myartefactsPrivacy Policy
Effective date: October 31, 2026
myartefacts ("we", "us") is operated by Monte Villa, LLC, 11815 Far Edge Path, Columbia, MD, USA. This policy explains what personal data we collect when you use https://myartefacts.com (the "Service"), why, and what your rights are.
Questions: privacy@myartefacts.com. General contact: hello@myartefacts.com.
1. The short version
- We store your account details and the files your agents publish to your private library.
- Artifacts are private until you share them. We do not sell them, and we do not use them to train AI models.
- When someone opens one of your share links, we log basic visit details (including a shortened IP address) so you can see who looked. These logs are deleted after 90 days.
- We use a small number of service providers to run the Service. They are listed in section 8.
- You can delete your account and export a copy of your data from your settings. See section 9.
2. Who is responsible
For account data and the visit logs described below, Monte Villa, LLC is the controller (we decide why and how the data is used). For the content of your artifacts, you decide what is uploaded and shared, and we process that content on your behalf to provide the Service. If your artifacts contain other people's personal data, you are responsible for having a legal basis to put it there.
3. What we collect
Account data. Your name, email address, and a hashed password. If you turn on two-factor authentication or passkeys, we store the secrets, recovery codes and passkey credentials needed for them. We record whether your email is verified and when the account was created.
Agent connections. When an agent connects, we store the agent name (for example "Claude Code"), an optional device label, the IP address of the connecting request, the time, and an API token (stored in hashed form). An agent can connect using only your email address. In that case we open an account for that address if none exists and email you so you can approve, claim or remove the connection. If nobody approves it within 7 days, the agent loses access, anything it saved while waiting is deleted, and so is an account it opened that nobody claimed.
OAuth connectors. Apps such as ChatGPT and claude.ai can also connect as a custom connector: you sign in to myartefacts and approve the connection on a consent screen. For these we store the connector's registered name and redirect address, your approval, and the access and refresh tokens we issue (access tokens last 1 day and refresh tokens 30 days). You can disconnect a connector at any time in Settings, Agents, which deletes its tokens. Deleting your account or having it suspended also removes them.
Artifacts. The files and details your agents or you publish: file content, title, summary, the prompt (if the agent provided one), project names, which agent made it, version history, file size and type, and whether and when you starred, archived or shared it. The title and summary come from what the agent or you send us. We do not call an AI service to generate them.
Share link visits. When someone opens a share link to one of your artifacts, we record: the visitor's IP address with its last part removed (the last of the four numbers for IPv4, the last 80 bits for IPv6; we never store the full address), an approximate city, region and country, their browser user agent (truncated), the host name of the website they came from (not the full address), whether the visit looks like a link preview or crawler, the time, and the visitor's account if they happen to be signed in. Your own visits are not recorded. You see this in the views log for your artifact. The visitor does not need an account.
Invitations. If you invite a friend, we store their email address, the time sent, and whether they joined, and we send them an email with a sign-up link. We use the address only for that invitation. Someone who does not want this can ask us to delete it at privacy@myartefacts.com.
Email we send. Verification and password reset emails, agent approval and connection emails, invitation emails, one onboarding email about a day after signup if no agent has connected yet, and notices about your account. We do not send marketing email without a separate opt-in.
Website usage. If Google Analytics 4 is enabled, we use it to count visits and clicks on the public site and in the app (see section 6). Our servers also keep standard technical logs (IP address, request, time, errors).
4. Why we use it, and our legal basis (GDPR)
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the Service: accounts, storing, serving and sharing artifacts, agent connections | Account, agent, artifact, share data | Contract (Art. 6(1)(b)) |
| Show you who opened your share links | Share visit data | Our legitimate interest in giving owners visibility into their links (Art. 6(1)(f)) |
| Security, abuse prevention, rate limiting, enforcing our rules | IP addresses, logs, agent data | Legitimate interest (Art. 6(1)(f)) |
| Service emails (verification, approvals, invitations) | Email address | Contract / legitimate interest |
| Usage analytics | Analytics identifiers, page views | Consent where the law requires it, otherwise legitimate interest |
| Legal obligations (tax, lawful requests, takedown handling) | Account data | Legal obligation (Art. 6(1)(c)) |
You can object to processing based on legitimate interest (section 9).
5. Where your artifacts live and who can see them
Artifacts are stored on our servers, in private storage that is not publicly reachable. They are private to your account until you choose to share. A share link is an unguessable URL: anyone who has the link can open it until you revoke it, or until it expires if you set an expiry. Share pages ask search engines not to index them, but a link you post publicly can still be found. Uploaded files are served with a restrictive security sandbox so their scripts cannot read your session.
The public Explore library at /explore contains only articles that we publish ourselves. Member artifacts do not appear there.
To make link-preview images for shared artifacts, our rendering provider (Cloudflare) opens the shared page and takes a screenshot, so it processes the visible contents of shared artifacts.
If you use the "send to Claude, ChatGPT, Grok or Gemini" buttons on a share page, your browser opens that third party's site with a link or a copied prompt. That is your action and their privacy policy applies.
6. Cookies and similar technologies
- Essential cookies. A session cookie and an anti-forgery token keep you signed in and protect forms. A session stays valid for 2 days unless you sign out. A "remember me" cookie is used only if you choose it. These do not need consent.
- Preference cookies.
appearance(light or dark theme, kept up to one year) andsidebar_state(sidebar open or closed, kept one week), plus the same preferences in your browser's local storage. - Analytics. If Google Analytics 4 is turned on, Google sets cookies and receives your IP address, device and page information. Analytics cookies are only set after you click Accept on our cookie notice. Until then Google Analytics runs in consent mode with storage denied, and advertising features are always off. You can change your choice at any time with the Cookie settings link in the footer. It is not loaded on share link pages.
7. How long we keep data
| Data | Retention |
|---|---|
| Account data | Until you delete your account |
| Artifacts and versions | Until you delete them or your account. Archived artifacts are kept until you delete them |
| Share visit logs | 90 days, then deleted automatically. Also deleted with the artifact or the account |
| Agent connection records | Until you remove the agent or delete your account. Unapproved connections are deleted after 7 days |
| Invitation records | Until you delete the invitation or your account |
| Server logs | 14 days |
| Backups | Up to 30 days, then overwritten |
8. Who we share data with (subprocessors)
We do not sell personal data. These providers process data on our behalf:
| Provider | What for | Data | Location |
|---|---|---|---|
| DigitalOcean, LLC | Server hosting (managed through Laravel Forge) | Everything stored by the Service, including artifacts and the database | US (New York area) |
| Cloudflare, Inc. | DNS, sending and routing of email, rendering screenshots for link previews | Email address and content of emails we send; shared page content for previews | Global network, US |
| Google LLC (Google Analytics 4) | Site analytics, only when enabled | Online identifiers, IP address, page views | US / global |
| ipapi.co (Kloudend, Inc.) | Approximate city and country of a share-link visitor's IP address | Visitor IP address with its last part removed | US |
| Laravel Forge (Laravel LLC) | Server provisioning and deployment | Server access metadata, not user content | US |
We may also share data when the law requires it, to protect our rights and users, or in a merger or sale of the business (with notice to you).
The agents you connect (Claude Code, Cursor and others) are your tools. When they publish to your library they act as you.
9. Your rights
Under the GDPR (and UK GDPR) you can ask us to: access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent at any time. You can also complain to the data protection authority in the country where you live or work.
How to use them:
- Delete your account: Settings, Profile, delete account. This immediately removes your account, tokens, agent connections, artifacts and every version, link previews, projects, share links and their visit logs, invitations and sessions. The stored files are then deleted by a background job, normally within minutes. Copies in backups expire as described in section 7.
- Delete single artifacts from your library.
- Export your data: Settings, Profile, export. We email you a link to a zip with your account details, projects, and the latest version of each artifact with its metadata and visit log. The link works for 7 days, then the zip is deleted.
- Everything else: email privacy@myartefacts.com. We aim to reply within 30 days.
10. California and other US states
If you are a California resident, you have the right to know what personal information we collect and why (described above), to request deletion and correction, to get a copy, and not to be discriminated against for using these rights. We do not sell personal information and do not share it for cross-context behavioral advertising. To make a request, email privacy@myartefacts.com. We may need to verify your identity first.
11. International transfers
We are based in the United States and the Service runs on servers there, so if you use it from elsewhere, including the European Economic Area or the UK, your data is transferred to and processed in the United States. Where the law requires a transfer mechanism, we and our providers rely on adequacy decisions (such as the EU-US Data Privacy Framework for certified providers) or Standard Contractual Clauses.
12. Security
Passwords and API tokens are stored hashed. Connections use HTTPS. Uploaded files are served in a sandbox. Agents waiting for approval have limited access. No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.
13. Children
The Service is not for people under 16. We do not knowingly collect data from them. If you think a child has an account, tell us and we will delete it.
14. Changes
We will update this page when things change and revise the effective date. For material changes we will email account holders in advance.
15. Contact
Monte Villa, LLC, 11815 Far Edge Path, Columbia, MD, USA Privacy: privacy@myartefacts.com General: hello@myartefacts.com