Privacy notice
A fact-checked description of the information Mosaic currently handles and the choices that still require approval.
Who operates Mosaic
Mosaic is operated by Mosaic Screens LLC. Privacy questions and personal-information requests can be sent to privacy@mosaicscreens.app.
Information Mosaic handles
Mosaic handles account identity and profile information, authentication methods, workspace membership, project messages and work, evidence, repository information an organization authorizes Mosaic to read, and support communications.
Live collaboration can also process room and participant state, presence, chat, room memory, audio, and screen sharing. Technical records such as session identifiers, request and error metadata, rate limits, usage events, delivery outcomes, and bounded lifecycle diagnostics support operation and abuse prevention.
Microsoft sign-in
Microsoft sign-in currently requests openid, profile, email, and delegated User.Read. Mosaic uses them during interactive sign-in to identify the signed-in person, resolve their Mosaic account, and read their basic profile and profile image.
The code does not request Microsoft mail, calendar, file, Teams chat, contact, group, other-user directory, or application-only permissions, and it does not explicitly request offline_access.
Why Mosaic uses information
Mosaic uses information to authenticate users; provide workspaces, project Chat, collaboration, repository evidence, live rooms, and support; maintain membership and permissions; operate optional integrations selected by an organization; prevent abuse; diagnose failures; and maintain reliability.
Current retention behavior
- Mosaic authentication sessions have a seven-day maximum age.
- Ephemeral rooms expire after four hours without activity and are cleaned daily, so ordinary room records may remain for roughly up to 28 hours after the last activity. Eligible timeline diagnostics can remain for 30 days after room expiry.
- Raw usage events are swept after 90 days; expired or consumed email-verification records after 30 days; office invites after 7 days; and room lifecycle diagnostics after 48 hours or 100 records. Expired rate-limit buckets receive a 24-hour grace.
- Account, workspace, durable project, repository-evidence, coordination, organizer, and project-memory records do not currently share one general time-based deletion rule.
- Provider-side logs, consent records, email activity, diagnostics, and backups depend on provider settings that have not yet been confirmed for publication.
Access, correction, deletion, and export
Contact the privacy address to ask about access, correction, deletion, or export. Signed-in users can start an account-deletion review at the stable account route. Shared project content, workspace authority, security and audit records, legal holds, provider copies, and other people's information can affect what is available.
Mosaic does not promise a response, export, or deletion deadline in this draft. A complete portable export and automatic deletion workflow are not current commitments.
Service providers and processing locations
The application contains paths for hosting, Postgres storage, realtime media, identity, transactional email, error monitoring, and optional Teams, AI-organizer, and repository integrations. A code integration does not prove that it is enabled in production.
Provider legal entities, active accounts, regions, backups, contracts, retention, deletion, international-transfer terms, and controller or processor roles remain pending confirmation and approval.
Cookies and browser storage
Mosaic uses authentication and room-session storage needed for sign-in, authorized room participation, protected account-linking flows, and necessary interface state. The authentication session is configured for a seven-day maximum. The signed room-session cookie is HTTP-only, SameSite=Lax, and Secure in production, but has no explicit browser maxAge in the reviewed code.
The browser-storage inventory, jurisdiction-specific disclosures, launch markets, rights and appeal process, authorized-agent handling, and children's eligibility remain pending legal approval.
Change history
- Draft 0.1 ·
Initial fact-checked publication draft. It is not effective and has not been approved as a legal or contractual commitment.