Privacy / review draft · 30 September 2026
Your address.
Your boundaries.
Not a final policy or verification-ready document. Operator legal identity, address, jurisdiction, legal bases, processor/transfer details, and retention schedules still need confirmation and legal review. Contact: [email protected].
Operator
MailDial Oy, Pentagonveien 1, 1430 Ås, Norway. Contact: [email protected]. Company registration details and data-controller arrangements remain to be confirmed before final publication.
Account and Google sign-in
MailDial uses Supabase for authentication and account storage. Email sign-in associates a verified email with an account and public MailDial number. Google sign-in requests basic identity information: an account identifier, email address, and profile information such as name or avatar supplied by Google. These are used to authenticate and maintain the account. Google sign-in does not grant MailDial access to read your Gmail, Google Drive, or address book.
The browser keeps session credentials in local storage so you can stay signed in. Protect shared devices and sign out when finished. Google identity data is not published as a Pool profile, sold, used for targeted advertising, or used to train studio voices by the current app. Any new use requires updated disclosure and an appropriate permission process.
Private email and Box
Your destination email is not in the public directory. Cloudflare processes incoming email for forwarding to a verified destination; your sender and receiving provider handle their own email records. MailDial stores delivery metadata, not a private conversation inbox. It is not end-to-end encrypted email and does not promise anonymity. The app does not provide an attachment-upload feature; external email may nevertheless contain attachments. Do not treat this as an attachment-scanning promise.
Planned private conversations
Private Box copies and Circle talks are not enabled in the current service. Before activation, this notice must be finalized with the actual processor region, access controls, legal basis, backup and log schedules, and rights handling. The planned in-app copy contains plain-text message content, sender/recipient MailDial identifiers, and timestamps, without attachment bytes. Its active-service retention target is 90 days, with earlier removal on account return where technically applicable. Outside email providers and other participants may retain independent copies. MailDial will not keep all private conversation text forever for product development or use it to train studio material. Limited, non-identifying aggregate service measurements may be used to improve reliability after safeguards are reviewed.
Public Pool and lasting memories
Pool thoughts, reactions, and replies are public while available. Account identifiers link contributions internally for access control and limits. Community and studio thoughts can remain in Pool for up to six months, with dependent reactions and comments removed during cleanup. The reusable studio editorial library is separate. New comments permit a Circle request by default unless the commenter checks the opt-out box before posting. Older comments keep their original choice. Writer-opted-in, reviewed public thoughts can enter Memoric Corner beyond ordinary Pool expiry; an early 72-hour reaction and jury window still applies. Private mail and other people's comment text are not archived there. Authors can remove their archived thought.
Pool safety check planned
Before a new public thought is posted, MailDial plans to send its text to the Agnes AI text service for a safety classification. The check does not need your private email address or MailDial number. Clear threats, graphic violence, hateful abuse, exploitation, or encouragement of self-harm may be declined; ordinary sadness, grief, and requests for support are not automatically prohibited. If the safety service is unavailable, the thought is not published. This integration must not be enabled until Agnes's processing location, retention, training use, and transfer terms are checked and this notice is finalized.
Aura dust
MailDial awards 5 Aura dust when you publish a community thought. When the interaction feature is enabled, the thought's owner also receives 5 for another person's first reaction and 5 for each new reply. Self-interactions and studio prompts do not earn interaction dust; changing or removing and re-adding a reaction does not earn more. When the Circle connection feature is enabled, both people receive 5 after accepting a connection, once per account pair; declines and repeat connections earn nothing. Aura dust is a service metric, not money. The award ledgers keep the owner's account ID, source identifiers, award type, and an interaction or connection reference so awards remain counted after public content expires. For anti-repeat protection, a reacting or connected account ID is kept while that account exists; on account deletion that ID is removed from the surviving person's award row. Award rows belonging to the deleted owner are removed. These ledgers contain no thought, reply, or private-message text.
Circle and presence
Saved contacts and nicknames are private to the account owner. Contact requests reveal the requester's public number to the recipient and require acceptance. The planned Aura Node card lets a signed-in MailDial user who knows an exact active number see that number, its MailDial join date, and Aura dust before, during, or after a Circle request. It does not reveal the private email address, another person's contact nickname, presence, or messages. Profile lookups are limited per account. This card is not enabled until its database access and privacy checks are completed. Presence is optional and based on recent check-ins, not precise activity or read receipts.
Location and device choices
Location sharing is optional at posting. With permission, the browser obtains a position and rounds coordinates to whole degrees before submission. The app does not continuously track you. Coarse location accompanies a live post and is not a street-level location. City placements of studio thoughts are editorial, not users' whereabouts.
Providers, safety, and legal requests
The current architecture uses Cloudflare for hosting/email routing and Turnstile, Supabase for authentication/database services, Google for optional sign-in, and Resend for configured sign-in email delivery. They process relevant authentication, delivery, infrastructure, and abuse-prevention data under their own applicable arrangements. Final processor regions, cross-border safeguards, and log/backup retention must be confirmed before launch.
We may disclose information actually held where legally required or otherwise lawfully necessary for a proportionate response to a specific safety emergency. This does not grant blanket access to authorities. We do not secretly publish private messages or train studio models on users' thoughts in the current app.
Retention, rights, and contact
Account records persist while needed to operate the account. Exact account-deletion, security-log, delivery-metadata, backup, and legal-hold schedules remain to be finalized. Public expiry does not guarantee immediate deletion from third-party caches or provider backups. Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing, and complain to a relevant data-protection authority. Contact support to discuss a request; verify ownership without sending passwords or sign-in codes.
The intended minimum age is 16, or any higher local requirement. Material changes will be dated and communicated. This draft must be finalized before public onboarding and OAuth branding submission.