Privacy policy
Mandalai is a goal-planning app made by Petr Moravec, an individual developer based in the Czech Republic ("I", "me"). This policy explains what data the app handles, why, and who else sees it. Questions or requests: support@mandalai.app.
The short version
- Without an account, your goals stay on your phone. I never see them.
- With an account, your goals are stored on my server so they sync, and you can delete the account and everything in it from the Profile tab.
- When you ask the AI for subgoals, that goal and the goals above it are sent to Anthropic to write the suggestions.
- No ads, no tracking, no analytics, and your data is never sold.
What the app handles
| Data | When | Why |
|---|---|---|
| Goals (titles, details, progress) | Always on your device. On my server only if you sign in. | The app itself; syncing across devices when signed in. |
| Email address and password | When you create an account. The password is stored only as a secure hash. | Signing in, resetting a forgotten password. |
| Token balance and purchases (pack, amount, date, payment status) | When you use AI suggestions or buy tokens. | Charging for AI suggestions, receipts, refunds. |
| Goal text sent for AI suggestions | Each time you tap Generate. | Writing the suggested subgoals. |
| An anonymous user ID | The first time a guest uses AI suggestions. | Holding a guest's free token. It isn't linked to an email address. |
The app has no ads and no analytics, and it doesn't track you across other apps or websites.
Who else receives data
- Supabase (database, sign-in and server functions; servers in the EU, Frankfurt) stores accounts, synced goals and token balances.
- Anthropic (the Claude AI, USA) receives the goal you generate for, the goals above it and their details, and the titles of its existing subgoals. Nothing else about you is sent: not your email address, and no other goals. Under its commercial terms, Anthropic doesn't use this data to train its models.
- Stripe (payments) handles token purchases. Card details go to Stripe and never reach me. Stripe keeps its records of payments and invoices, which the law requires.
- Resend (email delivery) sends password-reset codes to your email address.
- Google: tapping Ask AI opens Google in your browser with the goal written into the question. That happens only when you tap it, and from then on Google's own privacy policy applies.
The app asks before the first time it sends a goal to Anthropic or Google.
Transfers outside the EU (to Anthropic and Stripe in the USA) rely on these providers' standard contractual clauses.
How long data is kept
- Account data and synced goals: until you delete the account.
- Purchase records: as long as tax and accounting law requires (up to 10 years in the Czech Republic), including after the account is deleted.
- A guest's anonymous user ID: until it's cleaned up as unused.
Deleting your data
- In the app: Profile → Delete account. This permanently removes the account, its synced goals and its token balance straight away.
- Goals on your phone: delete them in the app, or uninstall the app.
- Without the app: email support@mandalai.app from your account's email address.
Your rights
If you're in the EU or UK, the GDPR lets you access, correct, delete or export your data, object to how it's used, and complain to a data protection authority (in the Czech Republic: ÚOOÚ, uoou.gov.cz). The legal basis is the contract with you (providing the app and what you buy) and, for AI suggestions, your consent, which you can withdraw by not using them.
If you're in California, you have the right to know what personal information is collected, to delete it, and not to be discriminated against for asking. Mandalai doesn't sell or share personal information as the CCPA defines it.
Children
Mandalai isn't directed at children under 13 and doesn't knowingly collect their data. If you think a child has created an account, email me and I'll delete it.
Changes
If this policy changes, the new version will be posted here with a new date. Important changes will also be announced in the app.