Last updated May 2026. This notice explains what _mycroft collects, why, who we share it with, and how to contact us. It is written in plain language; a counsel-reviewed policy should replace or extend it before any large-scale commercial launch.
Who we are
_mycroft is private software offered by its operators. For privacy questions, contact support@mycroft.app. When South African law applies, we act as the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) for personal information you provide to use the Service.
What we collect
- Account data — your email, sign-in credentials managed by Supabase, optional display name, and tier / subscription status.
- Watchzone and map data — coordinates and labels you choose for pins (e.g. "Home", "Mom"), and the radius and preferences you set. We do not track your real-time device location unless you explicitly share it.
- People/place labels you add — names like family members, homes, rentals, or travel spots are user-provided labels. Please only add data you have the right to use and share.
- Payment metadata — receipt identifiers, amounts, and subscription status returned by Yoco. We do not store full card numbers; those stay with the payment processor.
- Usage and content — queries you submit (e.g. for AI analysis, search), credit consumption, alert delivery records, support messages.
- Technical data — IP address, device and browser information, basic logs needed to operate and secure the Service.
- Messaging identifiers — phone number and WhatsApp opt-in state when you choose to receive alerts via WhatsApp through Twilio.
Why we use it (legal basis)
- To provide the Service — performance of contract: account, map, alerts, payments.
- To keep it secure — legitimate interest in preventing fraud, abuse, and outages.
- To meet legal obligations — e.g. tax, payment-record keeping, lawful requests.
- With your consent — for optional communications (e.g. WhatsApp alerts, product emails) where consent is required. You can withdraw consent at any time.
Subprocessors
We rely on the following processors. They each receive only the data needed to perform their function and are bound by their own privacy and security obligations.
SupabaseAuthentication, database, file storage VercelWeb hosting, serverless functions, and AI Gateway routing YocoCard payments (South Africa) OpenAIAI summaries and analysis (when configured) AnthropicAI summaries and analysis (when configured) AI providers process the prompts and minimal context needed to answer your request. A collection brief sends the collection intent plus the selected pins' labels, coordinates, stages, and notes; it does not send your account email. Map and weather providers receive coordinates and viewport bounds; they do not receive your account email. Some providers are based outside South Africa; using the Service involves transferring the listed data to those jurisdictions under the providers' standard data-processing terms.
How long we keep data
- Account, watchzones, preferences — for the life of your account, and up to 30 days after deletion to allow recovery and remove backups.
- Payment records and invoices — typically 5 years, to meet South African tax and accounting obligations.
- Alert and usage logs — up to 12 months rolling, then aggregated or deleted.
- Support messages — up to 24 months for follow-up and dispute handling.
- Security logs — up to 90 days unless a longer period is needed to investigate an incident.
Your rights
Subject to applicable law (POPIA in South Africa; GDPR / UK GDPR if applicable to you), you have the right to:
- access the personal information we hold about you;
- request correction of information that is inaccurate or out of date;
- request deletion of your account and associated personal information;
- object to or restrict certain processing (e.g. marketing);
- request a copy of your data in a portable format;
- withdraw consent for optional communications.
To exercise any of these rights, email support@mycroft.app. We aim to respond within 30 days. If you are in South Africa and are not satisfied with our response, you can lodge a complaint with the Information Regulator (inforegulator.org.za).
Cookies and similar tech
We use cookies and equivalent local storage to keep you signed in, remember layer preferences, and run the map. We do not currently use third-party advertising trackers. Analytics, if any, are limited to aggregated, privacy-respecting product metrics.
Children
The Service is not intended for children under 16. If you believe a child has created an account, contact support@mycroft.app and we will delete it.
Security
We use TLS in transit, encrypted storage at our hosting providers, and least-privilege access. No system is perfectly secure: if you suspect an incident affecting your account, email support@mycroft.app and we will investigate and notify affected users where required by law.
Changes to this notice
We may update this notice from time to time. Material changes will be posted on this page with a new "Last updated" date. If a change materially affects how we use your data, we will give notice by email or in-app where reasonable.