Privacy Policy

The short version

MangoTart — operated by SUPERMIND PTE. LTD., a Singapore company (“we”, “us”) — sells a small computer that runs an AI agent on hardware you own. The Hermes runtime and its working state live primarily on your device. Data still leaves when you use a model provider, messaging platform, website, connected tool, software update, support path, or optional encrypted backup. This policy explains the data MangoTart services handle.

Information we collect

• Email address — when you join the waitlist or sign in. We sign you in with a one-time code, so we don’t store a password.
• Waitlist answers — optional questions (such as your region and how you’d use MangoTart) that help us build the right product. You can skip them.
• Device identity and status — serial number, short code, hostname, account binding, local-network IP, last-seen time, and MangoTart/Hermes versions used for discovery, ownership, updates, warranty, and support.
• Order & payment — payments are processed by Stripe. We never see or store your full card number; we receive an order confirmation and the details needed to fulfil and support it.
• Website analytics — page views and limited interaction events when production analytics is configured. Session replay and captured text content are disabled.
• Sales-chat messages — text you enter in the MangoTart sales assistant is sent to OpenRouter and its selected downstream model (currently DeepSeek) to generate a reply. Do not submit passwords, API keys, or private agent data.
• Optional encrypted backups — if you enable cloud disaster backup, storage receives the encrypted file and related object metadata. Encryption happens on the device first, and we do not store or return the backup password.

What stays on your device — and what does not

Hermes configuration, memory, skills, chat state, provider and messaging credentials, and the browser profile are stored on the device. Routine agent conversations are not copied to the MangoTart website just to run the agent. Relevant data does go to any model provider, messaging platform, website, external tool, or support path a workflow uses. We do not issue model-provider credentials or proxy model requests through a shared MangoTart account.

Device support and remote maintenance

Provisioned devices are designed to join a MangoTart-operated private support network. Authorized support operators can connect over Tailscale SSH with administrative mango/rootaccess to device ports. This can expose unencrypted local content, including Hermes state and conversations, provider credentials, the browser profile, and the local backup key. The current product does not require per-session owner approval in the UI for this path. Access is controlled through MangoTart support identities and network ACLs.

How we use your information

We use the data above only to:

• run your account and let you sign in;
• process orders, ship devices, and provide warranty and support;
• register, discover, monitor, and update devices;
• deliver and retain optional encrypted disaster backups;
• answer sales-chat questions through the disclosed model providers;
• prevent abuse, enforce rate limits, and secure the service;
• send transactional email — sign-in codes and order or support updates;
• understand, in aggregate, how the site is used so we can improve it.

We do not sell your personal data, and we don’t use it for advertising.

Service providers

We share data only with the providers that help us run the service, and only as needed:

• Neon — database hosting (account & order data).
• Resend — sending sign-in codes and transactional email.
• Stripe — payment processing.
• Vercel — website hosting and site analytics.
• Mixpanel — product and website interaction analytics.
• OpenRouter and its downstream model provider — generating sales-chat replies from the messages you submit.
• Cloud object storage — optional encrypted backup files.
• Fly.io / private-network infrastructure — update and support connectivity where configured.

Cookies and local storage

We use a first-party session cookie to keep you signed in, and a small cookie to remember the currency you chose. When Mixpanel is configured, its client stores an analytics identifier in browser local storage. We do not use advertising or cross-site advertising profiles.

Retention

• Account and order records are kept while your account is active and as needed for warranty, support, tax, and legal obligations.
• Device identity and heartbeat records are kept while the device is registered and as needed for ownership, updates, warranty, support, and security.
• Optional encrypted backups use a rolling schedule of recent daily, weekly, and monthly copies; unbinding a device deletes its cloud backups.
• Rate-limit buckets contain a pseudonymous hash derived from the identifier and are pruned after seven days.
• MangoTart does not intentionally persist the sales-chat transcript in its application database; OpenRouter and the downstream model provider apply their own retention terms.
• Vercel and Mixpanel analytics follow the retention configured with those providers. Support and security records are kept as needed to resolve the case, investigate abuse, and meet legal obligations.

Ask us to delete account data and we will, except where we need to keep records for the purposes above or where law requires retention.

Your rights

You can ask to access, correct, export, or delete the personal data we hold about you. Email hello@mangot.art and we’ll help. Depending on where you live, you may have additional rights under local law.

International transfers

We’re a small team using reputable global providers, so your data may be processed in countries other than your own. We rely on those providers’ safeguards to protect it.

Children

MangoTart isn’t directed at children, and we don’t knowingly collect data from anyone under 16.

Changes

If we change this policy, we’ll update this page and the date at the top.

Contact

Questions about your data? Email hello@mangot.art.