Privacy Policy

When you create an account and use the app, we collect: Data you give us: name or nickname, email, password (always encrypted), date of birth, gender (optional), profile photo (optional), relationship status, and reason for using — collected during onboarding to personalize your experience. Data generated by use: messages exchanged with the AI, voice message recordings you make (transcribed to text), photos you send in chat, diary entries (title, text, mood, categories), tasks created, emotional patterns identified, and language and theme preferences. Technical data: device type, operating system, error logs, and timestamps.

Every piece of data has a reason: • Your name and email enable login and personalization • Your messages power the AI conversation • Your diary and tasks are stored so you can access them later • Emotional patterns generate personalized insights and reports • Technical data helps identify and fix errors We never use your data for third-party advertising. We never sell your information.

We share data only with the essential partners (processors) needed for the app to function: Supabase — database and authentication; where your information is securely stored. (supabase.com/privacy) OpenAI — processes your text messages, transcribes your voice audio, and analyzes photos you send in chat, to generate the AI responses. (openai.com/privacy) Google — push notifications (Firebase Cloud Messaging), Google Sign-In, and Madelaide's voice (Google Cloud Text-to-Speech, when you listen to audio replies). (policies.google.com/privacy) RevenueCat — manages your subscriptions. It receives no card data — payment is handled by the store (Google Play). (revenuecat.com/privacy) Sentry — records app errors and crashes so we can fix bugs. (sentry.io/privacy) Brevo — sends your account emails (sign-up confirmation, password reset). (brevo.com/legal/privacypolicy) All act as processors, under contract, and never receive your data for their own commercial purposes.

Security is not optional for us: • All connections use TLS/HTTPS encryption • Passwords are stored with secure hashing — never in plain text • Data access is controlled by Row Level Security (RLS) policies • AI API keys live only on servers — never on your device • We continuously monitor for suspicious access In the event of a security incident that may affect you, we will notify affected users within the legal timeframe.

We keep your data for as long as necessary: • Active account: while you use the app • AI conversations: up to 12 months, then anonymized • After account deletion: personal data removed within 30 days Some data may be kept longer when the law requires it.

You can, at any time: • Access your data — know what we have about you • Correct incorrect or outdated information • Delete unnecessary data • Portability — receive your data in a structured format • Revoke consent whenever you want • Delete your account — available directly in Settings To exercise your rights: [email protected] Response within 15 business days.

What you share in the diary, in conversations, and in mood data is treated with maximum protection. • Processed only with your explicit consent • Accessible only by you • Never shared with third parties for commercial purposes • Used only to personalize your experience in the app

Madelaide is exclusively for users aged 18 and older. If we identify that a minor is using the app, the account will be closed and data immediately deleted. If you are aware of a minor using the app, please let us know: [email protected].

Data Controller: Bruno Oliveira dos Santos, responsible for operating Madelaide (individual), reachable at the emails below. Data Protection Officer (DPO): [email protected] Other matters: [email protected]