Privacy Policy

Mahadhi is a focus and planning app built for the way ADHD brains actually work. We designed it to hold as little of your data as possible. - You can use Mahadhi without creating an account at all. - Your blocks, thoughts, sessions, and settings live on your device. If you create an account, they also sync to our servers so your other devices can have them — you can turn that off in Settings. - Voice-to-text happens on your device. Your audio is never uploaded. - One more optional feature sends data out: if you tap "Break it down", that block's title is sent to our AI provider to generate suggested steps. Nobody stores it. - We show no ads, use no analytics or tracking SDKs, and never sell your data. The one thing that leaves your device without an account is a crash report, described below.

"Mahadhi", "we", "our", and "the app" refer to the Mahadhi application and this website (mahadhi.app). This policy explains what we collect, why, and the choices you have.

Account information (only if you create an account): your email address and the name you provide (one field — whatever you'd like to be called). Creating an account is optional — Mahadhi works fully without one. Accounts exist so you can sign in and sync your content across devices. Content you create: your focus blocks, plans, routines, thoughts, subtasks, and session history. This is stored locally on your device. If you create an account, it is also stored on our servers (Supabase) so that it can sync across your devices: each change you make is uploaded, and each change from another of your devices is downloaded. Sync is on by default for accounts and can be switched off in Settings at any time; while it is off, nothing you create leaves your device. We do not read, analyse, or share your content; it is used only to deliver it back to you. Voice input: if you use voice to capture a thought, speech is converted to text using your device's on-device speech recognition. The audio and transcription are processed on your device. We do not record, store, or transmit your audio. AI task breakdown ("Break it down"): if you tap this optional feature, the block's title and planned duration are sent to our server and passed to our AI provider (Anthropic) to generate suggested first steps. Nothing else is sent — no other blocks, history, or personal details — and neither we nor the provider store the content of these requests. We keep only a daily usage count tied to your account to enforce fair-use limits. Subscription information: if you buy Mahadhi Pro, we (via RevenueCat and the App Store / Google Play) record your purchase status and receipt so we can unlock Pro and restore it across your devices. We never receive or store your payment card details. Photos: if you attach a screenshot to a bug report, that image is included only in the report you choose to send. We do not browse or access your photo library otherwise. Backups: you can export a backup of your Mahadhi data from Settings. The backup is a file created on your device that you choose where to send — it does not pass through our servers, and once you share it, it is governed by wherever you put it (email, iCloud, another app). Restoring a backup reads that file back into the app on your device. On-screen displays: block names and times appear in your notifications, on the lock screen (Live Activity), and in the home-screen widget if you add one. These are rendered on your device by iOS. Anyone who can see your screen can see them, so keep that in mind when naming a sensitive block. Shared Rhythms: if you choose to share a plan ("Rhythm"), the plan's blocks — their names, durations, colours, any to-do items inside them, and any start or hard-stop times you set — are stored on our servers and given an unguessable link (mahadhi.app/r/…). Anyone who has that link can read the plan — in the Mahadhi app, or on that web page in any browser without the app — so treat the link the way you would treat the plan itself, and don't share a plan whose block names you wouldn't want a recipient to forward. A shared Rhythm does not include your account details or any personal data beyond an optional first name you can choose to attach. It has no expiry: it stays readable until it is removed (see Data retention & deletion). Crash diagnostics: when Mahadhi crashes or hits an unexpected error, a report is sent to our error-tracking provider (Sentry) so we can find and fix it. A report contains the technical detail of the failure — the error and where in the code it happened, the app and update version, your device model, OS version and basic device state (such as free memory and orientation) — plus a short trail of which screens, taps and network requests preceded it (paths and element names only, never their contents). It may include a random identifier for that app installation so repeat reports can be counted as one problem; it is not linked to your account. Crash reports deliberately do NOT include your blocks, to-dos, thoughts, history, name, email, screenshots or any recording of your screen. The app's own diagnostic logs are excluded because they mention block names. For errors the app reports itself, any text in quotation marks is also stripped out of the message before the report leaves your device; a hard crash is captured by the operating system layer instead, which carries the technical failure and no text of yours. Nothing is sent on a normal launch — session and app-hang reporting are switched off deliberately, so a report means something actually failed. We do not collect location data. We do not use advertising identifiers. We do not embed advertising SDKs, and we do not use analytics that profile you or track what you do in the app — the only diagnostic service we use is the crash reporting described above.

Mahadhi asks for permissions only when you use the feature that needs them, and only for that purpose: - Microphone & Speech Recognition — to turn your voice into text when adding a thought. On-device only. - Photo Library — to let you attach a screenshot to a bug report. - Notifications — to send you local reminders when a focus block is ending or an anchored time arrives. - Alarms — so a block-end alert can ring like a timer even when your phone is on silent or in a Focus mode (AlarmKit on iOS 26 and later; exact alarms on Android). Alarms are scheduled and rung entirely on your device. You can revoke any of these at any time in your device settings. Mahadhi keeps working with those features disabled.

- To provide the app's core features: planning, timing, and reviewing your focus blocks. - To authenticate your account and keep you signed in (if you created one). - To deliver the local reminders you enable. - To respond to bug reports and support requests you send us. We do not use your information to build advertising profiles, and we do not share it for anyone's marketing.

If you are in the European Union, United Kingdom, or another region with similar laws, we process personal data on these bases: - Contract: processing your account email and name to provide and maintain your account. - Legitimate interest: responding to support requests, and keeping the app secure and functional — which includes the crash reports described above, so a failure that affects you gets fixed. - Consent: any optional feature you turn on (such as sharing a Rhythm). You can withdraw consent at any time by stopping use of that feature or deleting your account.

We keep external services to a minimum: - Supabase — authentication and, for accounts, secure storage of your email and name, your synced content while sync is on, and Rhythms you explicitly share. Supabase hosts data on cloud infrastructure and operates under its own privacy policy. - Anthropic — processes block titles you explicitly submit through the "Break it down" AI feature to generate step suggestions, under its own privacy policy. We use API access that does not train models on your data. - Sentry — receives a crash report when the app fails, so we can fix it. It gets the technical detail of the failure and your device model and OS version, never your content or your identity, and it operates under its own privacy policy. - RevenueCat — if you purchase a Mahadhi Pro subscription, we use RevenueCat to manage the subscription and confirm your entitlement. RevenueCat receives your purchase/receipt information and an anonymous app-user identifier (linked to your account only if you're signed in). It operates under its own privacy policy. - Apple App Store / Google Play — the payment itself is processed by Apple or Google under their own terms; we never see or store your payment card details. That's the extent of it. There are no advertising networks, no analytics providers, and no data brokers involved in Mahadhi.

Mahadhi is operated from the United States. The limited personal data we hold is stored in the United States (Supabase), and the other providers we use (Anthropic, RevenueCat, Sentry) also process data on infrastructure located in the United States. If you are in the European Economic Area, the United Kingdom, Switzerland, Canada, Australia, or New Zealand, this means the limited personal data we hold — your account email and name, anything you explicitly share, the block title you submit to the AI feature, and the technical detail of any crash report — is transferred to and stored in the United States. Where required, we rely on appropriate safeguards in our agreements with those providers: the European Commission's Standard Contractual Clauses, and for UK data the UK International Data Transfer Addendum. For users in Australia and New Zealand, this is the overseas disclosure described by the Australian Privacy Principles (APP 8) and the New Zealand Privacy Act 2020 (IPP 12); the United States is the country your data is likely to be disclosed to. For users in Canada, this is the transfer outside Canada that PIPEDA and Quebec's Law 25 ask us to tell you about: your data is stored in the United States and is subject to US law while it is there. You can avoid these transfers entirely by using Mahadhi without an account and without the AI feature; the app's core is fully on-device.

- On your device: your blocks, thoughts, sessions, and preferences are stored in your device's local database. Your sign-in token is stored in your device's secure storage (iOS Keychain / Android Keystore). - On our servers (only with an account): your email, name, your synced content (blocks, plans, routines, thoughts, subtasks, session history) while sync is on, any Rhythms you share, and a daily count of AI requests, via Supabase. - With our error-tracking provider (Sentry), if something fails: the crash report described above. This is the only thing that leaves your device without an account. - Wherever you send it: any backup file you choose to export.

Content on your device is kept until you delete it or uninstall the app. Uninstalling removes the local database from your device. If you have an account, your email and name are retained while the account is active. You can delete your account at any time from Settings → Delete Account inside the app. Deleting your account permanently removes your account record and associated data from our systems, including any content synced to it. Your local copy stays on your device until you uninstall. This action cannot be undone. You can also request deletion by emailing support@mahadhi.app. We will verify your request and complete it within 30 days. Rhythms you shared are kept until they are removed. Deleting your account removes the Rhythms you shared while signed in. A Rhythm shared without an account isn't linked to you, so we can't find it for you automatically — email support@mahadhi.app with the link or code and we will delete it. Crash reports are held by Sentry under its retention schedule and then deleted. They are not linked to your account, so we cannot look one up by person — which is the trade-off for collecting as little as we do.

Depending on where you live, you may have the right to: - Access the personal data we hold about you. - Correct inaccurate data (you can edit your name in the app). - Delete your account and associated data (Settings → Delete Account, or email us). - Withdraw consent for optional features at any time. - Object to or restrict certain processing. To exercise any of these, email support@mahadhi.app. We will respond within the timeframe your local law requires (for example, 30 days under GDPR, 45 days under CCPA). If you are not satisfied with how we handle a privacy request or complaint, you can complain to your regulator: the Information Commissioner's Office (UK), the Office of the Australian Information Commissioner, the Office of the Privacy Commissioner (New Zealand), the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec, or your local data protection authority in the EEA.

If you are a California resident: - We do not sell or share your personal information, and we have not in the preceding 12 months. - You have the right to know what personal information we collect and to request its deletion. The categories are: identifiers (your email, name and account id, if you create an account); commercial information (your purchase and receipt data, if you buy Pro); internet or electronic network activity (crash diagnostics, including device and app version information); and your own content, where you choose to send it (a Rhythm you share, or the block title you submit to the AI feature). - We will not discriminate against you for exercising these rights. To make a request, email support@mahadhi.app with "California Privacy Request" in the subject.

Mahadhi is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact support@mahadhi.app and we will delete it.

We use industry-standard measures to protect your data: encrypted connections (HTTPS/TLS), secure device storage for authentication tokens, and reputable infrastructure (Supabase). No system is perfectly secure, but because Mahadhi keeps most of your data on your own device and collects so little, your exposure is minimal by design. If a data breach affecting personal data occurs, we will notify affected users and relevant authorities as required by law.

If we change how Mahadhi handles data — for example, adding cloud sync — we will update this policy and change the "Last updated" date above before the change takes effect. Significant changes will be surfaced in the app.