Privacy Policy

Last updated: 2026-10-19

1. Introduction

Ma (間) is a health and mood diary ("the Service") operated by Torkel Bylund, sole proprietor (enskild firma) — registered in Sweden.

We take your privacy seriously. This policy explains what personal data we collect, how we use it, and your rights under the EU General Data Protection Regulation (GDPR).

Data Controller: Torkel Bylund, sole proprietor (enskild firma) Org. no: 19850502-6255 Filgränd 2B, 906 30 Umeå, Sweden Email: support@ma-app.com

2. Personal data we collect

2.1 Account information

• Email address
• Password (hashed with bcrypt — we can never see your password in plaintext)
• Profile name
• Theme and language preferences

2.2 Health data (sensitive personal data under GDPR Article 9)

You log this data yourself. The Service may store:

• Sleep (hours and quality)
• Energy levels
• Emotions and moods
• Habits (exercise, diet, mental health, supplements, treatments)
• Physical symptoms
• Menstrual cycle (only if you enable that feature)
• Meals and diet
• Alcohol, caffeine, fasting
• Steps, social activity
• Workouts and activities (type, distance, duration, heart rate, pace, laps, calories) — if you import them from Apple Health, Garmin, Strava, or your own files
• Strength training (if you connect Hevy)
• Your messages in conversations with the Meowl coach (stored so the conversation has continuity)
• Images you attach in conversations with Meowl (Premium). The image is downscaled and metadata such as location is removed before it is sent. Only a small thumbnail (at most 512 px) is stored in the conversation so you can see it in the history; we do not store the original image. Images may reveal health information and are therefore treated as health data (see 4)
• Files you attach in conversations with Meowl (Premium): one PDF or text file (e.g. a lab report or an export). The file is sent unchanged together with that one message. We do not store the file itself — only the file name and page count are saved in the conversation so you can see what you attached. Files may contain health information and are therefore treated as health data (see 4). Do not attach files that contain other people's information without their knowledge
• Notes you write yourself

2.3 Technical data

• IP address (for security and troubleshooting)
• Browser and device type
• Login times

2.4 Payment data (Premium only)

We never see your card number. All payment processing is handled by Stripe. We store:

• Stripe customer ID
• Subscription status and plan
• Latest payment date

3. How we use your data

3.1 Providing the Service

• Storing your logged data and showing your history
• Calculating correlations and patterns between your health metrics
• Sending reminders (if enabled)

3.2 AI-generated insights and AI coach (Premium)

For Premium users who have given AI consent (see below), relevant logged data is sent to Anthropic (Claude) to generate personalized insights and power the Meowl coach. This happens in two cases:

• Daily and weekly insights: a summary of your logging is sent to surface patterns and correlations.
• The Meowl coach: when you chat with Meowl, your message is sent together with a relevant portion of your logged data (e.g. sleep, energy, habits, training) so the reply is grounded in your data. Data is sent with each message you send. If you attach an image, it is sent (downscaled, without metadata) together with that message to Anthropic so Meowl can respond to it; earlier images are not re-sent with later messages. Likewise, an attached file (PDF or text) is sent only together with the message it belongs to and is not re-sent with later messages.

About the data:

• It is sent without direct identifiers (no name or email) but is linked to your profile — i.e. pseudonymized, not anonymized.
• Anthropic processes the data to deliver the response and deletes it under its standard terms within 30 days at most (longer only in exceptional cases, e.g. if the content is flagged by its abuse-prevention systems or where required by law). Under our agreement with Anthropic, they may not use it to train their models.
• The transfer to Anthropic (USA) is protected by Standard Contractual Clauses (SCCs) — see section 5.5.
• Separate consent for AI: the AI features are only used if you have explicitly consented to them. The first time you start an AI feature, the app asks whether you consent to your logged data — including Apple Health data (e.g. HRV, steps, sleep and workouts) — being sent to Anthropic. Without consent nothing is sent to Anthropic; Ma works as usual but without the AI features (insights are then rule-based).
• Withdrawing AI consent: at any time under Settings → Privacy & data → AI analysis of my data. After that no new data is sent to Anthropic; data already sent is deleted by Anthropic as described above. AI consent is separate from your health-data consent, which is withdrawn separately on the same page.
• The AI features are part of Premium. You can also control the processing by choosing not to use them or canceling Premium.

3.3 Service improvement

• Anonymous usage statistics
• Error reports and crash logs (no personal information)

3.4 Billing and payments

• Subscription handling via Stripe
• Bookkeeping under Swedish law (retained for 7 years)

4. Legal basis

Our processing is based on the following GDPR legal bases:

You can withdraw consent at any time by deleting your account in Settings → Privacy & Data.

5. Third-party providers

We use the following data processors to deliver the Service:

5.1 Supabase Inc. (USA)

• Purpose: Database, authentication, serverless infrastructure
• Data: All data except payment information
• Region: EU-region (Dublin, Irland — eu-west-1)
• Privacy policy: https://supabase.com/privacy

5.2 Netlify, Inc. (USA)

• Purpose: Hosting of the web app and static pages
• Data: Technical logs (IP address, requests)
• Privacy policy: https://www.netlify.com/privacy

5.3 Stripe, Inc. (USA)

• Purpose: Payment processing
• Data: Payment details, billing address, card history
• Privacy policy: https://stripe.com/privacy

5.4 Anthropic, PBC (USA)

• Purpose: AI-generated insights (daily/weekly) and the Meowl AI coach (Claude models)
• Data: Pseudonymized logged data (no name/email) for Premium users — summaries for insights, plus relevant logged data + your messages (and images and files you attach) when you chat with Meowl
• Transfer: USA, protected by Standard Contractual Clauses (SCCs) — see 5.5
• Privacy policy: https://www.anthropic.com/legal/privacy

5.5 Data transfers outside the EU

Your health data is stored within the EU (Supabase, Dublin). Some providers are US-based (Netlify, Stripe, Anthropic). These transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission, together with supplementary safeguards where needed. We do not rely on the EU–U.S. Data Privacy Framework for these transfers.

5.6 Services called directly from your device

Some features fetch data from external services directly from your device — not via our servers. These services are therefore not data processors, but your device shares certain information with them when the feature is used:

• Weather (Open-Meteo, EU): When the weather card is shown, Ma fetches weather data from Open-Meteo, an EU-based service. Only an approximate location (rounded to about 1 km) and your IP address are sent — never your name, account, or health data. Website: https://open-meteo.com
• Public holidays (Nager.Date): To display public holidays, Ma fetches a list from date.nager.at based on country code. No personal information beyond your IP address is sent. Website: https://date.nager.at

You can avoid the weather request by denying location access for Ma (in your device or browser settings).

6. Storage and deletion

6.1 Retention period

Data is retained as long as your account is active. When you delete your account:

• All personal data is deleted within 30 days
• Anonymized statistics may be retained for service improvement
• Billing data is retained for 7 years under Swedish bookkeeping law (Bokföringslagen 5 kap. 2 §)

6.2 Inactive accounts

Accounts inactive for more than 24 months may be deleted after notice via email.

7. Security

We take technical and organizational measures to protect your data:

• All traffic is encrypted with HTTPS/TLS 1.3
• Passwords are hashed with bcrypt — we can never recover them
• Row Level Security (RLS) at the database level — each user can only access their own data
• Leaked Password Protection — checks against known compromised passwords (HaveIBeenPwned)
• Two-factor authentication (MFA) is available
• Regular security updates

We who operate the Service do not read the content of your logged data, your notes/emotion texts, or your conversations with the Meowl coach — except when necessary to deliver or troubleshoot the Service, or when required by law. Access is technically restricted (RLS) so other users can never reach your data.

In the event of a personal data breach, we will notify you and the Swedish Authority for Privacy Protection (IMY) within 72 hours under GDPR Art. 33.

8. Your rights under GDPR

You have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Delete your account and all data — "right to be forgotten" (Art. 17)
• Restrict processing (Art. 18)
• Data portability — get your data in a machine-readable format (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent at any time (Art. 7.3)

To exercise your rights:

• Use the in-app functions (Settings → Privacy & Data)
• Or contact us: privacy@ma-app.com

We respond to requests within 30 days.

Complaints

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY):

• Website: https://www.imy.se/en
• Address: Box 8114, SE-104 20 Stockholm, Sweden
• Phone: +46 8 657 61 00

If you are based in another EU country, you may also contact your local data protection authority.

9. Cookies and Local Storage

Ma uses no cookies. All local storage in your browser/app is handled via Local Storage:

We use no tracking cookies, no advertising cookies, and we never sell data to third parties for marketing purposes.

10. Children

Ma is not intended for children under 16 years of age. If you are under 16, your parent or legal guardian must give consent.

We do not knowingly collect data from children under 16 without parental consent. If you discover that a child has created an account without consent, please contact us and we will delete it.

Family profile sharing: A parent or legal guardian may log on behalf of their child via our profile sharing feature.

11. Changes to this policy

We may update this Privacy Policy. For material changes, we will notify you:

• By email to the address linked to your account
• Via in-app notification
• At least 30 days in advance

Continued use after changes means you accept the updated policy.

12. Contact

Questions about this policy or your personal data:

Email: privacy@ma-app.com Data Controller: Torkel Bylund, sole proprietor (enskild firma), org. no 19850502-6255, Filgränd 2B, 906 30 Umeå, Sweden

You may also contact the Swedish Authority for Privacy Protection (IMY): https://www.imy.se/en