Privacy Policy

This policy explains what personal data CodeLit, a company based in India, collects when you use MediaLit at medialit.cloud (the website, the dashboard, the API, the CLI and the MCP server), and what we do with it. If you host MediaLit yourself, you run it and this policy doesn't apply.

1. What we collect

• Your email address. You sign in with a one-time code sent to it. Your display name is the part before the @.

• Session details. Your IP address and browser user agent, stored with your session to keep you signed in and protect your account.

• Your files and their details. File name, type, size, caption, group and whether it's public or private. We create thumbnails for images and videos, and WebP versions if you turn that on.

• Apps and API keys you create.

• Connected agents and the CLI. The assistant's name and website, the permissions you approved, and its access tokens.

• Billing details, if you upgrade. Lemon Squeezy handles your payment, so we never see your card. We keep your billing email, your subscription status and Lemon Squeezy's payment notifications (stored encrypted).

• Website analytics, through PostHog.

2. How we use it

• To run the service: sign you in, store and serve your files, and apply your plan's limits.

• To send sign-in codes and important notices about the service or this policy.

• To understand how our website is used.

We don't sell your data. We don't open your files unless you ask us to while helping you, or the law requires it. We don't use your files to train AI, and MediaLit never sends them to an AI provider.

3. AI agents

When you connect Claude, ChatGPT or another assistant, it can list, read, upload and delete files in the app you choose, with the permissions you approve. The assistant fetches files itself, and its provider's privacy policy covers what happens to them next. Access tokens last an hour and renew for up to 30 days. To disconnect, remove MediaLit in your assistant, run medialit logout for the CLI, or email us.

4. Public and private files

Anyone with the link can open a public file. Private files are only served through signed links that expire after about an hour.

5. Who we share data with

We share data only with the providers that help us run MediaLit:

• Amazon Web Services (hosting, database, file storage, file delivery, and sign-in and service emails through Amazon SES).

• Lemon Squeezy (payments).

• PostHog (analytics).

Otherwise we share it only when the law requires. Your files and account data are stored on servers in the United States (AWS US East). If you use MediaLit from outside the United States, your data is transferred there.

6. Cookies

One cookie keeps you signed in, for up to 7 days. PostHog uses cookies or local storage on our website for analytics. We don't use advertising cookies.

7. How long we keep data

• Uploads your app doesn't keep are deleted after 24 hours.

• Deleted files are removed from storage right away. Copies of public files may stay in the CDN cache briefly.

• We keep your account and files while your account is open.

• Billing records are kept as long as tax law requires.

• To delete your account and everything in it, email us. We'll do it within 30 days.

8. Your rights

You can download your files at any time from the dashboard, the API or the CLI. Email us to see, correct, export or delete your personal data.

9. Security

All traffic uses HTTPS, billing data is encrypted, and browser uploads never expose your API key. No system is perfectly secure. If a breach affects your data, we'll tell you.

10. Children

MediaLit isn't meant for anyone under 16.

11. Changes

When this policy changes, we update the date below. We'll email you about significant changes.

12. Contact

hi (at) codelit (dot) dev

Updated: 11 Oct, 2026