Privacy notice

This notice explains what personal data we process when you visit minga.run (this website and its docs) and when you use Minga: the app at app.minga.run, the minga runner on your machines, and Minga's MCP server. We keep it short and plain. If something is unclear, write to web@jung.dev.

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

We have not appointed a data protection officer, as the law does not require one for us. Write to the address above.

2. This website (minga.run)

Hosting and server logs

minga.run is a static website served by Cloudflare Workers. When you open a page, your browser sends the usual request data to Cloudflare: your IP address, the date and time, the page requested, the referring page, and your browser's user agent. Cloudflare needs this to deliver the page and to protect the service against attacks. Cloudflare processes it on our behalf under a data processing agreement (Art. 28 GDPR). The legal basis is our legitimate interest in a secure, working website (Art. 6 (1) (f) GDPR). We do not combine this data with other data and do not use it to identify you.

No cookies, no tracking

The website sets no cookies and uses no analytics, tracking pixels, advertising, or social media plugins. Fonts are served from minga.run itself; the website makes no requests to third parties. The docs search runs in your browser: your search terms are not sent anywhere.

If you pick a light or dark theme, your browser stores that choice in its local storage on your device. It is never sent to us. This is strictly necessary for a feature you asked for (§ 25 (2) no. 2 TDDDG); you can remove it by clearing your browser's site data.

Email

If you write to us, we process your address and what you write to answer you (Art. 6 (1) (b) GDPR when it concerns using Minga, otherwise Art. 6 (1) (f) GDPR). We delete it when the matter is settled, unless we have to keep it for legal reasons.

3. The Minga app (app.minga.run)

Minga is in early access. The app runs on Cloudflare (Workers, D1, Durable Objects and R2). The legal basis for the processing in this section is the contract with you, the terms of use (Art. 6 (1) (b) GDPR), unless a different basis is named.

Your account

• Account data: your name, email address and password (stored only as a hash), and, if you add one, a passkey's public key. Stored in Cloudflare D1. We send no emails from the app.
• Sessions and cookies: when you sign in, we set a session cookie that keeps you signed in, and store the session with your IP address and user agent so you can see and end your sessions and so we can detect misuse. While you add or use a passkey, or connect an MCP client, the app also sets short-lived technical cookies for that step only. All of these cookies are strictly necessary (§ 25 (2) no. 2 TDDDG). The session cookie ends when you sign out or the session expires; the others end within minutes.
• Browser storage: the app keeps a few preferences (such as the last workspace you opened and how you like to view a run) in your browser's local and session storage. They stay on your device.

Fonts in the app

Unlike this website, the app currently loads its fonts (Inter, Source Serif 4, IBM Plex Mono) from Google Fonts. When you open the app, your browser therefore sends your IP address and user agent to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google may also process this data in the United States (Google LLC is certified under the EU–U.S. Data Privacy Framework, Art. 45 GDPR). The legal basis is our legitimate interest in showing the app consistently on every device (Art. 6 (1) (f) GDPR). We are moving these fonts onto our own servers; this paragraph will go when that is done.

Workspaces and teams

A workspace stores its name, its members with their roles, and pending invitations. When you invite someone, we store the email address you entered for the invitation link (Art. 6 (1) (f) GDPR: our and your interest in letting you invite colleagues). Minga does not send the invitation; you send the link yourself. Invitations expire after 7 days.

What you and your agents create

For each workspace, Minga stores in Cloudflare Durable Objects and R2:

• the brief, goals and KPIs, milestones, items with their specs and checks, decisions, cards and comments;
• the chat with each agent, with the author's name on every message;
• every change as an event, so the history can be shown and replayed;
• outputs that workers, agents or people attach (files up to 25 MB), never public and opened only through short-lived signed links;
• run transcripts: what a run on your machine read and did, including the commands it ran, their output, excerpts of files it opened, and the diffs it made.

Every member of a workspace can see its projects, and anyone who can open a run can read its transcript. A transcript can contain whatever a command printed, including personal data or secrets in your files. The runner removes its own Minga tokens; nothing else is filtered.

If you put personal data of other people into Minga (for example in a brief, a chat, or files in a repo a run reads), make sure you are allowed to. If you use Minga for a company and need a data processing agreement, write to us.

Runners on your machines

The minga runner runs on machines you choose and connects out to Minga; Minga never connects into your machine. It sends: the machine's name and operating system, its CLI profiles and whether each CLI is signed in (without reading the credential files), the models a CLI offers, the repos you registered (name, path, branch and access checks), and, for each run, its transcript and how it ended. Your repo stays on your machine; Minga does not copy it. The runner's own token is stored only on the machine.

If a runner watches pull requests, it asks GitHub with your own gh login, from your machine. It reports the state of each pull request to Minga: status, checks, reviews and the GitHub usernames of the people who reviewed, commented, pushed or merged. Minga has no GitHub credentials of its own.

Model providers

• Runs on your machines use the Claude Code and Codex CLIs under your own accounts with Anthropic or OpenAI. The CLI sends your code and context to its provider as it always does. That happens between you and the provider, under their terms; Minga is not a party to it and receives nothing from the provider.
• Lea in Minga's cloud (only if you add an Anthropic or OpenAI API key to your workspace): Minga sends Lea's context (the brief, the plan, the chat, what changed, and images from recent messages through links that expire after 15 minutes) to that provider with your workspace's key, on your instruction. The provider processes it under your agreement with them and may process it in the United States. The keys are stored encrypted and never shown again.

Connecting Claude Code or Codex over MCP

When you connect your own Claude Code or Codex session to Minga's MCP server, you sign in with OAuth and press Allow. Minga stores the client's registration, which account it acts for, and its tokens (access tokens last 15 minutes, refresh tokens 30 days). What the session does through Minga is stored like any other action in the app; its messages say "via Claude Code" or "via Codex". You can disconnect it under Account › Connected apps.

Runner downloads and app logs

When you download the runner or the install script, Cloudflare processes the request data described in section 2. For troubleshooting, the app's Worker logs (request time, path, status, errors, and what the app logs about a request) are kept by Cloudflare for a few days and then deleted automatically (Art. 6 (1) (f) GDPR: a working, secure service).

4. Recipients and transfers outside the EU

• Cloudflare hosts the website and the app as our processor under a data processing agreement (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, and its affiliates). Cloudflare may process data in the United States. Cloudflare, Inc. is certified under the EU–U.S. Data Privacy Framework (adequacy decision of 10 July 2023, Art. 45 GDPR); its agreement also includes the EU standard contractual clauses (Art. 46 GDPR).
• Google (Google Ireland Limited, and Google LLC in the United States) receives your IP address when the app loads its fonts, as described above.
• Anthropic or OpenAI, only if you add their API key to your workspace, as described above.
• Other members of your workspace see what is shared in it, as described above.

We do not sell personal data and do not use it for advertising.

5. How long we keep data

• Your account: until you delete it. You can delete it any time under Account › Profile › Delete account (if you are the only owner of a workspace, transfer or delete that workspace first). Deleting it removes your account, sessions and passkeys, and revokes your runners.
• Shared workspace content (messages, decisions, items, history) belongs to the workspace and stays there with your name after you leave or delete your account, because it is part of the record the team works from. Ask us if you want your name removed from it.
• A workspace: until an owner deletes it. During early access, some stored project data (history, transcripts, files) may remain in storage after a workspace is deleted; write to us and we delete it within 30 days.
• Invitations: until they are accepted, revoked or expire (7 days).
• Server and app logs: a few days, deleted automatically by Cloudflare.

Where the law requires us to keep data longer (for example for tax purposes), we keep it only for that purpose.

6. Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• have it corrected (Art. 16 GDPR) or deleted (Art. 17 GDPR);
• restrict its processing (Art. 18 GDPR);
• receive it in a common, machine-readable format (Art. 20 GDPR);
• object, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21 GDPR);
• withdraw any consent you gave, with effect for the future (Art. 7 (3) GDPR).

To use these rights, write to web@jung.dev. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), for example in the EU country where you live. The authority responsible for us is:

7. Other points

• You do not have to give us personal data to read this website. To use the app you need an account with a name and an email address.
• We do not make decisions about you based solely on automated processing (Art. 22 GDPR).
• All connections to minga.run and app.minga.run are encrypted with TLS.
• We update this notice when Minga changes. The date at the top says when it last changed; for important changes we tell you in the app.