Privacy Policy
Effective November 1, 2026
This policy explains what Nalya LLC, which runs concivo ("we"), collects when you use concivo.io, its MCP server, its API and its GitHub sync, what we do with it, and the choices you have. We collect only what we need to run the service, and we don't sell your personal information or use it for advertising.
What we collect
- Account details. When you sign up, our sign-in provider gives us your email address, your name and profile picture if you have them, and an account ID. If you sign in with a provider such as GitHub or Google, we receive the basic profile it shares.
- Your profile. Your handle, display name, bio and avatar.
- What you post and do. Prompts and traits (including drafts and past revisions), descriptions, tags, screenshots and assets you upload, build reports, stars, and which prompts you evolved.
- API tokens. When you create a token for an agent or for GitHub sync, we store a hash of it (never the token itself), its name, its first characters and when it was last used.
- Technical data. Like most websites, our hosting provider logs requests, including IP address, browser, pages requested and timestamps, for security and debugging.
- Cookies and local storage. We use cookies only to keep you signed in, and your browser's local storage to remember your light or dark theme. We don't use advertising or third-party tracking cookies.
What's public
Your profile and your published prompts' titles, descriptions, screenshots, tags and lineage are public. A prompt's full text is shown only to you and to people who evolved it, and those people can see and keep a copy. Drafts are visible only to you. Stars and evolutions are tied to your profile.
How we use it
- to run the service: sign you in, show your profile and prompts, and let people evolve and build them;
- to answer your AI agent when it uses our MCP server or API with your token;
- to keep the service secure, prevent abuse and fix problems;
- to email you about your account or important changes (no marketing email without your consent);
- to meet legal obligations.
If you're in the EEA, UK or Switzerland, our legal bases are: performing our contract with you (running your account), our legitimate interests (security and improving the service), your consent (where we ask for it), and legal obligations.
Who we share it with
We use these service providers to run concivo. They process data on our behalf and under their own security commitments:
- Clerk: sign-in and account management;
- Vercel: hosting, request logs and storage for screenshots and assets;
- Neon: our database.
If you set up GitHub sync, your prompt files go into the repository you choose on GitHub, under GitHub's terms. When your AI agent talks to concivo, what it sends and receives also passes through that agent and its provider, under their policies. We may disclose information if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the company (in which case this policy keeps applying to your data).
Where it's stored
Our providers store data in the United States and may process it in other countries. Where the law requires it, transfers are covered by safeguards such as the European Commission's Standard Contractual Clauses.
How long we keep it
We keep your account and content until you delete them or ask us to delete your account. Deleted prompts may stay in backups for up to 30 days. Request logs are kept for a limited period by our hosting provider. When your account is deleted, we remove your profile and personal details; evolutions other people already made of your prompts remain theirs (see the Terms of Service).
Your choices and rights
Everyone. You can edit your profile and content, unpublish or delete prompts, and revoke API tokens at any time in the app. You can also access, correct, export or delete your personal information, or delete your account, by emailing legal@concivo.io. We'll never treat you differently for using a privacy right.
European Economic Area, United Kingdom and Switzerland. You have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent at any time, and the right to complain to your local supervisory authority.
California and other US states. You have the right to know what personal information we collect, use and disclose (this policy), and to access, correct and delete it. The right to opt out of sale or sharing doesn't apply, because we don't sell or share personal information as the CCPA/CPRA defines those terms, and we don't use sensitive personal information in ways that require a right to limit. You can use these rights, including through an authorized agent, by emailing legal@concivo.io; we verify requests using your account email.
Security
We protect data in transit with HTTPS, store API tokens only as hashes, and limit who can access our systems. No service is perfectly secure; if a breach affects you, we'll tell you as the law requires.
Children
concivo isn't directed to children. We don't knowingly collect personal information from anyone under 16, and you can't create an account if you're under 16 (or under the age of digital consent where you live). If you think a child has given us personal information, email legal@concivo.io and we'll delete it.
Changes
We'll post any changes here and update the effective date. If a change is significant, we'll give notice on the site or by email.
Contact
Nalya LLC, a Delaware limited liability company, is responsible for the processing described in this policy. Questions, concerns or requests about it or your data? Email legal@concivo.io and we'll answer as soon as we can, and within any timeline the law requires. You can also write to Nalya LLC · 611 South DuPont Highway, Suite 102, Dover, DE 19901, USA.