Effective and last updated October 12, 2026
1. Scope and controller.
This policy applies to Mission websites, local Mission workspaces, hosted Mission workspaces, Mission’s remote MCP service, the Mission app used from ChatGPT or another compatible client, and GoMission Remote for iPhone. Phenomena Labs Ltd. (“Mission,” “we,” “us”) is responsible for the hosted service and optional mobile relay. For questions or requests, email missionexecutionlayer@gmail.com.
A local workspace is controlled by the person or organization operating that installation. A hosted workspace stores its operational files on Mission’s infrastructure. The interface identifies which mode you are using.
The free standalone hosted connector has a dedicated privacy policy describing its current tools, authentication and retention. That policy governs the connector where its details differ from this general website policy. The accounts and billing service described below is a separate service, currently in sandbox testing; paid public signup is not open.
2. Data we collect.
Account and connection data. If you create or connect an account, we process your name, email address, a salted password hash (never the plain-text password), account and sign-in state, OAuth client/provider, requested scope, redirect URI, login hint, authorization code, hashed access token, token expiry, and workspace association. Mission tools do not accept passwords, API keys, multi-factor authentication codes, or raw access tokens as tool input.
Workspace and professional context. Depending on what you add or connect, Mission may process workspace settings; goals; tasks; priorities and due dates; relationship or promise notes; draft titles and summaries; approval packets; receipts and outcome summaries; voice-learning preferences, counts, keep/cut phrases, edits, approvals and rejections; learning-rule counts; market-research signals, sources, topics and task summaries; and connector-derived email, calendar, chat, social, document, or website context.
Tool inputs and outputs. A connected client sends the fields declared for the requested tool and receives relevant saved work, summaries, item references, permission-limited links and confirmations. Mission does not request a full chat conversation unless you deliberately include it in a tool input. The standalone connector policy describes that service in detail. Private credentials are not accepted as MCP tool inputs.
Operational data. Our application records the request method, endpoint path without its query string, response status, duration, RPC method name, error count, and authentication mode. It does not log tool arguments, tool results, authorization headers, OAuth query parameters, remote IP addresses, or workspace identifiers. Network and hosting providers may independently receive standard connection metadata such as IP address, user agent, host, path, status, and time.
Website analytics. The public gomission.io site currently uses Google Analytics and StatCounter. They may collect visit time, pages and referrer, approximate location derived from IP address, browser, operating system, device and screen information, and first-time/returning-visitor identifiers. Google Analytics uses first-party _ga cookies; StatCounter may use is_unique or sc_is_visitor_unique cookies. Website analytics are not joined to private Mission workspace content or returned by Mission tools.
2A. GoMission Remote data.
The iPhone app stores the paired Mission base URL in app-only iOS preferences and the pairing token in the iOS Keychain. It reads workspace status, Mission prompts and items, approval packets, enabled capability descriptions, execution state, and receipts from the workspace you pair. It sends only the local edits, decisions, commands, and exact action fields you deliberately enter or approve. QR camera frames are processed on device and are not stored by Mission. The app contains no advertising or analytics SDKs and does not track you across apps or websites.
2B. Hosted accounts and billing.
Sign-in and saved work. The separate hosted accounts service uses Auth0 for signup, verified email, sign-in and password recovery. Password entry occurs on Auth0’s sign-in pages; this service receives the verified identity claims needed to create or find your account, not your password. Mission stores the provider identity reference, email, account state, session-token hashes, organization/workspace membership, tasks and their changes. The current browser session expires after 24 hours. Existing local workspaces and the standalone connector are not automatically linked by matching email addresses.
Payments. Paddle hosts website checkout and acts as merchant of record. Paddle receives the checkout contact, billing and payment information you provide. Mission stores payment-provider customer, transaction and subscription references, selected price and billing period, subscription/refund status, verified event records and the related account or organization. These records enforce access, prevent duplicate processing and support billing inquiries. Mission’s accounts server does not receive the full card number or card security code from hosted checkout. Sandbox transactions use a separate test environment; they are not real sales.
Optional AI. Hosted AI is currently disabled in the deployed accounts sandbox. If you explicitly configure a supported user-owned AI key, Mission stores it encrypted and uses it to send your request and limited workspace task context to the selected provider. Your provider’s terms, retention settings and usage charges apply. Do not place provider keys in chat or support messages.
3. How we use data.
We use the data above to authenticate and route the correct workspace; answer the tool you chose; search, summarize, prioritize, and display your Mission context; prepare local review artifacts and receipts; learn workspace-specific drafting preferences from your decisions; connect GoMission Remote to the workspace you chose; carry an allowlisted mobile request to that workspace; prevent unauthorized or excessive access; diagnose availability and security problems; respond to support and privacy requests; and comply with law. We do not use private workspace content for advertising, sell it, or use it to train a general-purpose Mission model.
4. Recipients and disclosures.
OpenAI. When you use Mission in ChatGPT, OpenAI receives the tool inputs ChatGPT sends and the tool outputs Mission returns. OpenAI processes that data under your OpenAI account settings and OpenAI’s applicable terms and privacy policy.
Infrastructure providers. Render hosts the current MCP application and hosted workspace storage, and the separate accounts service and PostgreSQL database, in Oregon, United States. DreamHost hosts the public website and its DNS records and provides the mailbox used to send account verification and recovery email. Cloudflare provides DNS, network delivery, TLS, abuse prevention, and related security services. They process service data on our behalf under their own data-processing and privacy terms.
Website and communications providers. Google receives public-site analytics events and serves Google Fonts; StatCounter receives public-site analytics events; and Google Gmail receives email you send to missionexecutionlayer@gmail.com. Auth0 sends account verification and recovery email through our DreamHost mailbox; those providers process the address and message needed for delivery. These providers do not receive private workspace content from Mission unless you put it in an email or separately direct a connection.
Auth0 and Paddle. Auth0 processes the credentials, identity and authentication records used for the separate hosted account service. Paddle processes checkout, payment, subscription, refund and merchant-of-record records under its applicable terms and privacy policy. These services are separate from Mission’s workspace database; deleting Mission records does not automatically erase their records. We coordinate verified deletion requests with the relevant provider, subject to its legal retention requirements.
User-directed connectors. If you enable Gmail, Google Calendar, Slack, Discord, Telegram, a social platform, or another connector, the relevant provider receives the requests necessary for that connection. Mission does not enable those services through the public ChatGPT app unless you separately authorize them.
People and legal disclosures. A limited number of authorized Phenomena Labs personnel or contractors may access hosted data when necessary for support, security, deletion, or legal compliance. We may disclose data to advisers, authorities, or a successor organization where required by law or a corporate transaction, subject to appropriate safeguards. We do not sell or rent personal data.
4A. GoMission Remote recipients.
If you pair directly with a local or user-controlled Mission host, mobile request content goes only between your iPhone and that host. If you choose the optional gomission.io mobile relay, DreamHost hosts the relay and may process encrypted connection metadata plus the allowlisted request and response while carrying it between your iPhone and your Mission connector. The relay stores only token hashes, not raw tokens. Apple processes App Store, TestFlight, device, crash, and purchase or download information under Apple’s terms; Mission does not add a third-party analytics SDK to the app.
5. Retention.
Local workspaces: workspace files remain until you or your organization delete them. Mission’s local privacy commands can inventory, export, harden, encrypt, or delete selected local data. Local connector copies and provider-side data may require separate deletion or revocation.
Hosted account and workspace content: account records, workspace files, prepared packets, receipts, and learning preferences are retained while the account or workspace remains active. After a verified deletion or account-closure request, we delete the active hosted copy within 30 days. Encrypted operator backups may retain an earlier copy for up to 30 days from creation. They are restricted to recovery use; completed deletion requests must be reapplied before restored data is served. Render-managed disk snapshots are separate: its published snapshot retention has no stated maximum, so Mission’s 30-day operator-backup limit does not promise deletion from all provider snapshots.
Authentication: lifetimes differ by service. The current hosted accounts browser session expires after 24 hours; sign-out revokes the current Mission session. See the standalone connector policy for its authorization and retention rules. Local installations use their configured authentication settings. Provider-side account records remain subject to provider retention and verified deletion procedures.
GoMission Remote: the paired base URL remains on the iPhone until you disconnect the app or remove it. The pairing token remains in the iOS Keychain until you disconnect or remove the app. Optional mobile-relay requests expire after 60 seconds; connector leases expire after 15 seconds; transient request and response bodies expire from relay storage within 120 seconds. Hashed mobile and connector tokens remain until the relay workspace is reprovisioned or deleted.
Operational logs: as currently configured, Render retains application service logs for 7 days. Cloudflare makes HTTP request logs available for at least 3 and up to 7 days. Mission does not stream these logs to a separate long-term logging provider. Security/audit records about changes made by Mission administrators, rather than your tool content, may remain in provider audit logs for the provider’s published retention period.
Website analytics: Google Analytics user- and event-level data is retained for no more than 14 months; its _ga cookies can remain for up to 2 years. StatCounter detailed visits are stored in a rolling, capacity-limited log: the oldest visit is removed when a new visit exceeds the configured log capacity. StatCounter’s visitor cookies can remain for 2 years (sc_is_visitor_unique) or 5 years (is_unique). We do not download or maintain a separate long-term copy of raw visitor logs.
Support and privacy correspondence: closed support correspondence is retained for no more than 90 days after closure. A minimal deletion-safeguard record may be needed while an older backup remains eligible for restoration, to avoid reinstating deleted data. Provider billing records may be retained under applicable accounting, tax or legal requirements; deleting a Mission account does not cancel a subscription or automatically erase Paddle’s records.
6. Your controls.
You can choose what to place in Mission; inspect, edit, export, or delete local workspace files; use mission privacy summary, mission privacy export, or the documented scoped delete commands; decline a prepare action; disconnect Mission in ChatGPT; and revoke a connected provider’s authorization in that provider’s settings. Disconnecting stops future app access but does not by itself delete an existing hosted workspace.
You can block or clear analytics cookies in your browser, use Google’s Analytics opt-out controls, or use StatCounter’s cookie-refusal control. Blocking analytics does not prevent use of Mission’s public information pages or app tools.
For a hosted workspace, email missionexecutionlayer@gmail.com to request access, a portable export, correction, deletion, restriction, or withdrawal of consent. Include the account email and say “Mission data request.” We may verify your identity before acting. We acknowledge support requests within 3 business days and complete verified export or deletion requests within 30 days, or explain any legally permitted extension and any provider-retention limitation. You may also object to processing or complain to your local data-protection authority where those rights apply.
6A. GoMission Remote controls.
You choose the Mission host and whether to use a direct connection or the optional relay. You can inspect the paired URL in Settings, reject or defer an action, refresh the workspace, disconnect to delete the iPhone’s pairing URL and Keychain token, revoke or rotate the token from the paired workspace, and delete the app. Disconnecting the iPhone does not delete the underlying Mission workspace or provider-side drafts and data.
7. Sensitive data and credentials.
Do not place passwords, API keys, authentication tokens, multi-factor codes, financial account credentials, government identifiers, health records, or other highly sensitive data in Mission tool fields. Enter account credentials only on a Mission-owned login page or the relevant provider’s authorization page. Pair GoMission Remote only with a Mission URL and token generated for you; do not send the pairing link to another person. Professional workspace content can incidentally identify colleagues, clients, or other people; only add or connect data you are authorized to use.
8. Security, transfers, and limits.
Mission uses encrypted network transport, hashed credentials and tokens, access controls, scoped tools, human approval boundaries, and data-minimized tool results. No system is perfectly secure. Render, Auth0, Paddle, DreamHost, Google, Cloudflare, OpenAI, and other providers may process data in countries other than yours under their applicable safeguards.
9. Children and changes.
Mission is a professional product and is not directed to children under 18. If you believe a child provided data, contact us for deletion. We will update the date above when this policy changes materially and will provide additional notice where required.