Privacy Policy
Last updated 2026-08-02. Written in good faith by the person who built this app. A legal review is being arranged and this page will be updated when it happens — that is stated rather than hidden, because a policy that overclaims its own authority is the first thing worth distrusting. English only for now; the Ukrainian, Polish, German, Spanish and French editions follow the legal review, so that all six say the same reviewed thing rather than six drafts. The app itself is fully translated — this page is not, and saying which is which is the point.
Murro (“the app”, “we”) is a small, independently-run product for people living with bipolar disorder and borderline personality disorder: tracking medication, sleep and mood, and talking to an AI companion about how you’re doing. It is built and run by one person — Volodymyr, who has both diagnoses and made this first for himself — with review from a psychotherapist. This page explains what data we collect, why, and what control you have over it.
What we collect
- Account: your email address, used only to send you a sign-in code.
- Profile: the country and language you choose (used to show the right crisis line and interface language).
- Tracker logs: whatever you enter — medication taken, sleep times, mood tags, and any free-text note.
- Chat messages: your conversation with the companion bot, stored so it can remember context across sessions.
- Crisis check events: if our safety filter detects crisis-adjacent language, we log only the category and timestamp — never the message text itself.
- Money notes: if you use the money page — what you parked or bought, in your own words, an amount only if you typed one, and the sentence you wrote to yourself. There is no bank connection of any kind: we never see your card, your account or a real transaction, only what you choose to type. This never leaves our database and is never sent to the companion bot.
- The link you came by: if the link that brought you here carried a short word (for example
?from=reddit), we keep that one word with your account, so we know which places bring people here. That is all it is: one word chosen by whoever made the link — no IP address, no advertising identifiers, no browsing history.
Why we collect it
Solely to run the app: to save your logs across devices, to let the companion bot respond with real context about how you’ve been doing, and to show the correct emergency resource for your country if a crisis-adjacent message is detected.
We do not sell your data, and we do not use it for advertising. Nothing here is used to train AI models.
Who processes it
- Supabase — hosts the database and handles sign-in. Every table is access-controlled so only you can read your own rows.
- Anthropic — generates the companion bot’s replies. It receives more than your messages, and you should know exactly what: so the bot can answer with real context, each request also carries your last seven days of daily entries (including the free-text note and your wins), your medication names and whether doses were taken, your own early-warning signs, and your safety plan — with one deliberate exception: the names you listed under “people I trust” are sent, but their phone numbers and email addresses are stripped out first, because those belong to someone who never agreed to any of this. Four more things ride along that we used not to name here: whether you ticked an urge on the DBT card (as a sentence, never the numbers), how often our crisis filter has matched in the last fourteen days, how the last few days compare with your own usual sleep and mood, and which form of address you chose. It does not receive your email address, your name, the part of your safety plan about limiting access to means, your reasons for living, or anything from the money page. A message our filter recognises as an explicit crisis stops here and is never sent — but the filter reads the message you just typed, so something written days earlier in a diary entry can still reach Anthropic as part of that context.
- Resend — delivers sign-in emails.
- OneSignal — delivers medication reminder push notifications, if you turn them on.
- Vercel — hosts the app itself.
- Cloudflare (Turnstile) — checks that a sign-in attempt comes from a person, not a script. It sees the technical request on the sign-in screen only; it never sees anything you write inside the app.
How long we keep it
Your data stays until you delete it. There is currently no automatic deletion window on chat history or logs — we’re telling you that plainly rather than promising a retention policy we haven’t built yet. You can export or delete everything at any time (see below), and deletion is immediate and permanent.
What would happen if this app had to close — the warning you would get, what turns off first, and what stays yours — is written out plainly at /continuity.
Your rights
- Access & export: download every piece of data we hold about you, in Settings → My data.
- Deletion: permanently delete your account and everything tied to it, also in Settings. This cannot be undone.
- Correction: your logs and profile are directly editable in the app at any time.
If you’re in the EU (this includes Poland), these are your rights under GDPR. We built export and deletion as self-service tools specifically so you don’t have to email anyone to exercise them — but you’re welcome to.
A note on sensitivity
This app handles information about your mental health, which is treated as a special, more sensitive category of data under GDPR. We minimize what we store where we can — crisis events log a category, never your words — and we built account deletion for exactly this reason: this kind of data shouldn’t sit somewhere you can’t remove it.
Contact
This is an independently-run project. Questions or requests about your data: volodymyr@murro.app.