Radhya Softlabs operates Mach ("Mach", "we", "us", or "our"). This policy explains how we process personal information and project data when you use the Mach dashboard, CLI, APIs, hosting, support channels, and a connected AI or MCP client. For privacy questions or requests, contact support@getmach.dev.

RSL ID provides shared sign-in across participating apps operated by Radhya Softlabs. The same email and password can be used in those apps; project access and subscriptions remain governed by each product. Account and identity data can include your name, email address, account identifier, team role, plan, country or pricing tier, and authentication/session information. Project and delivery data can include project names and configuration, source archives and build inputs you upload, build and release metadata, logs, artifacts, OTA delivery records, test-run results, device-registration details, store-submission status, and support messages. Usage and billing data can include allowances, wallet balance, pricing tier, payment order/status identifiers, and billing audit records. We do not receive or store full card details when a payment provider processes a payment.

We receive information directly from you and your authorized teammates when you create an account, configure a project, upload materials, run a build or test, connect a device, request support, or connect an AI client. We also receive service information generated by your use of Mach, and payment status information from the payment provider you choose. We receive only the information needed from app stores, signing platforms, or other services that you explicitly connect for a requested workflow.

We use information to provide the workflows you request; authenticate users; authorize project access; prepare and deliver builds, releases, tests, and hosting; calculate usage and payments; respond to support requests; prevent abuse and protect the service; investigate reliability or security issues; and meet legal obligations. We do not sell personal information or project data, and we do not use it for cross-context behavioural advertising.

Mach MCP is an optional, read-only connection. When you approve a connection, we process the connected client identity, approved scopes, connection timestamps, a hashed token identifier, and the tool arguments needed to answer your request. Tool arguments can include project, build, submission, OTA-update, or test-run IDs and list filters. The connected AI client receives only the safe metadata covered by your approved scopes: project, build, store-submission, OTA, managed Maestro, local Playwright outcome, and usage summaries. It cannot receive passwords, OAuth or personal-access tokens, secrets, environment variables, certificates, provisioning profiles, source archives, artifacts, screenshots, videos, traces, build logs, browser output, or raw test logs through Mach MCP. When you invoke Mach from ChatGPT, the requested tool output is sent to OpenAI/ChatGPT so it can answer your request; OpenAI's handling of information in ChatGPT is governed by its own terms and privacy policies.

We share information only as needed to operate the service: Amazon Web Services for authentication, databases, object storage, queueing, and transactional email; Cloudflare for network delivery, custom-domain verification, hosting, and security services; payment providers such as Cashfree or PayPal when you choose a supported payment method; and OpenAI/ChatGPT only after you explicitly connect Mach and invoke an MCP tool. We may also disclose information to professional advisers, authorities, or other parties when required by law or necessary to protect rights, safety, security, or the integrity of the service. We do not permit service providers to use Mach project data for their independent marketing purposes.

Retention depends on the record and service you use. Current MCP authorization requests expire after 10 minutes; authorization codes after 5 minutes; access tokens after 1 hour; refresh tokens after 30 days; and dynamically registered client records after 90 days. MCP connection records remain until you revoke the connection or your account is deleted. Current standard retention settings retain build artifacts and associated build-output objects for 30 days on the free tier and 100 days on paid tiers, build caches for 30 days, saved build-source archives for 14 days, and Maestro test-output objects for 30 days. Saved-source retries and managed test flows that rely on those build sources are available within the 14-day source window. Artifact entitlement is recorded when work is created; the source and Maestro file-retention limits also apply to previously stored files. Local Playwright records retain only their safe status and timing summary while the project remains active; Mach never receives their source or test-output objects. Account and project records are retained while the account or project remains active. On account deletion, Mach removes account-scoped profile, device, token, connection, and related access records; shared project history, wallet ledger entries, and payment audit records may be retained where necessary for project continuity, security, accounting, disputes, or legal obligations.

You can review and revoke an AI/MCP connection in Dashboard Settings under Security. You can manage project membership, devices, and credentials through the dashboard according to your role. You may contact us to request access, correction, export, or deletion of personal information, or to object to or restrict certain processing where applicable law provides that right. We may need to verify your identity and may retain limited information where deletion would conflict with legal, accounting, security, fraud-prevention, or shared-project obligations.

We use technical and organizational safeguards designed to protect information in transit and at rest. Access is limited to authorized people and systems with a legitimate operational need. OAuth access is scoped, short-lived, and revocable; Mach stores hashes rather than raw MCP token values. No system is completely secure, so please protect your account credentials and contact us promptly if you believe your account has been compromised.

Mach and its service providers may process information in the countries where they operate. Where information is transferred across borders, we use appropriate safeguards required by applicable law. Contact us if you need more information about a specific transfer relevant to your use of Mach.

Mach is a professional developer service and is not directed to children. Do not use Mach or provide personal information if you are below the minimum age required to consent to online services in your jurisdiction.

We may update this policy as Mach evolves or our processing changes. We will post the updated version and its effective date on this page. For privacy questions, requests, or complaints, contact support@getmach.dev.