myMakPrivacy Policy
Effective November 3, 2026
This Privacy Policy explains how myMAK.ai (“we”, “us”) collects, uses, shares and protects personal information when you use the myMak apps, MAK, the website at mymak.ai and related services (the “Service”). It also explains your rights and how to use them. It forms part of our Terms of Use.
- Your chats stay on your device. We don’t receive them.
- We keep only what an account needs: your email, the name MAK calls you, your age group, your settings and the people you invite.
- No ads, no analytics, no tracking, and we never sell or share your personal information for advertising.
- Your messages go from your device to the AI provider you chose, under your own account with them.
- You can see, correct, download or delete your information at any time.
1. Who is responsible
In short: myMAK.ai is responsible for your information. Our privacy contact is support@mymak.ai.
myMAK.ai is the controller of the personal information described here (the organisation that decides how and why it is used). The person in charge of the protection of personal information, including for the purposes of Quebec law, is our Privacy Officer, who you can reach at support@mymak.ai.
2. What we collect
In short: Account details, your settings, the people you invite, and basic security records.
| Information | Examples | Where it comes from |
|---|---|---|
| Account | Email address, the name you want MAK to call you, age group (13 to 17, or 18 and over), account type (individual or family), whether the account is a child’s, the version of the Terms you accepted, your setup progress, account status, and when the account was created and last used | You, and the parent who set up a child’s account |
| Settings | Your preferences, chosen AI models, the tools and AI providers you add (their names and web addresses, never your keys), and whether memory is on | You |
| Invitations and family | Email addresses of people you invite, invitation links and their status, and family controls a parent sets for a child (such as quiet hours, study hours and content filters) | You, or the person who invited you |
| Activity record | A record of account events, such as invitations sent, settings changed by a parent, or an account paused or deleted, with the time and who did it | The Service |
| Reports and messages to us | Reports you send about content or behaviour, and emails you send us | You |
| Sign-in and security | Records of sign-in attempts and sessions, IP address, device and browser type, and the result of the person check that runs before a sign-in code is sent | Your device, our account provider (Supabase) and Cloudflare Turnstile |
| Free plan daily count | A one-way code made from your phone’s or computer’s own device ID (we never receive the ID itself, and the code can’t be turned back into it), and how many free requests were made from that device each day. The count is not linked to your account | The myMak app on your device |
| Website | Standard request information (IP address, browser type, page requested, time), used only to deliver and protect the site | Your browser, through Cloudflare |
3. What we don’t collect
In short: No chats, no keys, no passwords, no location, no contacts, no tracking.
- Chats. Your conversations with MAK, and anything MAK remembers about you, are stored on your device, not on our servers.
- Keys. Your OpenRouter key and any other provider keys stay in your device’s own secure key store. We never receive them.
- Passwords. myMak has no passwords. You sign in with a one-time email code.
- Payment details, precise location, contacts, photos, microphone recordings, advertising identifiers and analytics. We do not use analytics, advertising or tracking tools in the apps or on the website.
4. Your messages and AI providers
In short: When you chat, your message goes straight from your device to the AI provider you picked. Their privacy policy covers it, not ours.
When you send a message, the app sends it, together with recent conversation context and any instructions needed for safety features (such as Tutor mode), directly from your device to the AI provider you selected, normally OpenRouter, which passes it to the company that runs the model. This happens under your own account with that provider, using your own key. Those providers act independently of us, decide how they use your messages, and are responsible for them under their own privacy policies. Some free models may store messages or use them for training. Do not send information you want kept private. The same applies to tools and services you choose to connect: they receive the information needed to carry out the actions you approve.
5. How we use information
In short: Only to run myMak, keep it safe, support you and follow the law.
| Purpose | Legal basis (EU, UK and similar laws) |
|---|---|
| Create and run your account, sign you in, sync your settings across devices, and handle invitations and family controls | Performing our contract with you |
| Apply age-appropriate protections, including Tutor mode for ages 13 to 17 | Performing our contract; our legitimate interest and legal duties in protecting young people |
| Prevent abuse, fraud, spam and attacks (including the person check, rate limits, keeping the free plan’s daily limit to one per device, and investigating reports) | Our legitimate interest in keeping the Service and its users safe; legal obligations |
| Send sign-in codes, invitations, and important notices about the Service or these policies | Performing our contract; legal obligations |
| Respond to your questions and requests | Performing our contract; legal obligations |
| Comply with the law, enforce our Terms, and establish or defend legal claims | Legal obligations; our legitimate interests |
We do not use your information for advertising, we do not sell it, and we do not use it to train AI models. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Tutor mode is applied automatically from your age group; if you think your age group is wrong, contact us and a person will review it.
6. Who we share it with
In short: Only with the companies that help us run myMak, and with others when the law requires it.
- Service providers that process information for us under contracts that require them to protect it and use it only on our instructions:
- Supabase (account database and sign-in), United States
- Cloudflare (website hosting, security and the Turnstile person check), global network
- Google Workspace (sending sign-in emails and handling support email), United States and global
- GitHub (hosting app downloads and update files; it sees the request when your app checks for updates), United States
- Your parent or guardian, if they set up your account as part of their family: they can see and change your family settings and see the activity record for your account.
- People you invite see who invited them.
- Authorities and others where required: to comply with law, a court order or a lawful request; to protect the safety, rights or property of anyone, including reporting child sexual abuse material; or to enforce our Terms.
- Business transfers: if we are involved in a merger, acquisition, financing or sale of assets, your information may be transferred, and we will tell you before it becomes subject to a different privacy policy.
- With your consent or at your direction, such as when you send messages to an AI provider or approve an action by a tool.
7. Where it is stored
In short: Account data is stored in the United States, with safeguards for international transfers.
Your account information is stored in the United States (Supabase, US East). Our service providers may process it in other countries. When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum and Swiss amendments where needed), or another lawful mechanism. For Canadian users, information may be processed outside Canada and may be accessible to courts and authorities there; we assess transfers, including the privacy impact assessment Quebec law requires, and use contracts to give it comparable protection.
8. How long we keep it
In short: As long as your account exists. When you delete it, everything goes after 7 days.
- Account, settings, family controls and activity record: while your account exists. When you delete your account, it is marked for deletion and permanently removed after 7 days (the undo window), together with your settings, tools, providers and activity record.
- Invitations: until used, withdrawn or expired, and in any case not after the inviting account is deleted.
- Reports and support emails: as long as needed to handle them and keep the Service safe, then deleted.
- Sign-in and security records: kept by our providers for a short period for security, then deleted on a rolling basis.
- Free plan daily count per device: deleted after 30 days.
- Backups and legal holds: backup copies are overwritten on a rolling basis. We may keep specific information longer where the law requires it or to resolve disputes, and only for that purpose.
- On your device: chats and memory remain on your device until you delete them or remove the app.
9. Children and teens
In short: myMak is not for children under 13. Teens get extra protection, and parents can manage family accounts.
- myMak is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that we have, we will delete it. If you believe a child under 13 is using myMak, contact support@mymak.ai.
- Teens aged 13 to 17 need a parent’s or guardian’s permission. For them, MAK keeps answers age-appropriate and Tutor mode is always on. We collect no more information from teens than from adults, and we never use it for advertising or profiling.
- A parent or guardian who set up a family account can review and change their child’s family settings, see the account’s activity record, and ask us to access, correct or delete their child’s information.
10. Security
In short: We protect your information with strong technical and organisational measures, and tell you if something goes wrong.
Our measures include encryption in transit, database rules so each person can reach only their own data, keys kept only in your device’s secure store, password-free sign-in with short-lived codes, a person check and rate limits against automated attacks, two-step sign-in for administrators, and signed app updates. No system is perfectly secure. If a breach affecting your personal information creates a real risk of significant harm, we will notify you and the relevant authorities as the law requires, including Quebec’s Commission d’accès à l’information.
11. Your rights
In short: You can ask to see, fix, download or delete your information, and more depending on where you live. Email us; we answer within 30 days.
Depending on where you live, you may have the right to:
- know what personal information we hold and get a copy of it (access);
- correct inaccurate or incomplete information;
- delete your information (you can also delete your account in Settings);
- receive your information in a portable format and have it transferred;
- object to or restrict certain uses, and withdraw any consent you gave;
- not be subject to decisions based solely on automated processing with significant effects;
- appeal our decision on your request; and
- complain to a data protection authority.
To use these rights, email support@mymak.ai from your account email, or have an authorised agent contact us with proof of authority. We will verify your identity (normally by confirming your account email), respond within 30 days (or the shorter time your law sets; we may extend this where the law allows, and will tell you why), and will not treat you differently for using your rights. Requests are free unless they are clearly unfounded or excessive. If we refuse a request, we will explain why and how to appeal.
12. Regional information
European Economic Area, United Kingdom and Switzerland
Our legal bases are listed in section 5. You may lodge a complaint with your local data protection authority (in the UK, the Information Commissioner’s Office). Where the law requires us to appoint a representative in the EU or UK, we will name it here.
Canada and Quebec
We handle personal information under the Personal Information Protection and Electronic Documents Act and applicable provincial laws, including Quebec’s Act respecting the protection of personal information in the private sector. You may withdraw consent (subject to legal or contractual limits), access and correct your information, and, in Quebec, ask for information about how it was collected and processed and receive computerised information in a structured, commonly used format. You may complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information. We do not use technology that locates or profiles you.
United States
These disclosures apply to residents of California and other states with comprehensive privacy laws. In the last 12 months we collected these categories of personal information: identifiers (email address, IP address); account details; a protected characteristic (age group); internet or network activity (sign-in and security records); and the content of reports and emails you send us. We collected them from the sources in section 2, for the purposes in section 5, and disclosed them for business purposes to the service providers in section 6. We use the account sign-in information only to provide and secure the Service, which is a permitted use. We do not sell or share personal information (including for cross-context behavioural advertising), and have not done so in the last 12 months, and we have no actual knowledge of selling or sharing information of anyone under 16. You have the rights in section 11, including to know, delete and correct, and to appeal a decision by replying to our response; if your appeal is denied, you may contact your state attorney general. We honour Global Privacy Control signals, although there is nothing to opt out of.
Elsewhere
If you live in another country with privacy laws, such as Australia, Brazil or Japan, you have the rights those laws give you, and you can use them as described in section 11.
13. Cookies and tracking
In short: No tracking cookies, no analytics.
Our website does not set its own cookies and does not use analytics or advertising tools. Cloudflare, which delivers and protects the site, may use strictly necessary security measures, and the person check (Cloudflare Turnstile) looks at technical signals from your browser to tell people from bots; it is not used for advertising or tracking across sites. The apps contain no analytics, advertising or tracking code.
14. Changes
We may update this Privacy Policy. If we make significant changes, we will tell you by email or in the app at least 30 days before they take effect, and, where the law requires, ask for your consent. The effective date at the top shows when it last changed.
15. Contact
Privacy Officer, myMAK.ai · support@mymak.ai · mymak.ai