Privacy Policy

Last updated: October 12, 2026

1. Introduction

We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard your information when you use the MATONE computational materials science platform.

2. Information We Collect

We collect the following categories of information:

Account information: your email address, username, and authentication credentials (passwords are stored using PBKDF2-SHA256 hashing). If you sign in with Google, we also receive the name and profile picture of your Google account.
Calculation inputs: crystal structures, simulation parameters, and any scientific data you submit for DFT, MD, or analysis calculations.
Usage data: calculation types, job submission frequency, feature utilization patterns, workflow completion statistics, and anonymous page-performance timings (load speed and responsiveness, sent to our own servers with no identifier attached).
Cloud compute metadata: instance types, provisioning timestamps, resource utilization metrics, and billing data.
Chat and conversation history: messages exchanged with MATONE's AI assistant, tool invocations, and associated job references.
Technical logs: IP addresses, browser type, access timestamps, and server-side execution logs for security and debugging.
Voice input (optional): if you dictate a message in Korean with the microphone, the audio is streamed through our server to a speech-recognition service to produce a transcript. We do not store the audio; we keep only the text you send as a chat message and a usage record of the session.

3. How We Use Your Information

We use the information we collect for the following purposes:

To provide, maintain, and improve MATONE's services, including AI-assisted workflows and analysis accuracy.
To execute your computational jobs, including generating input files, running DFT/MD calculations, and delivering results.
To manage cloud compute resources on your behalf, including provisioning OCI instances and generating billing records.
To provide technical support and communicate important service updates.
To detect, prevent, and address abuse, fraud, and security threats.

4. Information Sharing

We share your information only in the following limited circumstances:

With infrastructure providers: Oracle Cloud Infrastructure, which hosts the service and runs your calculations, and Cloudflare, which routes and filters all traffic to matone.one (and therefore processes connection metadata such as your IP address) and forwards email sent to our support@, privacy@, security@ and abuse@ addresses.
AI models: MATONE uses both EXAONE 4.5 33B (LG AI Research), which we run on our own servers, and API models from Korean AI companies. The default model is SK Telecom's A.X-K2. It writes chat replies, chooses tools, summarizes calculation results, interprets results, answers in the help widget and phrases the start-screen guidance, so the conversation text, the calculation context it carries (formulas, structures, parameters and results) and text extracted from attached files are sent to SK Telecom. Images are not sent to A.X-K2; EXAONE on our servers handles them. If you pick EXAONE 4.5 33B in the chat model picker, that conversation's replies are generated on our servers (the result-interpretation panel and the help widget still use the default model). When the default model cannot answer, EXAONE on our servers takes the request, and it also drafts autonomous research plans and extracts calculation settings from papers. If you pick K-EXAONE (LG AI Research, served by FriendliAI), Upstage Solar or, when offered, KT Mi:dm, the same content is sent to that provider. File paths and email addresses are removed before anything is sent out; scientific data is not.
Google, if you use Sign in with Google: Google verifies your identity and shares your email address, name and profile picture with us (see also section 7).
An email delivery provider, which sends account emails on our behalf (such as verification, password-reset and notification emails) and therefore processes your email address and the content of those messages.
SKT, if you use Korean voice input: the microphone audio is relayed through our server to SKT's speech-recognition service, which returns the transcript; MATONE does not store the audio. English voice input uses your browser's built-in recogniser instead, which may send the audio to Google or Apple.
Anyone you give a share link to: a share link lets anyone who has it view a read-only snapshot of what you shared, and a signed-in visitor can copy a shared workspace into their own account. You can revoke a link at any time; copies already made are not affected.
With law enforcement or regulatory authorities when required by applicable law.
We will never sell, rent, or trade your personal information to third parties.

5. Data Retention and Security

We keep your account data, projects, files and conversations for as long as your account is active. When you delete your account, your account and its data are deleted immediately. Specific retention periods:

Deleted project files stay in the trash for 30 days so you can restore them, then are removed permanently. A small record of each deleted file (such as its path, size and deletion time — not its contents) is kept for up to 180 days.
Files you attach to chat messages are deleted after 7 days.
Your sign-in history is kept for 90 days, with IP addresses stored only in hashed form.
Our database is backed up daily and the 7 most recent backups are kept, so deleted data can remain in a backup for up to about a week. Backups are stored with the service itself, not in a separate region.
Share links stay active until you revoke them.

Connections to matone.one are encrypted with HTTPS (TLS), and the cloud storage that holds your data is encrypted at rest (AES-256) by our hosting provider.

6. Your Rights

You have the following rights regarding your personal information:

Right of access: request a copy of the personal data we hold about you.
Right to correction: request that we correct any inaccurate personal data.
Right to deletion: request deletion of your account and associated data.
Right to data portability: export your data in machine-readable formats (JSON, CIF, POSCAR).

7. Cookies, Local Storage, and Tracking

MATONE sets two essential cookies — one for authentication, one to block cross-site request forgery — plus the browser's local and session storage to remember your preferences and resume in-progress work. Google's sign-in script sets a third on the sign-in page (listed below). We do not use tracking cookies, third-party analytics, or advertising technologies.

Cookies We Use

matone_auth — Authentication token (24-hour lifetime, HttpOnly, Secure on HTTPS, SameSite=Lax, scoped to /api). Set after sign-in. Required to access any account-aware feature; clearing it signs you out.
matone_csrf — Cross-site request forgery token (24-hour lifetime, Secure on HTTPS, SameSite=Strict, scoped to /). Deliberately readable by page scripts: the app has to echo it back as a request header, which is what proves a request came from our own pages. It carries no personal data.
g_state — Set on matone.one by Google's sign-in script, not by us. Google uses it to remember that you dismissed its sign-in prompt so it is not shown again immediately. It is governed by Google's privacy policy; we neither read nor use it.

Local Storage and Session Storage

We use the browser's localStorage and sessionStorage APIs (which the EU ePrivacy Directive treats the same as cookies) to keep settings client-side without a server round-trip:

Theme, font, language, and other UI preferences (localStorage, persists until you clear it).
Workspace layout, panel sizes, and tiling state (localStorage).
Cookie banner dismissal flag (localStorage).
Active study session and workspace tab state (sessionStorage, automatically cleared when you close the tab).

Third-Party Sign-In

The sign-in page offers Sign in with Google. That button is drawn by Google rather than by us, so the Google Identity Services script loads from accounts.google.com as soon as the sign-in page opens — no click is required, and it loads even if you go on to sign in with a password instead. It loads only on the sign-in page; no other page loads Google's scripts. (Separately, voice input that uses your browser's built-in speech recogniser — as English voice input does — may send your audio from the browser to Google or Apple; see section 4.) Google may set its own cookies on accounts.google.com under its privacy policy, and its script sets the g_state cookie on matone.one listed above. We do not receive or use either — they remain under Google's control.

Managing Cookies and Storage

You can clear cookies and storage at any time through your browser's privacy settings (Chrome: Settings → Privacy and security → Clear browsing data; Firefox: Settings → Privacy & Security → Clear Data; Safari: Preferences → Privacy → Manage Website Data). Clearing storage signs you out and resets your preferences.

Because every cookie and storage entry we set is essential or for your own preferences, there is no analytics or advertising surface to opt out of.

8. International Data Transfers

Your data may be processed outside your country of residence. In particular, some of our service providers — such as Cloudflare, Google (for Google sign-in) and our email delivery provider — may process data on servers outside the Republic of Korea. We rely on these providers' contractual and legal safeguards for such transfers. The default AI model (A.X-K2) is provided by SK Telecom, a Korean company; where the optional models K-EXAONE (FriendliAI) and Upstage Solar process data follows each provider's policy.

9. Children

MATONE is not intended for use by individuals under 18. We do not knowingly collect personal information from children.

10. Changes

We may update this Privacy Policy from time to time. We will notify you of material changes via email or platform notification.

11. Contact and Business Information

If you have any questions about this Privacy Policy, please contact us at privacy@matone.one. The MATONE service is operated by Logos Labs (Representative: Shinwon Son, Business Registration No.: 444-99-01784, Location: Dongducheon-si, Gyeonggi-do, Republic of Korea). We comply with applicable privacy laws including Korea's Personal Information Protection Act (PIPA) and the EU General Data Protection Regulation (GDPR) for users in the European Economic Area.

MATONE