Privacy notice

Draft of 22 October 2026. Applies to aedile.city, the Morph access-request form and the hosted Morph app at aedile.city/morph.

Who we are

Aedile (legal entity name, registered address) runs aedile.city and Morph Studio. Questions and requests about your data: contact email.

What we collect

• Access requests. Your name, email address and project description, the time you sent them, a random ID that stops a retried submission from being stored twice, and a keyed hash of your network address (your IPv4 address or IPv6 /64). The hash is used only to limit how many requests one network can send; it cannot be turned back into your address, and an automatic hourly job deletes it 30 days after you send the request.
• Hosted Morph accounts, once they open: your email address and password (the password is checked and stored by Supabase Auth; our servers pass it on but never store it), a sign-in cookie that keeps you signed in, your projects, uploads and the designs Morph generates, records of your usage against your plan's allowance, and any model-provider API key you add. Your key is stored encrypted with a key unique to your workspace and is used only to send your own requests to that provider.
• Technical data. Like any website, our hosting providers receive your IP address, browser details and the pages you request, and keep short-lived logs for security and troubleshooting (confirm retention). When the spam check runs, Cloudflare Turnstile looks at signals from your browser to tell people from bots.

We do not use advertising or analytics trackers, and we do not sell or rent personal data. The only cookie we set is the sign-in cookie for hosted Morph.

How we use it

• To review access requests and reply to you about them.
• To run your hosted workspace: sign-in, account emails (confirmation and password reset), storing your projects and keeping usage within your plan.
• To keep the service secure and prevent abuse, for example rate limits and the spam check.

Counsel: state the legal bases (for example consent for the form, contract for accounts, legitimate interests for security) for the laws that apply.

Who processes it for us

These providers handle data on our behalf, only to provide the parts of the service listed:

• Netlify hosts aedile.city, runs the access-request form's server function and forwards hosted-Morph requests to our servers.
• Supabase stores access requests and runs account sign-in (Supabase Auth).
• Cloudflare Turnstile runs the "Verify you are human" check on the form and the sign-in pages.
• Resend sends account emails: address confirmation and password reset.
• DigitalOcean hosts the servers that run hosted Morph workspaces and store their files.
• Your model provider (for example Anthropic, for Claude) receives the requests Morph sends with the API key you add, under your own account with that provider and its privacy terms.
• Google Fonts serves the fonts these pages use, so Google receives your IP address and browser details when a page loads.

Some of these providers process data in the United States and other countries. Counsel: describe transfer safeguards (for example Standard Contractual Clauses) and list data-processing agreements in place.

How long we keep it

• Access requests: until we have reviewed them and for up to 12 months after, unless you ask us to delete them sooner. Network hashes: 30 days, then deleted automatically.
• Account data and workspace files: while your account is open. When you delete your account (or ask us to), we delete them within 30 days, and from backups within N days.

Your choices and rights

You can ask us for a copy of your data, to correct it, or to delete it, by writing to contact email. Depending on where you live you may have further rights, such as objecting to processing or complaining to a data-protection authority. Counsel: confirm which laws apply (for example GDPR/UK GDPR, CCPA) and the wording they require.

Security

Connections use HTTPS. Each hosted workspace runs separately, provider keys are encrypted at rest, and access requests can be read only by Aedile's team. No system is perfectly secure; we will tell you about a breach that affects your data as the law requires.

Children

Morph is not intended for children under 13 (16 in the EEA and UK), and we do not knowingly collect their data.

Changes

We will post any changes here with a new date, and email account holders about significant ones.