Privacy for your
Mission workspace.

1. Scope and contact.

Phenomena Labs Ltd. operates Mission’s hosted connector. Questions and data requests can be sent to founders@phenomenalabs.com.

This connector-specific draft does not replace the policies for the general marketing website, local Mission installations, GoMission Remote, the optional mobile relay, or a separate subscription account service. See the general Mission privacy policy for those surfaces.

2. Data processed by the connector.

Account and authorization data. The standalone service processes the email-shaped login identifier and optional account name; password submissions during authentication and a stored salted password hash; account status; workspace membership; OAuth client details, callback URL, requested permissions, resource, consent flow and token/session records. Passwords are not accepted through MCP tools and are not stored in plain text. The service does not verify ownership of the signup email.

Workspace content. Depending on what you or an authorized operator add, saved context can include tasks, priorities, due dates, goals, open loops, relationship notes, draft summaries, local review packets, receipts, writing preferences, learning rules and research. These records may identify colleagues, clients or other people. Add only material you are authorized to use.

Tool inputs. The selected 19-tool contract accepts declared setup/navigation options, search text and limits, opaque item references, task titles/notes/priorities/dates, retry keys/current versions, and bounded local-packet fields. It does not request the full conversation, provider credentials or Calendar event fields. Only provide the task-specific information needed for the requested operation.

Tool outputs. Results contain relevant account-state booleans and setup links; workspace items and summaries; task status, priority and due date; source freshness; counts; opaque references/current versions; access-controlled artifact links; and confirmation of local preparation or task changes. Item content can include professional information stored in that item. A source timestamp describes saved content, not live provider verification.

Operational data. The application request logger records request method, endpoint path without its query string, response status, duration, RPC method names, error count and authentication mode. A browser artifact path can contain opaque workspace/item references. This logger does not record tool arguments/results, passwords, authorization headers or query strings. The hosting and network providers may separately process connection metadata such as IP address, browser information, path, status and time.

3. Why the data is used.

Data is used to authenticate the account, enforce workspace access and selected permissions, perform the tool operation you requested, preserve task changes and retry results, display source content, prepare local review artifacts, diagnose service problems and handle support or data requests.

The free connector does not create Calendar events, send messages, publish material, start subscriptions or take payments. A local task marked Done is a saved status, not evidence of an external action. The connector does not automatically link an existing workspace using an email match.

4. Recipients and boundaries.

Your OpenAI client. When you invoke Mission in ChatGPT or Codex, OpenAI receives the tool inputs the client sends and the results Mission returns. OpenAI processes them under the terms, privacy policy and account settings applicable to that product.

Service infrastructure. The selected service is hosted by Render in Oregon, United States. Render processes hosted account and workspace records and operational connection data. Its Mission workspace is on the Hobby plan. These facts were checked against service records and the authenticated Render support conversation on 27 September 2026. Any additional delivery provider and support-email provider must be recorded before publication; this candidate does not assert an unverified Cloudflare integration.

Support and administration. Service operators may need access to stored records to maintain the service, verify an access request, diagnose a reported issue or carry out an export or deletion. Emailing support also sends the material you include to Mission’s email provider. Avoid including passwords or tokens.

Other connected services. These 19 tools use saved Mission context and make local workspace changes. They do not enable a Calendar provider or carry out external sends, posting or payment. Content previously brought into a workspace by another authorized workflow remains subject to that workflow’s policies.

These candidate pages include no analytics scripts, third-party fonts or advertising trackers. Visiting other Mission website pages may invoke the separate website practices described in the general privacy policy.

5. Retention.

Accounts and workspace records: account records, password hashes, saved work, local artifacts and task retry history remain until an operator removes them. The standalone release has no automatic account/workspace deletion schedule. Disconnecting a client does not delete those records.

Authentication records: consent flows last 10 minutes; authorization codes last 5 minutes and are consumed after a successful exchange; access tokens last 1 hour; refresh tokens rotate and last 30 days per issuance; hosted browser sessions last 24 hours. Secrets are stored as hashes. Expired records are cleaned up on later authentication-store mutations, not by a guaranteed immediate purge.

Logs, backups and support correspondence: Render’s Hobby workspace log retention is seven days. This is platform log availability, not a promise that every operational record everywhere is erased after seven days. The current service has no persistent disk or verified hosted-data backup. The proposed paid disk uses automatic daily snapshots retained for at least seven days; that is a minimum availability period, not a verified deletion deadline. Before publication, verify the installed storage and snapshot behavior and record the operator’s support-record and backup-deletion procedures. Token expiry and removal from active storage do not prove backup erasure.

6. Available controls.

Choose what to add to Mission, review requested OAuth permissions, decline connection, use a different account at sign-in, and disconnect the connector in your client. The standalone authorization service provides token revocation; the operator can also remove a workspace membership. These access changes are distinct from deletion of stored content.

To request access, a portable export, correction, recovery, restriction or deletion, contact founders@phenomenalabs.com and identify the account/workspace without sending credentials. The request is handled by an operator, who must verify authority before disclosing or removing data. There is no self-service hosted export or account-deletion interface in this release.

A verified request-handling process, response deadline, deletion-completion timeline and backup treatment must be documented before publication. This draft does not promise an unimplemented automatic deletion or export service.

7. Credentials and sensitive content.

Enter passwords only on the Mission-owned authentication page. Do not place authentication secrets, payment-card data, government identifiers, health records or unnecessary sensitive personal information into tool fields or workspace material supplied to the connector. Do not send credentials to support or paste them into chat.

Account password authentication does not verify email ownership or enable enterprise email-domain restrictions. An existing workspace requires explicit authorized linkage; account recovery or data disclosure must not rely on the signup email alone.