Moly privacy policy

Last updated: 13 October 2026. This policy covers the Moly browser extension and the Moly app that runs on your computer.

In short. Your conversations stay on your computer. The people who make Moly receive nothing: no account, no analytics, no telemetry, no tracking, no advertising network. Text leaves your computer only if you choose a cloud AI provider, and then it goes to that provider with your own key.

Who we are

Moly is published by Hermes Software (GitHub: Nireus79) as open-source software under the MIT licence. Contact: Hermes_creative@proton.me.

What Moly stores, and where

What	Where
Your conversations and messages, the people you mention, goals and facts Moly learned from what you wrote, your settings	An encrypted database (AES-256) in the `.moly` folder of your user folder on your computer. The key is kept in your operating system's keychain; on a computer without one, you choose a passphrase that protects it (or, knowingly, a key file).
The AI provider you chose and, if you use Claude or OpenAI, your API key	The same encrypted database. You can protect the key with a passphrase that Moly never stores. Moly never shows the key again and never writes it to a log.
A session token for your local profile and your interface preferences	The browser's extension storage. The API key is not kept there.
Diagnostic logs	Files in the `.moly` folder and in Moly's configuration folder. They do not contain your message text, names or e-mail addresses.

Moly has no account on any server of ours. The first time you use it, it creates a local profile on your computer that has no e-mail address and no password.

What leaves your computer

With Ollama (a model on your computer): nothing.
With Claude (Anthropic) or OpenAI: the messages you write, together with the context Moly needs to understand them (for example a short summary of the conversation and the people you mentioned), are sent to that provider to write the replies. This uses your own API key and is governed by that provider's terms and privacy policy. Moly asks you to confirm this before you save the key. Card numbers and bank account numbers are removed from your text before anything is sent. Other secrets you type (such as passwords) are removed from what Moly stores and from later requests, but the first analysis of a message reads it as you wrote it, so do not type passwords into Moly.
Moly sends nothing else anywhere. It has no analytics, no crash reporting to us, and no advertising network.

The small card

In its own area below the writing box, Moly may show a small card labelled "Sponsored": a message from us (it carries our name and logos) or from a sponsor. It is part of the extension: it loads nothing from the internet, it is chosen by the day and never by anything you wrote, and it never appears between messages. You can hide it with its Hide button; it comes back the next time you open Moly. If you click its link, that website opens in a new tab and sees your visit, like any link you click; we learn nothing about you from it.

Why the extension needs its permissions

Side panel: to show Moly beside the page you are working on.
Storage: to remember your session and interface preferences.
Native messaging: to start and stop the Moly app on your computer. The extension cannot do anything on your computer except talk to that app.
Access to http://127.0.0.1:11436: to talk to the Moly app on your own computer. The extension does not read the web pages you visit and contacts no server on the internet; it talks to the Moly app on your computer (and, to look for it, to Ollama on your computer).

Your choices

Export: Settings, "Export my data" saves everything Moly stored about you as one file.
Delete: Settings, "Delete profile permanently" removes your conversations, contacts and everything learned from them. Uninstalling the app keeps your data unless you ask for it to be deleted too: the Windows uninstaller asks you; on Linux and Mac use uninstall.sh --purge.
Remove your AI key at any time in Settings.
Because the data is on your computer, you also control it with your own tools: back it up, copy it, or delete the .moly folder.

Security, and its limits

The local app listens on your computer only, answers only the Moly extension, and requires a token created each time it starts. The database is encrypted. These measures protect your data from other websites and from other people who find your files. They cannot protect against malicious software that runs as you and can read your keychain or watch your keyboard. Use a passphrase for your API key, create a separate key for Moly with a spending limit at your provider, or use Ollama if no key should exist at all. If you lose the keychain entry or forget the passphrase (for example by reinstalling your operating system) the database cannot be opened, and nobody can recover it for you, so export your data first.

Moly is not a crisis, medical or legal service

Moly is a writing coach. It gives no emergency, medical or legal advice and no emergency contact numbers. If you or someone else is in danger, contact your local emergency services.

Children

Moly is not designed for children.

Changes

If this policy changes, the new version will be published here and, if the way your data is handled changes, Moly will tell you inside the extension.