Privacy Policy

1. Who we are

Morphys ("we", "us", "our") is based in India. Contact: team@morphys.app.

2. What Morphys does

Morphys is a browser customization tool. The bookmarklet and consumer extension apply visual themes to websites you visit. The Teams extension lets organizations customize enterprise tools and share those customizations with team members.

3. Data we collect

3a. Bookmarklet and consumer extension (no account required)

• The website domain name where you activated Morphys (e.g., "youtube.com" — not the full URL)
• The type of event (e.g., "theme applied", "widget opened")
• No personal identifiers, no browsing history, no page content, no IP addresses stored
• Your theme preferences are stored locally on your device only (browser localStorage)

3b. Teams (extension + dashboard — requires Google account)

• Your Google account email address and name (via Google OAuth)
• Your workspace membership and role
• Published layout specifications your organization creates
• When you use the AI editing feature: the structure of the page you are editing (an ARIA semantic snapshot) and a screenshot of the visible page area are sent to our servers and to OpenAI to generate the layout change. These are not stored after the response is returned.
• AI prompts you type as an admin are sent to OpenAI and discarded after processing. They are not stored in our database.

4. How we use your data

• Anonymous activation counts: to understand which websites people use Morphys on, in aggregate
• Google account data: to manage your workspace membership, allow team sync, and send workspace notifications
• Page structure and screenshots (Teams): solely to generate the layout change you requested
• We do not sell any data. We do not use your data for advertising.

5. Our service providers (sub-processors)

We share data with these providers only as necessary to operate the service:

All providers are contractually bound to process data only as instructed.

6. Cookies and local storage

The bookmarklet and consumer extension store theme preferences in your browser's localStorage. This is local to your device. No cookies are set by Morphys on third-party websites. The Morphys web dashboard (morphys.app) may set session cookies for authentication via Supabase. We do not use advertising or tracking cookies.

7. Data retention

• Anonymous activation events: 90 days
• Anonymous tokens: 90 days from last use
• Teams account data: retained until you delete your account or request deletion
• Published layouts: retained until deleted by a workspace admin
• Server request logs: standard Vercel log retention (up to 30 days)
• AI inputs (page structure, screenshots, prompts): not retained beyond the request

8. Your rights (GDPR — EEA/UK users)

If you are in the European Economic Area or UK, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Request restriction of processing
• Data portability
• Object to processing
• Withdraw consent at any time

To exercise any of these rights, email team@morphys.app. We will respond within 30 days.

9. Your rights (CCPA — California users)

California residents have the right to know what personal information we collect, to request deletion, and to opt out of sale (we do not sell personal information). To exercise rights, email team@morphys.app.

10. Children's privacy

Morphys is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect data from children. If you believe we have inadvertently collected such data, email team@morphys.app and we will delete it.

11. Security

We use TLS for all data in transit, row-level security on our database, and bearer token authentication. Screenshots and page structure sent during AI generation are transmitted over encrypted connections and not stored.

12. The Chrome extension and page data

The Morphys Chrome extension requires permission to read and modify webpage content in order to apply visual customizations. The extension:

• Does not read, store, or transmit the content of pages you visit for any purpose other than applying a visual transform you explicitly requested
• Does not log your browsing history
• Modifies webpage security headers (CSP) only on sites where you have actively applied a Morphys transform
• Captures a screenshot of the current page only when you explicitly use the Teams AI editing feature, and only to generate the layout change

13. International data transfers

Our infrastructure is hosted in the United States (Vercel, Supabase, OpenAI, Upstash). If you are in the EEA or UK, your data is transferred to the US under appropriate safeguards (Standard Contractual Clauses with our providers).

14. Changes to this policy

We will update this page and the "Last updated" date when we make material changes. For significant changes affecting Teams users, we will send an email notification.

15. Contact

For questions about privacy: team@morphys.app