1. Overview
MZAI ("we", "us", "our") takes your privacy seriously. This Privacy Policy explains what personal data we collect, how we use it, and your rights over that data. By using the Service, you agree to the practices described here.
2. Data We Collect
Account data — your email address and, optionally, your name and profile picture, provided during sign-in via Google, Apple, or magic link.
Onboarding data — zodiac sign, life goal, area of focus, and an initial question you enter during setup. This is used to personalize your AI companion.
Conversation data — messages exchanged with your AI companion. These are stored securely and are used to power the chat experience and generate conversation memory.
Memory data — short semantic memories extracted from your conversations (facts, preferences, emotional patterns). These are stored as vector embeddings in a dedicated vector database and are used to make your companion more contextually aware over time.
Usage data — streak counts, message counts, subscription status, and daily check-in responses. Used to track your progress and maintain feature access.
Analytics data — aggregated, anonymized events (page views, feature usage) collected via Amplitude. We do not sell this data and use it only to improve the Service.
3. How We Use Your Data
- To provide and operate the AI companion experience
- To personalize responses based on your preferences and conversation history
- To manage your subscription and process payments
- To send service-related communications (e.g., account security)
- To detect and prevent abuse or policy violations
- To improve the Service through aggregated, non-identifiable analytics
We do not use your conversation data to train AI models. We do not sell or rent your personal data to third parties.
4. Data Storage and Security
Your data is stored on Supabase PostgreSQL infrastructure hosted in secure cloud environments. Conversation memories are stored as vector embeddings in Qdrant Cloud. All data is transmitted over encrypted HTTPS connections.
We implement industry-standard security measures including authentication via Supabase, row-level access controls, and HMAC-verified webhooks for payment events. However, no system is perfectly secure — we encourage you to use a strong, unique password and enable two-factor authentication where available.
5. Third-Party Services
We use the following third-party services to operate MZAI:
- Supabase — authentication and primary database
- OpenAI — AI response generation and memory embeddings
- Qdrant Cloud — vector storage for conversation memories
- DodoPayments — payment processing (we do not store card data)
- Amplitude — anonymized product analytics and session replay
- Sentry — error monitoring (no personal conversation content is sent)
- Vercel / Railway — frontend and backend hosting
Each of these providers operates under their own privacy policies and data processing agreements.
6. Data Retention
We retain your data for as long as your account is active. If you delete your account, all associated data — including your profile, conversations, memories, and subscription records — is permanently deleted from our systems within 30 days of the deletion request.
Anonymous analytics events do not contain personally identifiable information and may be retained for longer periods for aggregate analysis.
7. Your Rights
Depending on your location, you may have the following rights:
- Access — request a copy of the personal data we hold about you
- Correction — request correction of inaccurate data
- Deletion — delete your account and all associated data via Settings → Account → Delete Account
- Portability — request an export of your data in a machine-readable format
- Objection — object to certain uses of your data
To exercise any right not available directly in the app, contact us at privacy@mzai.app.
8. Cookies and Tracking
We use session cookies required for authentication. We do not use advertising cookies or cross-site tracking. Our analytics provider (Amplitude) may set a first-party cookie to distinguish unique sessions; this cookie does not contain personally identifiable information.
9. Children's Privacy
The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that a minor has provided us with personal data, we will delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of significant changes via email or a notice within the Service. The effective date at the top of this page reflects the most recent update.
11. Contact
For privacy-related questions or data requests, contact us at privacy@mzai.app.