app can put together a bug-report file (app version and system, on/off settings and counts, the status of chat connections, crash events and the end of the log) for you to paste into a GitHub issue. It leaves out names, paths and message content from the settings and masks known keys and secrets in the log first. Nothing is sent unless you paste it yourself, and a public GitHub issue is public, so read it before you post.
• Downloads Murage makes for you. Some features download components when you turn them on, for example the small local model used for memory search or skills you import from a GitHub link. The app also fetches the team library list from a public GitHub repository (FerroxLabs/murage-teams), and the free built-in web search sends your search queries to Parallel Search, with DuckDuckGo as a fallback.

Because app data is on your computer, you are in control of it. You can make a bot forget any memory from Manage memory, delete bots and conversations in the app, or delete Murage’s data folder entirely. Deleting a conversation also removes its files, its attachments and the history each engine kept for it. Uninstalling the app and removing that folder removes it from your computer.

We cannot see or delete data on your computer for you. Data you sent to a third-party service (such as your AI provider) is held by that service, and deleting it locally does not pull it back. Ask that service directly.

The Murage phone app (iPhone on the App Store, Android on Google Play) connects to Murage on your own computer over HTTPS only. Your messages, transcripts and files are stored on your computer. Murage does not keep them on its servers. The bot's engine, Flux Router (and Groq for audio) process what they are sent, as described above. The phone web app described above works as before.

Secure access and your account

Setting up secure access for your phone creates an account on accounts.murage.ai. You sign in with your email address and a one-time code, and the account holds your email and a record of each phone installation. When you use secure access, your phone reaches your computer through a Cloudflare Tunnel that Murage manages, so that traffic passes through Cloudflare. To have the account removed, contact us through our contact form, by email to privacy@murage.ai, or by post to Ferrox Labs, LLC, a Florida limited liability company, 1000 Brickell Ave, Suite 715, Miami, Florida 33131, USA. We handle requests to delete relay or phone-account data through the contact form or privacy@murage.ai within 30 days.

The notification relay

To deliver alerts to your phone, the app uses a small notification relay that Murage runs. The relay holds only what it needs to deliver alerts:

• a device ID
• your phone’s push token
• a device secret hash
• a device check key (App Attest on iPhone, Play Integrity on Android)

Alerts sent through the relay carry no message text. Your phone then fetches the details from your own computer, so Apple, Google and the relay never see them. Event data is kept for at most 24 hours. The relay never stores your IP address. It uses a keyed, rotating hash of it only for rate limiting, and deletes that hash within about two hours. Its logs record errors only, with no IP address, token or request body.

A pairing you haven't used for 30 days is removed. While you use the app, your phone keeps its pairing current. Removing the computer in the app deletes the pairing from the relay at once, or as soon as your phone is back online.

To delete this data, see Delete your phone app data. We handle requests to delete relay or phone-account data through the contact form or privacy@murage.ai within 30 days.

Service providers for the phone app

• Apple (iPhone) and Google (Android) push notification services deliver notifications
• Apple App Attest and Google Play Integrity check that the app is genuine
• Cloudflare hosts the relay and keeps its own request logs under its own terms. Cloudflare also carries secure-access traffic through the managed tunnel

Scanning a QR code on Android

On Android, the app scans pairing QR codes with the code scanner in Google Play services. Images are processed on your phone and Google does not store them. Google Play services sends Google its own diagnostics (device model, OS version, app version and performance), which the app cannot switch off. When you remove the last computer, the app also deletes its push notification registration with Google. See Google’s ML Kit data disclosure.

Murage for Chrome

Murage for Chrome works only in the tabs you share with a bot. It talks only to Murage on your computer and has no network access of its own. When a bot reads a shared tab, the page text, its structure and screenshots go to Murage, into that bot's conversation, and on to the AI model provider of the bot's own engine, under that provider's terms. Murage also receives the address and title of each shared tab (and of tabs a bot opens), the file name of a blocked download and the text of a page dialog, and a signal that you took over a page so the bot pauses. The conversation stays on your computer until you delete it. Password and other sensitive field values are withheld, and cookies, saved passwords, request headers and tabs you have not shared are never collected. Page text you choose to share with a bot can include personal, financial, health, account or message content. Murage handles it as described in this policy.

Before a step that changes something, such as sending or submitting, an action check reviews it against what you asked for. It sends your request words for the task (up to 4,000 characters) and your standing browser instructions (up to 2,000) to Flux, a Ferrox Labs service, along with a description of the step: its kind, level and site; the name of the control, cut to 300 characters and taken from the page; the destination address and the names of its query parameters; the length of any text typed; and, for a send, up to 200 characters of the assistant's text. A sensitive field is described only as hidden. It sends no screenshots, cookies or bot reasoning. Flux handles it under the Flux Router privacy policy. When Flux is not in use, the check runs on the bot's own engine instead, under that engine's terms, and if neither can run, Murage asks you at each step. When the check runs on Flux, Ferrox Labs receives that data for that purpose.

Murage keeps an activity log of what each bot did in your browser (when, which site, the kind of action and who approved it, and for typing only the number of characters) on your computer for 30 days. The tabs you share, your site choices and the Pause and Stop state stay in the extension and in Murage on your computer until you remove them.

Murage for Chrome's use of information it receives follows the Chrome Web Store User Data Policy, including the Limited Use requirements. In plain words: we use that information only to provide the features you see in Murage for Chrome. We do not sell it, and we do not transfer it to others except to provide those features, to comply with the law, or, with your explicit prior consent, as part of a merger, acquisition or sale of assets. We do not use it for advertising, including personalized or retargeted ads, and we do not use it to judge creditworthiness or for lending. No person reads it unless you give permission for specific data, it is needed for security or to investigate abuse, the law requires it, or it is aggregated and anonymous and used for internal operations.

You can browse murage.ai and download the app without an account. Murage Cloud customers have an account on murage.ai; other Murage accounts for the website are not open yet. The first row below describes what a Murage account holds. The account that secure phone access creates is described in the phone section above.

Setup guide email. If you use “Email me the setup guide” on the website, we collect the email address you type and use it once, to send you the guide. We do not keep the address ourselves. The email is sent through our email provider, Resend, which handles it for us. If you also tick “Also email me occasional Murage news” (it is unticked unless you tick it), we add your address to a mailing list held with Resend and use it to send you Murage news. Every news email includes an unsubscribe link, and you can also ask us to remove you through our contact form, by email to privacy@murage.ai, or by post to Ferrox Labs, LLC, a Florida limited liability company, 1000 Brickell Ave, Suite 715, Miami, Florida 33131, USA. We send the guide because you asked for it, and we add you to the news list only when you tick the box. Resend handles both for us as our processor and keeps its delivery record for the guide email for 30 days.

Murage news. When you first open the Murage app, it asks for your name and email. If you give them, the app sends only your name and email (no device, install or usage identifiers) to Ferrox Labs, LLC, 1000 Brickell Ave, Suite 715, Miami, Florida 33131, USA. You can also sign up on the website. Either way, we add you to the Murage news list, held for us by our email provider Resend, straight away, record where you signed up, when, and the words you agreed to, and email you a getting set up guide. We use that address only to send you new releases, insights, how-tos and tutorials. We never sell it or use it for advertising. Every email has an unsubscribe link, and you can ask us to remove you at any time through our contact form, by email to privacy@murage.ai, or by post to Ferrox Labs, LLC, a Florida limited liability company, 1000 Brickell Ave, Suite 715, Miami, Florida 33131, USA. If you skip the question in the app, nothing is sent; the app only records on your computer that it asked.

The website does not use advertising cookies or trackers that follow you across sites. How-to videos. Our videos stream from Vidalytics. Nothing from the player loads until you press play; then it sets a cookie with a random identifier and records how much of the video is watched, along with the technical details any video stream needs, such as your IP address and browser. We use this only to see how our videos are watched. Partner referrals. If you arrive through a Murage partner’s referral link, our referral provider, FirstPromoter, sets a cookie that records which partner sent you, so the partner can be credited if you later subscribe to Murage Cloud. It is only set for visitors who use a partner link; see the cookie policy. If anything else changes, we will update this policy and the cookie policy first, and ask for consent where the law requires it.

Ferrox Labs sells Murage Cloud. Either we take payment through Stripe, or Link (by Stripe) takes payment as merchant of record on our behalf. The payment page shows which. What we hold for Cloud customers is set out in the Murage Cloud section.

This section applies only if you subscribe to Murage Cloud. In short: we run a private server for you in the EU. You own what is on it. We only look at it to run it, fix it when you ask, stop abuse, or when the law says we must.

What we hold

• Your account and billing details, such as your name, email address, plan, billing country and, for businesses, tax number. A payment processor handles your card. We never see your full card number.
• The contents of your server: your Murage data, bots, files and memory. They are stored encrypted. We hold the key, so we can run, back up and restore your server.
• Support messages you send us.
• Logs of access to your server.
• Refund codes. To give our 7-day first-month refund once per person, we keep a scrambled code (a keyed hash) of the card identifier our payment processor gives us (never your card number), of your email addresses, and of your billing name and address. A code cannot be turned back into your card, email or address, but these codes are still personal data. We use them only to see whether a new payment matches an earlier one.

Why we use it

• Contract: to run your server, back it up, bill you and support you.
• Legitimate interests: to keep servers secure, to prevent and investigate abuse, and to give our 7-day refund offer once per person or payment method.
• Legal obligation: to keep billing and tax records as the law requires.

Where it is

Your server and its backups are in the EU, in Germany or Finland, or in another EU data centre if those are full. Ferrox Labs is a US company. It may access Murage Cloud data from outside the EU and UK to run and support the service. Email privacy@murage.ai if you have questions.

Who handles it

• Hosting and backup providers whose data centres we use are in the EU, who store your server and its backups
• A key-management provider, which holds the keys that encrypt your server and backups and logs every use
• A network and content-delivery provider, which carries traffic between you and your server and runs our account service
• A payment processor, who takes your payment and handles card data (outside the US this is Link, which is also a separate controller, see below)
• An email provider, who delivers account and support emails

Our service providers process data for us under contract. We do not sell your data.

If Link (by Stripe) takes your payment as merchant of record on our behalf, Stripe and its affiliates also act as separate controllers for their own payment, fraud-prevention, tax, legal and Link services, as the Link privacy center explains. Depending on the payment, the records we get from Stripe or Link can include your name and email address, billing address, tax number, payment method type and last four digits, what you bought, amounts and currency, tax, subscription and payment status, refunds and chargebacks. We handle the records we receive under this policy. If you ask Link to delete your data, that also ends your plan.

We use the approximate country of your IP address (from our hosting provider) only to suggest your country at checkout. The country you confirm decides which payment page you see. We keep the suggested country with your checkout record as proof of how you were routed.

If you use ‘Cancel your contract here’ without signing in, we keep what you enter (email address, name, anything that identifies your plan, type, date and reason), the time we got it, and the IP address and browser details (for proof and to stop abuse). We use them only to find your plan, carry out and confirm your cancellation, and keep a record of it.

When you withdraw or cancel by email or on the public form, we may send a one-time confirmation link to your account’s registered email. The link is tied to that address and stops working if it or your account record changes, once used, or after 7 days; you can ask for a new one. The same email has a ‘This wasn’t me’ link, which puts the request on hold.

Backups

We back up your server every night, encrypted. We keep 7 daily and 4 weekly copies. Ferrox Labs holds the key and can unlock your server and its backups to run, restore and support it, and every unlock is logged. Your Claude and ChatGPT sign-ins are never backed up.

When we access your server

• to run it, update it and back it up;
• to fix a problem you ask us to fix;
• to investigate suspected abuse or a security problem; and
• when the law requires it.

Your AI providers

You sign in to Anthropic and OpenAI directly. They process your prompts under their own terms and privacy policies, not ours.

How long we keep it

We keep your server and its data while you subscribe. If your server is suspended, we keep everything for 30 days. If you have asked for an export, we wait until we have sent it. Only your first export request in that time pauses deletion; we still answer later requests before deletion. If you switch providers under the EU Data Act, you can get your data back for at least 30 days after the agreed switch ends, and we do not delete it before then. After that, the server, its data and its backups are deleted together, and we do not delete them before the 30 days end. After that we keep only these records: invoices, billing and tax records for as long as tax and accounting law requires; support emails for up to 24 months after our last reply; the log of backup unlocks and server access for 24 months from each entry; refund codes for 24 months after the payment they come from, even if you close your account; and records of what you accepted (the terms version, your choices at checkout and at first run of the app, the time, your account, the text shown on the checkout step and payment page, the country and checkout language you confirmed, your request to start your server and its time, your renewal confirmation, any tax ID you enter on the payment page, and any withdrawal or cancellation request with the time we received it and, where we can tell, the time you sent it, and the IP address and browser details), kept for at least 3 years after you accept, or 1 year after your plan ends, whichever is later. We use these records only as proof of what you agreed. One exception: we use the approximate country from your IP address only to suggest your country at checkout, and you confirm or change it there. Records under a legal hold are kept only while the hold lasts.

We keep the refund codes for 24 months after the payment they come from, then delete them. We keep them for that time even if you close your account, so the offer stays one per person. This is our legitimate interest in preventing abuse of the offer. You can object to it at any time, for reasons about your own situation, by writing to support@murage.ai. We then stop using your codes unless we show compelling legitimate grounds that override your interests, rights and freedoms. For example, a record that you already had this refund can be such a ground. If we say no, we tell you why, and you can complain to a data-protection authority or go to court. While we check, we keep your codes but do not use them. We look at each objection on its own and give you our reason in the reply.

Your rights

Your rights are the same as in the rest of this policy. See Your rights. The Murage Cloud terms cover the rest of the service.

You can object to our keeping refund codes about you: write to support@murage.ai.

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR and UK GDPR:

• Contract: to give you the services you asked for, such as Flux Router, secure phone access and the notification relay, and your account.
• Consent: for the Cloud waitlist, product announcement emails and the Murage news list. You can withdraw it at any time with the unsubscribe link or by contacting us.
• Legitimate interests: to send you something you asked for once, such as the setup guide, to credit and pay the partner who referred you, and to keep the website and accounts secure, prevent abuse and answer your messages.
• Legal obligation: where we must keep or disclose information by law.

We use a small number of service providers to run the website, your account and the services above. Most process personal data on our behalf and under contract; where a provider acts on its own terms instead (for example an AI provider you connect with your own key, or Apple for its own services), we say so in this policy:

• Supabase: authentication and account database
• Vercel: hosts the website, with functions running in the United States (Washington, DC area), and keeps its server logs
• Our email delivery provider: delivering contact-form messages to us and account emails such as sign-in links
• Resend: the setup guide email, the optional news list and product announcement emails
• Cloudflare: our account and announcement service (accounts.murage.ai) runs on Cloudflare, Cloudflare Tunnel carries secure phone access traffic, and Cloudflare hosts the phone notification relay
• Apple and Google: their push notification services, App Attest and Play Integrity for the phone app, and Google sign-in only if you choose it
• Groq: speech transcription for Flux Router voice, and for voice if you use your own Groq key
• Anthropic, OpenAI and Google: AI models that Flux Router uses to route and grade requests, when you use Flux Router
• GitHub: hosting app downloads, updates and source code
• For Murage Cloud subscribers only: EU hosting and backup providers, a key-management provider, a network and content-delivery provider, a payment processor and an email provider (see Murage Cloud above)
• FirstPromoter: partner referral tracking, only for visitors who arrive through a partner link, and paying our partners
• Vidalytics: streaming our how-to videos and counting views, only for visitors who press play

We may also disclose information if the law requires it, to protect people from harm or to protect our rights, or as part of a merger or sale of the business, in which case this policy continues to apply.

We don't sell your data and don't use it for advertising. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Services you connect inside the desktop app (your AI provider, Box, ElevenLabs, Telegram, WhatsApp and others) are your own choice and receive data directly from your computer under their terms. They are not our processors. Flux Router is the exception: it is our own optional service, described above. For Flux Router, Ferrox Labs is the controller for your Flux account, billing, and the routing, grading and abuse checks it runs for its own purposes. For the content of your requests, Ferrox Labs handles it on your instructions to serve the request, and each provider Flux Router passes it to receives it for that purpose under its own terms and data processing agreement with us. Our role and each recipient’s role for that content depend on the processing and the agreement that applies; ask us through our contact form, by email to privacy@murage.ai, or by post to Ferrox Labs, LLC, a Florida limited liability company, 1000 Brickell Ave, Suite 715, Miami, Florida 33131, USA if you need the detail for your own records.

Ferrox Labs processes information in the United States. What you give us directly, such as a waitlist or contact-form entry, a secure phone access account or a Flux Router request, comes to us there. Where we pass personal data to a provider and that disclosure is subject to international-transfer rules, we use the mechanism listed for that recipient below, or say so where we rely on an exception. Email privacy@murage.ai for a copy of the contractual safeguards that apply.

• Vercel (hosting and server logs) and Supabase (accounts): the European Commission’s Standard Contractual Clauses with the UK Addendum, under each one’s data processing agreement
• Cloudflare, Resend and GitHub: certified under the EU-US Data Privacy Framework with its UK extension, with the Standard Contractual Clauses as a fallback
• Google (push notifications, Play Integrity, Google sign-in, and models Flux Router uses): certified under the EU-US Data Privacy Framework with its UK extension
• Apple (push notifications and App Attest): Standard Contractual Clauses; Apple Distribution International Limited in Ireland controls EEA and UK data on Apple’s side
• Anthropic (models Flux Router uses): Standard Contractual Clauses
• OpenAI (models Flux Router uses) and Groq (transcription): the transfer terms in each one’s data processing agreement with us
• Murage Cloud: your server and backups are stored in the EU. Ferrox Labs is a US company and can access your data from outside the EU to operate and support Murage Cloud. EU storage does not mean EU-only access. We do not use Standard Contractual Clauses or the Data Privacy Framework for our own access
• FirstPromoter (partner referrals): based in the European Union, with some processing in the United States under the transfer terms in its own privacy policy
• Vidalytics (video streaming and view counts): based in the United States, under the EU Standard Contractual Clauses and the UK transfer addendum in its data processing addendum

If you want a copy of the transfer terms that apply to a provider, ask us through our contact form, by email to privacy@murage.ai, or by post to Ferrox Labs, LLC, a Florida limited liability company, 1000 Brickell Ave, Suite 715, Miami, Florida 33131, USA.

We use encryption in transit, access controls and reputable providers to protect the data we hold. Passwords for any Murage account are never stored in plain text. No system is perfectly secure.

In the desktop app, the files that hold your bots and channels can be read only by your own user account, and you choose what each bot may do without asking. New bots start in Ask mode; a specialist that a Chief of Staff in Auto creates starts in Auto, like its Chief. See privacy and security for how approvals work.

To report a security issue privately, follow the security policy on GitHub. Please do not open a public issue.

Everyone

You can ask us for a copy of the personal information we hold about you, ask us to correct it or delete it, and unsubscribe from emails at any time. If you have a Murage Cloud account, you can ask us to delete it.

EEA and UK (GDPR and UK GDPR)

You have the right to:

• access your personal data
• have inaccurate data corrected
• have your data erased
• restrict how we use it
• receive it in a portable format
• object to processing based on legitimate interests
• withdraw consent at any time, without affecting earlier use
• complain to your local data protection authority, or in the UK to the Information Commissioner’s Office (ico.org.uk)

California (CCPA and CPRA)

California residents have the right to know what personal information we collect, use and disclose; to delete it; to correct it; and to opt out of its sale or sharing. We don't sell your data and don't use it for advertising. We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information to infer characteristics about you. We will not treat you differently for using your rights. You can use an authorized agent, and we may need to verify your identity first.

In the last 12 months, the categories we collected are the ones described in this policy. Identifiers: name, email address, IP address, a device ID and push token for the phone notification relay, the account and phone installation record created by secure phone access, and a referral identifier if you arrived through a partner link. Internet activity: server logs, the partner referral cookie, and, if you use Flux Router, the User-Agent of your requests and your Flux account and usage data. Commercial information: if you buy Flux Router credits, the purchase and credit-balance records that Flux Router keeps under its own privacy policy. Commercial information also includes your Murage Cloud plan and billing records if you subscribe; the contents of your Cloud server; and logs of access to it, as the Murage Cloud section describes. Audio: voice you send through Flux Router, which Groq transcribes; Groq may keep inputs and outputs for up to 30 days for reliability and abuse checks under its published retention rules. The contents of messages you send us, and, if you use Flux Router, a copy of each request with personal details removed, kept for up to 30 days. Content you send through Flux Router may contain sensitive personal information; we process it only to provide the service you asked for, and we do not use sensitive personal information to infer characteristics about you. We do not ask for precise geolocation or biometric information, though content you choose to send could contain it. The desktop app sends no usage events today.

How to ask

Write to us through our contact form, by email to privacy@murage.ai, or by post to Ferrox Labs, LLC, a Florida limited liability company, 1000 Brickell Ave, Suite 715, Miami, Florida 33131, USA. We answer within one month (GDPR) or 45 days (CCPA), and will tell you if we need longer. Remember that we cannot reach data stored in the desktop app on your computer. You can delete that yourself at any time.

Murage and murage.ai are not intended for children. You must be at least 18 to use our services. Murage is for adults 18 and over. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

We will update this policy when what we collect or how we use it changes, for example when we add a new service. We will change the effective date at the top, and for significant changes we will give notice on the site or by email before they take effect.

Ferrox Labs, LLC, a Florida limited liability company, 1000 Brickell Ave, Suite 715, Miami, Florida 33131, USA

Or use the contact form. We read and answer every message.

For privacy requests, email privacy@murage.ai.

A phone number for legal and contract notices is shown on the checkout step of your account and in your order confirmation email. We don’t provide support by phone. For help, email support@murage.ai.