Chorus

GDPR overview

There is no mention of the GDPR anywhere on the site or in the documentation. Searching the full text and the archived HTML of every page collected returns no occurrence of GDPR, of a data processing agreement, or of subprocessors. No terms of service, no legal notice, no Article 27 representative and no data protection officer are published, and the only address exposed is the founders' mailbox. What does exist is a plain privacy page that names the data actually stored — account details and message metadata in an encrypted database at Fly, product analytics at PostHog — states that conversations remain on the user's own machine, and links to the privacy policies of the model providers. Useful as that is, it carries no compliance claim, no retention period and no description of access or erasure rights.

Who owns the data?

No terms of service are published, so the only contractual text is the privacy page in the documentation. It states that the publisher does not read conversations and does not sell data, and that the business model is subscription-based. Chat history is kept locally on the machine, in the Application Support directory, and none of it sits on the publisher's servers. What is stored elsewhere is limited to account data — email address and plan — and message metadata such as creation time, model, length and token count, held in an encrypted Postgres database at Fly, plus analytics at PostHog. Access is restricted to Melty employees. Screenshots sent in Vision Mode go to the model provider and are not retained.

Reuse rights

Because no terms of service exist, nothing in the publisher's documents restricts what you may do with the answers you obtain. In practice the material stays under your control: conversations live in a local directory you own, and your own API keys are stored locally too. The counterpart is that prompts travel to whichever model providers you enable, and their policies then apply — the privacy page links to those of OpenAI, Anthropic, Gemini, xAI and OpenRouter. The publisher states that it asks providers not to train on your data where possible, which is a request rather than a guarantee. Enterprise customers can have analytics collection turned off by writing to the founders' address.

Data retention & training

Hosting summary

No hosting country and no region are declared anywhere on the site. Most of the data never leaves the user's machine: chat history is kept in the local Application Support directory, and the privacy page states that none of it is stored on the publisher's servers. What sits elsewhere is limited to account data — email address and plan — and message metadata such as creation time, model, length and token count, held in an encrypted Postgres database operated by Fly, alongside product analytics at PostHog, which also records the operating system and IP address. The publisher describes both providers as SOC 2 compliant and states that access is restricted to Melty employees. Screenshots taken in Vision Mode are sent to the model provider and not retained. Prompts themselves transit through whichever model providers are enabled, each under its own policy. Nothing in the documentation identifies the jurisdictions involved.