Privacy · MySunday

Last updated 2026-09-26. MySunday is in beta, run by a single operator; this page describes what the software actually does today, not what a larger service might do later.

What stays on your Mac

Your project's source code, the dev server you point at, the agent's working directory, the task folders with their screenshots and prompts, the extension's captured references and the app's local logs stay on your machine until you remove them (see the last section). The coding agent (Claude Code or Codex CLI) runs on your Mac under your own account; what it sends to its provider is listed below and governed by that provider's terms, not by this service.

What leaves your Mac, and where it goes

The HTML and text of what you point at, with your instruction, go into the prompt your coding agent runs with, so they reach your coding agent's provider (Anthropic or OpenAI) along with whatever of your code the agent reads. Values typed into inputs are removed from these captures before they leave the browser.
Screenshots of the element you point at, of the reference you captured and of the result after the agent's edit are sent to OpenRouter (and through it to the model configured by the operator) to judge whether the change matches your intent. They may contain whatever was on that part of the page.
Audio: voice is an open microphone, not push-to-talk. From the hotkey until you turn the session off, say goodbye or 5 minutes pass without speech, what the microphone hears is streamed to Deepgram for speech-to-text; spoken replies are generated by ElevenLabs from the text the app produces. The 5 minutes are a default you can change in the app's Settings (0 means never).
The voice model: your words, the names of the elements you point at and page URLs go to a language model on OpenRouter, which turns what you say into a request. When you type a request to fill a field, the field labels (that field's and those of the fields around it, never their values) go to the same model to suggest the value.
Field fills type a value into a field on your local page after you confirm it; the form is never submitted. The value is never stored, logged or spoken back: the request that is kept and synced carries only its length.
Questions (“why did this happen?”) are answered by your coding agent in read-only mode from the page you point at, your code and the page's recent console errors and failed request URLs, without their query strings; nothing is edited. The answer is synced as the task summary, at most 500 characters.
Instructions, transcripts, requests and task outcomes (kind, status, verdict, attempt counts, summaries, changed file names) and usage counts (tasks, voice seconds, judge calls and their cost) are synced to this service's backend so your dashboard can show them and so limits can be enforced. Transcripts are synced as spoken, except a spoken request to fill a field, which is synced as “[fill request, N characters]” so the value you said stays on your Mac. The app's Settings has “Sync what I say” (on by default): turn it off and no transcripts leave your Mac (your audio still goes to Deepgram and your words to the voice model, as above, so the app can understand you).
Clips you choose to share (a short recording of the change) are uploaded to this service. They are private links until you publish them to the gallery.
Diagnostics, only when you send them from the app with a note: the app's settings without its tokens, which providers are configured (yes or no, never the keys) and its recent log lines, so the operator can look into a problem you report.
Account and device data: your email, display name, a sign-in cookie, the desktop device you approved and its last-seen time, and product events such as a download or a sign-up.
Early access: only while sign-up is by invite, if you ask for an invite, your email, the page you asked from, your optional note, the site that sent you there and campaign tags, and the invite status are stored so the operator can send you an invite. They are used for nothing else, and they are part of your account export once you sign up.
Visits to these pages are counted with no cookie, no account and no IP address stored: the page, the site that linked to it and campaign tags in the link, so the operator can see which pages bring people in. If your browser sends Do Not Track or Global Privacy Control, nothing is counted. Where you first came from is kept for the browser session (not in a cookie) and sent with an early-access request or a sign-up.

Provider API keys are held by the operator and delivered to your app encrypted; the site itself never sees them.

How long we keep data

Screenshots, audio, page captures and field labels are sent to the providers for the duration of the request and are not stored by this service; each provider's own retention applies to what it receives.
Synced sessions (with their tasks, transcripts and intents) are kept for 365 days, then deleted automatically. You can delete a session sooner from its page.
Clips are kept until you delete them or your account; a clip can be deleted from your clips page.
Diagnostics you send from the app are kept for 30 days.
Product events (such as a download or a sign-up) are kept for 400 days.
The audit log of admin actions on your account is kept for 400 days.
Usage rows are kept until you delete your account.
A waitlist entry that is still waiting is kept for 365 days, then deleted automatically; once you are invited it is kept until you delete your account (invite codes expire after 14 days).
Server logs carry request ids, user ids and error details and are kept for up to 30 days for debugging.
Deleting your account removes your sessions, clips, usage rows and diagnostics straight away; product events stay only without your user id, and audit entries age out on the schedule above.

Export and deletion

The account page downloads everything above as one JSON file and deletes the account: every synced row, clip file, device, key and sign-in is removed immediately and the desktop app is signed out. There is no undo.

Uninstalling and removing local data

Deleting your account does not touch the files on your Mac. To remove those:

To keep the app but clear what it stored, open the tray → Settings → Delete local data. It removes screenshots, prompts, transcripts, task folders and logs, keeps only the app's settings, and removes the device sign-in from the macOS Keychain.
To uninstall, quit MySunday from the tray and move MySunday.app from Applications to the Bin.
Delete the data folder ~/Library/Application Support/myfriday (Finder → Go → Go to Folder). It holds the local database, task folders with screenshots and prompts, transcripts and logs.
Remove the device sign-in if it is still there: open Keychain Access and delete the entries named com.mysunday.desktop, and com.myfriday.desktop if an older version left one.
Remove the extension on chrome://extensions and delete the folder you unzipped it into.
What was synced to this service stays until you delete it: delete your account to remove every synced row and sign the device out.

Who runs this and how to reach them