MMOSHCODEapp

Privacy Policy

Effective date: November 11, 2026 · Terms of Service

moshcode is operated by Profullstack, Inc., 16375 Bonnie Lane, Los Gatos, CA 95032, USA. This policy covers moshcode.sh, app.moshcode.sh (including the pit and the Moshpit name registry), the moshcode MCP server, and what the moshcode CLI sends to them. It describes only what the service actually collects.

The CLI runs on your machine

The moshcode CLI installs and drives coding agents (opencode, Claude Code, codex and others) on your own computer. Your code, prompts and the agents' own accounts stay between you and those tools. The CLI sends something to app.moshcode.sh only when you use a feature that needs it: an approval, a live session mirror, the herd on your phone, settings sync, or the pit.

What we collect

Account. Your email address and a password (stored only as a hash), or a passkey (we keep its public key and a counter), or Sign in with CoinPay (we keep the CoinPay account identifier). An optional display name. A session cookie while you are signed in. API keys and CLI sign-ins are stored as hashes with a short prefix.

Approvals. When a script asks for one, we store its message, the context the script sent, the script name, and your reply.

Notification channels. The channels you add: an email address, a Slack incoming webhook URL, a Telegram chat id, browser push subscriptions, or a phone number for SMS.

Live sessions and the herd. If you mirror a CLI session or turn on the herd for your phone, the CLI sends the terminal output of that session (we keep the most recent part as scrollback), the session and machine names, and their status, and we queue the lines and keys you send back until the CLI collects them.

Teams. Organizations, teams and members you create, and the sessions you share with them.

Settings sync. The settings snapshots you save from the pit with /save; you can delete them from your settings.

Credits and payments. Credits are prepaid in cryptocurrency through CoinPay. We keep a ledger of credits bought and spent, purchase amounts and status, credit codes you redeem and invites you send. We never see card or bank details.

Moshpit names. Names and endings you register or buy, their records (addresses, sites, links, feeds and content you publish to them), and offers. If you opt in to a contact address for a name, mail to it is forwarded to you through Forward Email without publishing your own address.

Cookies and local storage

Signing in sets a session cookie, and forms carry a CSRF token. An invite or referral link sets a cookie so a later sign-up can be credited. There are no advertising cookies.

Who else is involved

Nothing is sold, and no advertising profile is built from you.

What is public

Registered Moshpit names, their records and anything you publish to them are public. Approvals, sessions, settings, channels and payments are visible only to your account and the teams you share them with.

AI agents and MCP

The moshcode MCP server is at https://app.moshcode.sh/mcp (JSON-RPC 2.0, streamable HTTP), and a single shared session is reachable at https://moshcode.sh/api/v1/mcp/<share-id>. There are no anonymous tools: every call needs an OAuth 2.1 access token (authorization code with PKCE, or device authorization) that you approve in the browser. With it, an MCP client can list your live moshcode sessions, read their output, and, only with the permissions you grant, send a line or a key, answer or approve a prompt, or cancel the session. Access tokens last at most an hour, and revoking the grant or the share stops them at once.

MCP and API requests are logged (time, tool or route, IP address, and the account or key if any) for abuse prevention and rate limiting. MCP actions are also recorded in an audit log of who did what and when, without the command text or terminal output. No MCP data is sold or used for advertising.

Keeping and deleting data

Session output is kept as a rolling scrollback, not a full history. Settings snapshots can be deleted from your settings. Everything else is kept until you delete it or ask us to. To delete your account, write to support@profullstack.com from the address on the account.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data. Contact us to exercise them.

Children

moshcode is a developer tool and is not directed at children under 13, and we do not knowingly collect personal information from them.

Changes

If the service starts doing something different, this page changes with it. Material changes will be announced on this page.

Contact

Profullstack, Inc., 16375 Bonnie Lane, Los Gatos, CA 95032, USA. Email support@profullstack.com.