Privacy Policy
Plain English, and specific. If something isn’t listed below, we don’t collect it.
Last updated:
1. Who we are
Mashi is operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. For any privacy question or request, contact hello@mashi.app.
2. What we collect
- Account details — your email address and your name.
- Class membership — the teacher or class you belong to, if you joined one.
- Learning activity — lessons and topics completed, quiz answers and scores, XP, streaks, badges and league standing.
- In-app interaction events — which screens and features you use, so we can tell which parts of the app work.
- Purchase history — your subscription status and its renewal state.
- Push token — a device identifier used only to deliver notifications you have opted into.
3. What we never collect
Mashi does not collect your location, your contacts, your photos, or advertising identifiers. There is no advertising in the app and no advertising SDK in it.
4. Why we process it
- To give you an account and keep your progress in sync across your devices.
- To show your teacher your progress, if — and only if — you joined their class.
- To run streaks, XP, badges and the weekly Felucca Race.
- To deliver the notifications you asked for.
- To operate and improve the app.
[Lawful basis per purpose to be confirmed at legal review.]
5. Who processes your data
We use a small number of third-party providers. Each one only receives what it needs:
| Provider | What it does for us |
|---|---|
| Supabase | Hosting, database, authentication and audio storage |
| RevenueCat | Subscription management |
| Google Firebase (FCM) | Push notification delivery |
| Google Gemini | The Speak & Translate feature — see below |
We do not sell your personal data, and we do not share it with advertisers.
6. Speak & Translate
When you use Speak & Translate, the text you enter is sent to Google Gemini through our own server to be translated, and the result is returned to you. The text you translate is not stored beyond the counters we keep to enforce your daily quota.
7. How long we keep it
- Analytics events are deleted automatically after 180 days.
- Account and learning data is kept while your account exists.
8. Deleting everything
You can delete your account at any time from inside the app: Settings → Delete account → confirm. Your profile, progress, quiz history and activity are removed immediately — not queued, not soft-deleted.
You can also email hello@mashi.app and ask us to do it.
9. Your rights
Depending on where you live, you may have the right to access, correct, export or erase your personal data, to object to or restrict processing, and to complain to your data protection authority. Email us and we will action it.
10. Children
[Children’s privacy section to be completed at legal review. The app captures an age band during onboarding that includes under-13 learners.]
11. Security
Data is held in Supabase with row-level access rules, so an account can only read the records it is entitled to. Passwords are handled by the authentication provider and are never visible to us.
12. Changes to this policy
If we change how we handle your data we will update this page and change the date at the top. If a change is significant, we will tell you in the app.