Open Workspace

Privacy Policy

Updated October 12, 2026. This covers dyadic.app, the Dyadic Workspace and API, and the Dyadic app for Android.

Dyadic is an AI workspace: you chat with Iris and keep projects, libraries, files, images and memory together. To do that it has to store what you put into it. This page says what that is, what it is used for, who else handles it, and how to have it deleted. Dyadic shows no ads, sells no data and does not track you across other apps or sites.

Your Account

Signing In and Security

For each signed-in device Dyadic keeps the browser or app name, the IP address and an approximate location (city, region and country, from Cloudflare) where it signed in and was last used, so your account page can list your devices and sign any of them out. Sign-ins, new passkeys, recovery attempts and similar changes are kept in a security log on your account, with the IP address and approximate location of each. A session cookie keeps you signed in; a short-lived cookie protects signing in and connecting with Discord, Google and GitHub. There are no advertising or cross-site tracking cookies.

What You Store

Your chats and messages, projects, libraries, uploaded files, images you create or upload, memory, saved items, API keys you create and your credit balance and usage. These are kept so the Workspace and API work and are only shown to you, unless you choose to share something, such as an album link.

AI Processing

When you talk to Iris, your messages, the files and context you include, and relevant memory are sent to AI model providers through OpenRouter to generate the answer and any images. When Iris searches the web, reads a page, looks up market data or finds places for a map or a forecast, the query, address or place name is sent to those services (place names go to OpenStreetMap's geocoder). The map tiles in an answer come from OpenStreetMap through dyadic.app, so your address and browser details never reach them. Providers process this to answer your request; Dyadic does not sell it or use it for advertising.

Who Else Handles Data

Google User Data

Dyadic uses Google in two optional ways: signing in with Google, and the Google Workspace plugin, which lets Iris and your agents work with your Gmail, Drive, Calendar, Docs and Sheets when you connect it.

How it's used and shared. Google data is used only to do what you asked in the Workspace, a feature you can see and control. To answer, the parts Iris reads are sent through OpenRouter to the AI model generating the answer, only to providers that neither keep nor train on what they're sent. Google data is never sold, never used for advertising, never used to build profiles of you, and is not used to develop, improve or train any AI or machine-learning model, Dyadic's or anyone else's. No person at Dyadic reads it, except with your explicit permission (for example a support request you make), when needed for security, or to comply with the law.

Limited Use. Dyadic's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storing and deleting it. The access Google grants (its tokens) is kept encrypted and used only for your requests. What Iris reads is kept only as part of the conversation you asked in (its answer and its record of the tools it used), which you can delete at any time. You can lower a service's level or disconnect Google in the Store; disconnecting revokes Dyadic's access at Google and deletes the tokens. You can also remove Dyadic's access in your Google account's security settings at myaccount.google.com/permissions. Deleting your Dyadic account deletes all of this.

GitHub

If you connect GitHub, Dyadic keeps the access you granted, encrypted, and uses it only when you or your agents ask for something in your repositories. What it reads goes to AI processing as described above. You can disconnect at any time in the Store, and revoke it from your GitHub settings.

MCP Servers and Other Services You Connect

When you add an MCP server, Dyadic connects to the address you give and lists its tools. Each time Iris uses one of its tools, the tool's name and what Iris passes it, which can include parts of your chats and files, are sent to that server, along with the sign-in header you saved. That header is kept encrypted, sent only to that server and never shown again. The server's owner handles what it receives under their own terms; Dyadic doesn't control what they keep. You can turn each tool off, have every call ask you first, or remove the server.

An API key with Remote MCP servers on lets the app using it name any public HTTPS MCP server in a request, with a sign-in the app supplies. The app chooses where those calls go and what they carry. Dyadic uses that sign-in only for the request and never stores or logs it.

The Android App

The Android app shows the same Workspace. It asks for no contacts or microphone access. If you choose Use My Location for your home area, it asks Android for your approximate location once, and only the town is kept. If you allow notifications, the app's notification token from Google Firebase Cloud Messaging is stored with your account so answers and alerts can reach your phone. If the app crashes, a crash report (what failed, the app version, the device model and Android version, and an install id; no chat content) goes to Google Firebase Crashlytics so it can be fixed. The camera opens only when you choose to take a photo to attach, and downloads are saved to your device only when you ask.

How Long Data Is Kept

Account data and what you store are kept until you delete them or delete your account. Sign-in links expire after 20 minutes and passkey challenges after five. A device's session record, with its IP address and location, is deleted when that device is signed out.

Deleting Your Data or Your Account

You can delete chats, files, images, memory and API keys in the Workspace at any time, and remove passkeys, devices and a linked Discord or Google account on your account page. To delete your whole account and everything stored with it, email [email protected] from the address on your account (or say which Discord account it is). The account and the data stored with it are then deleted, except anything the law requires keeping.

Children

Dyadic is not meant for children under 13 and does not knowingly collect their data.

Contact

Questions or requests about your data: [email protected]. When this policy changes, the date at the top changes with it.