Privacy Policy for the Maru App

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Privacy enquiries: privacy@heymaru.com
General contact: hello@heymaru.com
Website: https://heymaru.com
Imprint: https://heymaru.com/imprint

2. Data processed by Maru

Account and sign-in

When you sign in to Maru, we process data including a technical user ID, your email address, display name, language setting, account creation or sign-in timestamps and technical authentication data. Maru does not store passwords in plain text.

We use this data to create and secure your account and provide your personal settings. The legal basis is Art. 6(1)(b) GDPR.

Personal content and private cloud recovery

Maru lets you voluntarily record personal text and moments. These include the text you enter, local date, creation and modification timestamps, and technical presentation data such as pebble, wave and layout parameters. Maru first stores this data on your device. For new accounts in the external beta, it is also associated with your Maru account and stored in Maru's private cloud so that confirmed changes can be backed up, synchronised between signed-in devices and recovered after reinstallation. Older local data that is not associated with an account is not automatically assigned to an account you sign into later.

The cloud contract also includes the revisions, transmission status, deletion markers, conflict and conflict-resolution data, recovery metadata and presentation state technically required for these functions. The cloud service uses your technical user ID confirmed by Firebase Authentication as the ownership boundary. The app transfers only account-bound data; operational logs do not contain personal reflection text.

We process this data solely to provide the storage, synchronisation, conflict-resolution, export, deletion and recovery functions you request. The legal basis is Art. 6(1)(b) GDPR. In this beta, Maru is not intended for storing special categories of personal data under Art. 9 GDPR. In particular, do not enter health data or data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric identification data, sex life or sexual orientation.

We do not use personal text for advertising, editorial publication, profiling, topic or mood analysis, automated decisions or training generative models. Changes that have not been confirmed as stored in the cloud cannot be recovered if the only device holding them is lost.

Stories and usage progress

The app downloads editorial stories, images and, where available, audio. To provide your library and let you continue a story, we may process the story ID, language version, opening timestamps, reading progress and audio position. A successfully opened item may be associated with your account; this does not turn the editorial text itself into a private profiling record.

We process this data to provide and synchronise story features under Art. 6(1)(b) GDPR.

Premium and voluntary test access

For account-bound access, we may process confirmed subscription status, technical purchase and transaction identifiers, validity periods and free account-bound Premium access. This provides and secures the relevant access under Art. 6(1)(b) GDPR. Apple processes purchase and payment data under its platform terms; Maru does not receive full payment details. Free Premium access is not a paid subscription.

If Apple verifies your use of a Sandbox version of Maru, your Maru account may receive permanent free Premium access. This includes TestFlight and Developer Sandbox. The gift is tied to your Maru account, requires no purchase and does not become a paid subscription. A separately purchased Apple subscription remains independent. Deleting your Maru account ends its access.

Voluntary usage analytics

Optional usage analytics is active only with your consent.

Only with your voluntary consent do we collect limited usage data to improve Maru and understand which features are useful and whether people return. Analytics is off by default, including in TestFlight. You can use Maru without consenting and change your choice at any time under My Maru.

We collect only ten events: session start; opening and finishing a daily story; starting and completing audio; saving a moment and opening its detail; opening the riverbed, library and a library item. Context includes time, language, app version and environment, random session, event and attempt identifiers and, where applicable, the public identifier of the editorial story. A randomly generated identifier that remains stable for your Maru account enables analysis of returning usage. This data is pseudonymous, not anonymous.

Personal moment text, name, email address, your technical account identifier and access tokens are not collected for this analytics. We do not record screens or session replays or create advertising profiles. The legal basis is your consent under Art. 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG.

Notifications

If you enable notifications, Maru processes a technical device or push token, platform, app ID, language and opt-in status. These data are needed to deliver the morning story notification. Apple Push Notification Service (APNs) and Firebase Cloud Messaging (FCM) act as technical delivery services. The evening reminder is scheduled locally on your device.

Processing takes place only after you enable notifications and is based on your consent under Art. 6(1)(a) GDPR. You can withdraw consent at any time in Maru or the iOS settings with effect for the future. Personal text is never included in push notifications.

Technical security and App Check

To protect the app and its interfaces, we may process technical data such as app instance, app version, platform, device-integrity signals, authentication status, IP address, request timestamp and limited error or security logs. Firebase App Check uses App Attest and, where necessary, DeviceCheck on Apple devices to recognise authorised app instances.

The purpose is secure and reliable operation and the prevention and detection of misuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the security and availability of Maru.

Local storage and cache

Maru stores settings, personal content, library and reading progress, and downloaded images and audio locally on your device. This provides the requested features and some offline use. You can remove individual private moments or your account using the available deletion functions. When you delete the app, iOS removes local app data in accordance with its platform rules; this alone does not delete cloud data already associated with your account.

TestFlight beta testing

When you use a pre-release version of Maru through Apple TestFlight, Apple automatically collects information about the invitation, installation, device, operating system, sessions, crashes and crash logs and makes it available to us as the app provider for testing, troubleshooting, security and improvement of the beta. This Apple collection cannot be disabled within TestFlight. Depending on the invitation method, your name and email address may be visible to us.

If you voluntarily submit feedback, it may also include comments, screenshots you choose to share and technical information. Screenshots may show private content; please use synthetic examples or redact personal text whenever possible. We use data supplied by Apple only for the beta test and related troubleshooting and security checks. Apple's TestFlight privacy notice provides further information.

3. No advertising profiles or content analysis

Maru does not sell personal data. Personal text is not used for advertising, semantic evaluation, mood analysis or automated decisions. Voluntary usage analytics is limited to the data described in section 2. Apple's separate processing of TestFlight data is unaffected.

4. Recipients and service providers

We use Google Firebase or Google Cloud and Apple services for operation, authentication, databases, file delivery, app-integrity checks and push delivery:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland;
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA;
• Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, and affiliated Apple companies.

These providers process data on our behalf or as independent controllers where required for their platform services. For further information, see the privacy policies of Google and Apple.

Private Maru content is held in Google Cloud Firestore's European eur3 multi-region, with replication locations in Belgium and the Netherlands and a witness region in Finland. Firebase Authentication also processes authentication data in the United States. Data is encrypted in transit using HTTPS and at rest by the Google services we use. Private cloud recovery is not end-to-end encryption.

For voluntary usage analytics, we use PostHog as a processor with an EU project. Our data-processing agreement governs processing and assistance with data-protection rights. Information about PostHog and its subprocessors is available at https://posthog.com/privacy and https://posthog.com/subprocessors.

Editorial service accounts have no access to personal Maru data.

5. International transfers

When Google and Apple services are used, processing outside the European Union or European Economic Area, particularly in the United States, cannot be fully excluded. Where no adequacy decision applies, such transfers are based on appropriate safeguards, in particular Standard Contractual Clauses under Art. 46 GDPR. Google LLC and Apple Inc. are certified under the EU-US Data Privacy Framework to the extent the relevant processing is covered.

International transfers, particularly to the United States, may occur despite the EU project. For transfers without an applicable adequacy decision, the data-processing agreement provides appropriate safeguards, particularly EU Standard Contractual Clauses.

6. Retention

We retain personal data only for as long as necessary for its purpose:

• account and profile data: until account deletion, unless statutory duties require longer retention;
• push registration: until opt-out, device deregistration or account deletion; invalid tokens are removed;
• story progress and library: until you delete them or delete your account;
• local personal content and caches: until deletion in the app, account deletion or removal of the app;
• account-bound cloud moments and related sync, conflict, deletion and recovery data: until you delete the relevant moment or your account;
• Short-lived account-deletion receipts are normally retained for up to 24 hours, and completed deletion jobs and locks for up to 30 days. Minimal operation records needed for outstanding erasure duties are retained until completion.
• a content-free deletion barrier containing a technical account identifier remains in place so that old devices or backups cannot reactivate deleted personal content;
• operational Firestore backups: up to seven days; deleted data is not reactivated in production from those backups;
• security logs: only for the limited period required for security and error analysis, or longer where necessary to pursue a specific incident;
• data subject to statutory retention: for the applicable statutory period.

We retain usage data only while necessary for voluntary usage analytics. Under the current free PostHog plan, events are normally queryable for one year; this does not mean automatic complete deletion after one year. On withdrawal or account deletion, we arrange erasure of the analytics data linked to you. During an outstanding erasure, only the technical mappings and verification records needed to complete it are retained. Necessary consent and completion records are kept separately for their respective evidence purpose.

Technical transaction identifiers and barrier markers are retained separately from personal account content where necessary for access verification, security or preventing renewed unauthorised access. Invoice or billing records subject to statutory retention follow their applicable legal periods and lawful preservation duties. Account deletion does not shorten those periods.

7. Deleting your account and data

You can delete individual private moments and start deletion of your account and associated data in the app under “My Maru”, or contact privacy@heymaru.com. If the app requires you to sign in again, this protects against unauthorised deletion. The account-deletion process blocks further synchronisation, removes associated cloud and local Maru data, and deletes authentication last unless a legal retention duty or another statutory exception applies. A recoverable error state prevents a partial deletion from being shown as complete.

Deleting your Maru account does not automatically cancel a separately purchased Apple subscription. Manage or cancel it in Apple's subscription settings. Necessary technical evidence and billing records subject to statutory retention are separate from deletion of personal account content; the privacy policy explains the details.

You can withdraw consent at any time under My Maru. New collection stops, unsent analytics events are discarded and we arrange erasure of analytics data already transmitted. Withdrawal does not affect the lawfulness of collection before withdrawal. For questions or erasure requests, contact privacy@heymaru.com.

Under “My Maru”, after recent authentication, you can also generate a versioned JSON export of your known Maru data and save or share it locally. The server does not retain an export artifact; the app's temporary file is removed after saving, sharing, cancellation or an error. A copy that you deliberately save or share outside Maru is then under your control.

8. Your rights

Subject to the statutory requirements, you have the right to:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR), and
• withdraw consent with future effect (Art. 7(3) GDPR).

To exercise your rights, email privacy@heymaru.com.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for the controller's actual establishment in Berlin is:

9. Automated decision-making

Maru does not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

10. Security and updates

We use appropriate technical and organisational measures to protect your data. These include account-bound access, Firebase Auth and App Check, encrypted transmission, server-side revision and deletion barriers, and bounded retry and export paths. However, no data transmission or storage can be guaranteed to be entirely risk-free.

We update this policy when Maru, the services we use or applicable law changes. The current version is available at https://heymaru.com/app/privacy.