Legal

Privacy Policy

Effective date: August 13, 2026

Overview

SUMMARU is a mindfulness app for breathing, sound, and meditation. We built it to collect as little as possible: no advertising, no analytics, no behavioral tracking.

You can use the entire app without an account. Signing in is optional, and it exists for one reason — so your practice history, journal, and conversations are not lost when you change phones. This policy explains what stays on your device, what is saved to your account if you choose to sign in, and what is sent to the AI services that power Maru.

Your account (optional)

If you sign in with Google, we receive your email address and the display name on your Google profile. We never receive your Google password. We use your email only to identify your account — we do not send marketing email.

If you never sign in, no account is created and nothing described in the next section leaves your device.

What is saved to your account

When you are signed in, the following is stored on our database (Supabase) so it can follow you to a new device:

  • Your email address and display name
  • Meditation sessions — date, duration, type, the mood you selected, and the sound category
  • Journal entries you write
  • Your conversations with Maru — both your messages and Maru's replies
  • Replies you marked with a heart
  • Favorite tracks and their order
  • Your subscription plan and how much of your monthly allowance you have used

Each account can only read its own rows. This is enforced by the database itself (row-level security), not only by the app.

These records are stored in East US (North Virginia). If you use SUMMARU from another country, your data is transferred to and stored in that region.

What stays on your device only

Some things are never sent to our database, whether or not you sign in:

  • The optional profile you fill in — gender, whether you have a partner or children and their ages, and a short personal note
  • App settings: theme, language, reminder time, background sound preferences

Your profile is used to personalize what Maru says. It is kept on your device and sent to the AI provider as context when you use an AI feature (see below), but it is not written to our database and does not move to a new phone.

What is sent to AI services

1. Chat with Maru

Your messages are sent to our server (summaru.app) and forwarded to Anthropic to generate a reply. To personalize it we include context alongside your message: your optional profile and a brief summary of your recent moods and meditation sessions. Anthropic processes this under its own policy at anthropic.com/legal/privacy.

2. Visualization images

When you create a visualization, your recent conversation context and the summary above are sent to our server, which uses Anthropic to compose a scene and fal.ai to generate the image. If you attach a photo, that photo is uploaded to fal.ai's storage and used as an input. We do not keep copies of attached photos or generated images. fal.ai processes this under its own policy at fal.ai/privacy.

3. Voice conversation

You can speak to Maru instead of typing. The microphone is only active while you have voice turned on, and it stops as soon as you turn it off.

The speech is turned into text by your own device, not by us — the operating system on the app (Apple on iOS, Google on Android) and the browser on the website. Depending on your device and its settings, that step may happen on the device or the audio may be sent to Apple, Google or your browser provider to be transcribed. That part is outside our control and is governed by their policies.

Summaru never receives or stores your audio. Only the resulting text reaches our server, where it is handled exactly like a message you typed (section 1). Maru's spoken replies are read aloud by your device's own text-to-speech, so no audio leaves your device for that either.

If you sign up as a tester

The website has a form for joining the pre-release test. It asks for one thing: the email address you use for Google Play, which is what an invitation to a closed test has to be sent to.

That address is sent to us over Telegram and kept only until the test is over. It is used to send you the invitation and nothing else — no newsletter, no marketing, and it is never passed to anyone. Ask us at support@summaru.app and we will delete it.

Submitting the form does not create an account, and it is unconnected to any account you may already have.

Making Maru better

When you press the heart on something Maru said, that reply is kept — on your device and on our server — so the improvement carries over when you change phones. We read these to see what actually helped, and we change how Maru is asked to speak.

That is prompt work, not model training: nothing you say is used to train an AI model, by us or by anyone else, and none of it is sold or handed to a third party. Only replies you chose to mark are kept this way — the rest of a conversation is not.

Ask us at support@summaru.app and we will delete them, or delete your account and they go with it.

Counting visits to this website

This website counts page views so we can tell which writing is read. It uses Vercel Web Analytics, which sets no cookies and builds no profile of you: it records the page, the referring site, the country, and the kind of device — nothing that identifies a person, and nothing that follows you to another site.

This counting happens on the website only. The app does not do it, and it is unconnected to your account or to anything you tell Maru.

What we do not collect

  • No password — sign-in is handled entirely by Google
  • No phone number, address, or payment card details
  • No device identifiers or advertising IDs
  • No location data
  • No advertising, and no data sold or shared with advertisers
  • Nothing you tell Maru is used to train anyone's AI models

Stopping abuse

The free visualization card is one per account. To keep that from being defeated by making accounts in bulk, we also count how many cards come from one network address in a day.

We do not store the address. It is combined with a secret value and hashed, and only the hash and a per-day count are kept. The hash cannot be read back as an address, and it is not used to recognize you, build a profile, or link your visits — it only answers “how many today.” These records are deleted after seven days.

Third-party services

ServicePurposeData shared
GoogleSign-inYour email address and display name are shared with us by Google when you sign in
SupabaseAccount database and authenticationEverything listed under “What is saved to your account”
AnthropicMaru replies and visualization scene textChat content, plus profile and a mood/session summary used for personalization
fal.aiVisualization image generation and photo storageConversation context, and any photo you attach for a visualization
VercelApp and website hostingStandard request logs (IP, timestamp)
TelegramDelivering tester sign-ups to usOnly the email address you type into the tester form on the website

How long we keep it

Data saved to your account is kept until you delete it or delete your account — we do not expire it on a schedule, because the point of keeping it is to preserve a long practice history. Your device keeps only the 15 most recent conversations with Maru; your account keeps them all.

Chat messages are not retained by us after Anthropic returns a reply, beyond the copy saved to your account described above. Photos attached to a visualization are handled by fal.ai under its own policy. Vercel request logs are retained per Vercel's standard policy.

Deleting your data

Delete your account and everything in it. In the app, open Settings → Delete account. This permanently removes your account and all records listed above — sessions, journal, conversations, favorites, and subscription usage. It cannot be undone, and it takes effect immediately.

Clear only your practice history. In the app, open Settings → Clear history. This removes your meditation records from both your device and your account, and keeps the account itself.

Remove everything from the device. Uninstalling the app removes everything stored locally, including your profile and settings. If you have an account, uninstalling does not delete it — use Delete account first.

If you cannot access the app, email us at support@summaru.app from the address you signed in with, and we will delete your account and its data within 30 days.

Children

SUMMARU is not directed at children under 13. We do not knowingly collect any information from children.

Changes to this policy

If we make material changes, we will update the effective date at the top of this page. Continued use of the app after changes constitutes acceptance.

Contact

Questions or requests: support@summaru.app