Privacy Policy

This summary provides key points from our Privacy Notice — see the table of contents below for the full detail on any of them.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us, the choices you make, and the products and features you use.

Do we process any sensitive personal information? Yes. Because Meloa is an anxiety-aware calendar and nervous-system tracking tool, we process the consumer health data you choose to log — mood and anxiety ratings, mental health assessment scores (adapted from the GAD-7 and PHQ-9, plus a social-anxiety check-in written for Meloa), and medication logs — with your consent. We describe this in detail in our Consumer Health Data Privacy Policy. We do not process other special categories such as racial or ethnic origin, sexual orientation, or religious beliefs.

Do we collect any information from third parties? Only when you connect one. If you sign in with Google or Apple, we receive your name and email address. If you link your Google Calendar, we receive the names of your calendars and, for events on the calendar you choose to sync, the event title, location, start and end times, and event status — and nothing more (no attendees, descriptions, or attachments). See Section 1 for exactly what we receive, why, how long we keep it, and what happens when you disconnect. We do not buy or collect personal information from data brokers or other unaffiliated third parties.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We only process your information when we have a valid legal reason to do so.

How do we keep your information safe? We have reasonable organizational and technical measures in place to protect your personal information, though no method of transmission or storage is 100% secure.

What are your rights? Depending on where you're located, applicable privacy law may give you certain rights over your personal information — see the sections on privacy rights below.

How do you exercise your rights? The easiest way is to visit meloa.io or contact us directly. We will consider and act on any request in accordance with applicable data protection laws.

Personal information you disclose to us

In Short: We collect personal information that you provide to us when you register on the Services, express interest in our products, participate in activities on the Services, or otherwise contact us.

The personal information we collect may include:

• names
• email addresses
• usernames
• passwords
• contact preferences
• contact or authentication data

Sensitive Information — Consumer Health Data. As an anxiety-aware calendar and nervous-system tracking tool, we process consumer health data: mood and anxiety ratings, mental health assessment scores (adapted from the GAD-7 and PHQ-9, plus a social-anxiety check-in written for Meloa), medication logs, and related entries you choose to log. This is described in detail, separately from this general notice, in our Consumer Health Data Privacy Policy, as required by Washington's My Health My Data Act — including who it's shared with, why, and how to withdraw consent.

Date of Birth. We ask for your date of birth when you create an account, and we use it for age assurance only: to refuse registration by children under 13, and to keep the AI features off accounts belonging to anyone under 18. We do not use it for advertising, profiling, or personalization of any kind. See section 6 for why the AI features have an age limit, and section 11 for how we treat accounts belonging to minors.

Payment Data. We may collect data necessary to process your payment if you make a purchase, such as your payment instrument number and its associated security code. All payment data is handled and stored by Stripe. You may find their privacy notice at https://stripe.com/privacy.

App Store Purchase Data. If you buy a subscription or Talu actions in the Meloa iPhone app, Apple takes the payment and we never receive your payment details. Apple sends us a signed record of the purchase — which product, when it was bought, when it renews or expires, and Apple's transaction identifiers — and we keep it with your account to provide what you bought, restore it, and handle renewals and refunds. Apple's own handling of your information is described in Apple's privacy policy.

Social Media Login Data. We may let you register using your existing social media account details. If you do, we collect certain profile information from that provider, as described in How Do We Handle Your Social Logins? below.

Application Data. If you use our application(s), we may also collect the following if you grant access or permission:

• Geolocation Information. We do not request or collect your device's location. Meloa never asks for location permission, and travel estimates are calculated between addresses you have typed or chosen yourself — not from where your device is.
• Mobile Device Access. The only outside account Meloa asks for is your Google Calendar, and only if you choose to connect it — you can disconnect at any time, which revokes our access with Google. We do not request access to your device's reminders, storage, or contacts. The only image we ever see is one you pick or take yourself for Photo Add or to attach to an event, and only when you choose to.
• Microphone and Dictation. If you choose to dictate instead of typing, your device's or browser's own speech recognition service (Apple's on iPhone, Google's in Chrome) turns your speech into text. Meloa receives only the text, never the recording. On iPhone, the system asks for your permission to use the microphone first.
• Mobile Device Data. If you turn on notifications, we store the push notification token your iPhone or browser issues for Meloa (for browser notifications, together with your browser's user-agent string) so notifications can reach you. Crash reports, and usage analytics if you have opted into them, include basic device and browser information such as device type, operating system, and browser name and version. Our servers also receive your IP address when you connect. We do not collect advertising identifiers or your mobile carrier.
• Push Notifications. We may send push notifications about your account or app features. You can turn these off in your device's settings.

This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for internal analytics and reporting.

All personal information you provide to us must be true, complete, and accurate, and you must notify us of any changes.

Information automatically collected

In Short: Some information — such as your IP address and/or browser and device characteristics — is collected automatically when you visit our Services.

Most of this information does not reveal your specific identity, and may include device and usage information such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use our Services. The two exceptions are described under “How you found Meloa” and “Referrals” below: those are recorded on your account and are therefore linked to you. We also collect information through cookies and similar technologies. The information we collect includes:

• Log and Usage Data — service-related, diagnostic, usage, and performance information our servers automatically collect, including your activity in the Services (date/time stamps, pages/files viewed, searches, features used) and device event information (system activity, error reports, hardware settings).
• Device Data — information about the computer, phone, tablet, or other device you use, including IP address, browser type and version, operating system, and basic device type (for example, phone or computer).
• How you found Meloa — recorded once, the first time you arrive, and stored on your account rather than anonymously. This is the marketing source in the link you followed (for example a campaign name or an invite code), the website that linked to us (the site's address only, never the full page address, which can contain a search you typed or a private group), whether you arrived through a web browser or one of our app store apps, and which page of ours you landed on first. It is never overwritten, so it always describes how you first found us rather than how you last returned. We use it to understand which of our efforts actually reach people.
• Referrals — if you create an account using another person's invite link, we record that the two accounts are connected, so that the reward described in our Terms can be granted to both of you. This is a link between two identified accounts and we treat it as personal information belonging to both. The person who invited you is never shown who you are, that you signed up, or anything you log. They are shown only two numbers: how many people joined through their link, and how many of those reached the check-in that triggers the reward. That restriction is enforced in our database, not merely as a matter of policy. You can ask us to remove the connection at any time using the contact details at the end of this notice.

Google API

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google Calendar data

If you connect your Google Calendar, here is exactly what we access and why:

• What we receive — the list of your calendars (names and IDs, so you can choose which one to sync), and for events on the calendar you select: the event title, location, start and end times, event status, and last-modified timestamp. We do not request or receive attendee lists, event descriptions, attachments, conferencing links, or the contents of any other calendar.
• Why — solely to show your schedule inside Meloa and place Meloa's supports around it: pre-event lockouts, post-event decompression buffers, and transit time (event locations are used only to plan travel buffers). Sync is two-way: events and buffer blocks you create in Meloa can be written back to your Google Calendar. We do not use Google Calendar data for advertising, do not sell it, and do not allow humans to read it except with your consent, for security purposes, or as required by law — consistent with the Limited Use requirements above.
• How long we keep it — synced event details are stored in your Meloa calendar for as long as your account exists, so your schedule history stays available to you. Your Google access and refresh tokens are stored encrypted at rest and kept only while the connection is active.
• When you disconnect — we immediately revoke our access with Google and delete the stored tokens, and no further data is received. Events already imported remain in your Meloa calendar as ordinary Meloa events (they are your schedule history); you can delete them individually or remove everything by deleting your account. You can also revoke Meloa's access at any time from your Google Account permissions page.
• Google Calendar data and AI — see Section 6: we never use Google user data to train or improve any AI or machine-learning model.

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes only with your consent.

We process your personal information for a variety of reasons, including to:

• Facilitate account creation and authentication and otherwise manage user accounts.
• Deliver and facilitate delivery of services you request.
• Respond to user inquiries and offer support.
• Send administrative information — product changes, changes to terms/policies, and similar information.
• Request feedback and contact you about your use of our Services.
• Protect our Services, including fraud monitoring and prevention.
• Identify usage trends so we can improve our Services.
• Save or protect an individual's vital interest — for example, to prevent harm.

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so — with your consent, to comply with law, to provide services or fulfill a contract, to protect your rights, or to fulfill our legitimate business interests.

If you are located in the EU or UK, this section applies to you.

The GDPR and UK GDPR require us to explain the valid legal bases we rely on:

• Consent — where you've given us permission for a specific purpose. You can withdraw consent at any time.
• Performance of a Contract — where necessary to fulfill our contractual obligations to you.
• Legitimate Interests — where reasonably necessary to achieve our legitimate business interests, such as analyzing how our Services are used to improve them, diagnosing/preventing fraud, and understanding user experience.
• Legal Obligations — to comply with law, cooperate with law enforcement/regulators, or exercise/defend legal rights.
• Vital Interests — to protect your vital interests or those of a third party, such as situations involving potential threats to safety.

If you are located in Canada, this section applies to you.

We may process your information with your express or implied consent, which you can withdraw at any time. In some exceptional cases permitted by law we may process information without consent — for example, for fraud detection and prevention, certain business transactions, identifying injured/ill/deceased persons, or complying with a subpoena, warrant, or court order.

In Short: We may share information in specific situations described in this section and/or with the following categories of third parties.

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third parties who perform services for us or on our behalf. We have contracts in place designed to safeguard your personal information — they cannot use it beyond our instructions, share it with others, or retain it beyond the period we instruct. Every service provider that receives personal information from us must protect it with the same or equal protection as this Privacy Policy provides.

The categories of third parties we may share personal information with:

• AI Platforms
• Cloud Computing Services
• Data Analytics Services
• Data Storage Service Providers
• Payment Processors
• Map and Location Services
• Performance Monitoring Tools
• Security and Bot-Protection Services
• User Account Registration & Authentication Services
• Website Hosting Service Providers

The specific vendors in these categories today:

We may also need to share your personal information in the following situations:

• Business Transfers — in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or part of our business.
• When we use Google Maps Platform APIs — we use certain Google Maps Platform APIs (the Places API and Routes API) for addresses you type into the app yourself: to suggest address completions as you type, to place a picked address on the map, and — when you ask for a travel-time estimate — to compute a route duration between two of those saved addresses. We never read your device's GPS or other geolocation: every address Google sees is one you typed or picked, the estimate we show is not stored, and the coordinates of places you choose to save are kept in your account (and refreshed at most every 30 days, per Google's caching policy) until you delete them. You can remove saved places at any time in Settings → Places & Travel.

In Short: We use a small set of cookies — the essential ones needed to run the app, plus optional product-analytics cookies that stay off unless you turn them on. We do not use advertising or cross-site tracking cookies.

We use cookies and similar technologies (like browser local storage) to keep you signed in, honor your privacy choices, prevent fraud during checkout, fix bugs, and — only if you opt in — measure how features are used so we can improve them. We do not use advertising cookies, cross-site tracking, or third-party marketing pixels, and we never store your health data in a cookie.

Product-analytics cookies are disabled by default and are set only for signed-in users who have turned on analytics sharing and whose browser is not sending a Global Privacy Control signal. To the extent any use of these technologies is deemed a "sale"/"sharing" under applicable US state law, you can opt out as described in Do United States Residents Have Specific Privacy Rights? below.

For the full list of cookies we set, their purposes, and how to control them, see our Cookie Policy.

In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

As part of our Services, we offer AI-powered products and features ("AI Products") designed to enhance your experience.

Use of AI Technologies

We provide our AI Products through a third-party AI Service Provider, Google Cloud AI. Your input, output, and personal information are shared with and processed by this provider to enable your use of our AI Products.

The AI Products Are For Adults Only (18+)

You must be at least 18 years old to use the AI Products. Our AI Service Provider's own terms require that the AI service not be used in an application directed towards, or likely to be accessed by, anyone under 18. Meloa itself is available from age 13, but the AI Products are not: we ask for your date of birth when you create an account, and on accounts belonging to anyone under 18 the AI consent setting cannot be switched on. This is enforced in our application and in our database, not only stated here, so no information from an account belonging to a minor is sent to our AI Service Provider. Buying a paid plan does not change this.

The AI Products are also off by default for everyone, at every age. Nothing is sent to our AI Service Provider unless you turn on “AI-assisted features” yourself, and you can turn it off again at any time.

Our AI Products

Our AI Products are designed for:

• AI automation
• Image analysis
• Text analysis

How We Process Your Data Using AI

All personal information processed using our AI Products is handled in line with this Privacy Notice and our agreements with third parties, to safeguard your information throughout the process.

Google User Data and AI Models

Some AI features can include your schedule as context — for example, when you ask Talu about your day, event titles and times from your Meloa calendar (which may include events synced from Google Calendar) are part of the request. When that happens:

• Data is sent to the AI provider only at your request, to generate a response for you in that moment — a user-facing feature you actively invoked. It is used for inference only.
• We never use Google user data — or any of your data — to create, train, or improve any machine-learning or artificial-intelligence model, whether ours or a third party's, and our agreement with our AI provider prohibits it from using your prompts or outputs to train its models.
• This processing complies with the Limited Use requirements of the Google API Services User Data Policy: Google user data is transferred only to provide or improve user-facing features that are prominent in Meloa's interface, and never for advertising, resale, or model training.

In Short: If you choose to register or log in using a social media account, we may have access to certain information about you.

Where you register using a third-party social media account (like Google or Apple), we receive certain profile information from that provider — often your name, email address, and profile picture, along with other information you've made public on that platform.

We only use this information for the purposes described in this Privacy Notice. We do not control, and are not responsible for, other uses of your information by your social media provider — we recommend reviewing their own privacy notice.

In Short: We may transfer, store, and process your information in countries other than your own.

Our servers are located in the United States. Regardless of your location, your information may be transferred to, stored by, and processed by us and the third parties we share it with (see When And With Whom Do We Share Your Personal Information? above), including facilities in the United States and other countries.

If you are a resident of the EEA, UK, or Switzerland, those countries may not have data protection laws as comprehensive as your own — we take measures to protect your information in accordance with this Privacy Notice and applicable law, including relying on the European Commission's Standard Contractual Clauses for cross-border transfers. Our Standard Contractual Clauses and further safeguard details can be provided upon request.

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice, unless otherwise required by law.

When you delete your account, the deletion is scheduled and completes within 30 days; you can cancel it during that window. Health data follows the same 30-day timeline described in our Consumer Health Data Privacy Notice.

We will only keep your personal information for as long as necessary for the purposes set out in this Privacy Notice, unless a longer period is required by law. No purpose in this notice requires us to keep your personal information longer than the period of time in which you have an account with us.

When we have no ongoing legitimate business need to process your information, we will either delete or anonymize it, or — if that isn't possible (e.g. because it's stored in backup archives) — securely store it and isolate it from further processing until deletion is possible.

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, no electronic transmission or storage technology can be guaranteed 100% secure, so we cannot promise that hackers, cybercriminals, or other unauthorized third parties will never defeat our security. Transmission of personal information to and from our Services is at your own risk — please only access the Services within a secure environment.

In Short: Meloa is for ages 13 and up. We do not knowingly collect data from, or market to, children under 13. Accounts belonging to anyone under 18 carry our strictest privacy settings, and the AI features cannot be turned on at all.

By using the Services, you represent that you are at least 13 years old. If you are between 13 and 17, you represent that a parent or legal guardian has given permission for your use of the Services and has agreed to our Terms and Conditions on your behalf. We ask for your date of birth when you create an account, and we use it for age assurance only.

We do not knowingly collect personal information from children under 13. Registration is refused when the date of birth given is under 13. If we learn we have collected personal information from a child under 13, we will deactivate the account and take reasonable measures to promptly delete that data. If you become aware of any such data, contact us at support@meloa.io.

How accounts belonging to users under 18 are treated

On an account whose date of birth is under 18:

• The AI features cannot be enabled, so nothing from that account is sent to our third-party AI Service Provider. See section 6. Buying a paid plan does not change this.
• Product analytics sharing is off unless it is switched on, as it is for every account at every age.
• We do not sell personal information, share it for targeted or cross-context behavioral advertising, or use it for profiling in furtherance of decisions that produce legal or similarly significant effects.
• Any report you create for a therapist or clinician is generated only when you ask for it, and is shared only by you. We never send it anywhere on your behalf.
• The consumer health data described in our Consumer Health Data Privacy Policy is collected only with the consent recorded at signup, and can be withdrawn at any time by the account holder or their parent or legal guardian.

A parent or legal guardian who wants to review, correct, or delete the information held on an account belonging to someone under 18, or to close that account, can write to us at support@meloa.io.

In Short: Depending on your state of residence in the US or region (such as the EEA, UK, Switzerland, and Canada), you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time.

In some regions (the EEA, UK, Switzerland, and Canada) you have certain rights under applicable data protection laws, which may include the right to: (i) request access to and a copy of your personal information; (ii) request rectification or erasure; (iii) restrict processing of your personal information; (iv) data portability, where applicable; and (v) not be subject to automated decision-making. If a decision producing legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. You may also have the right to object to processing in certain circumstances. Contact us using the details in How Can You Contact Us About This Notice? below — we will consider and act on any request in accordance with applicable law.

If you are in the UK and unhappy with how we've handled your information, you can complain directly to us first. This is in addition to your rights under the UK GDPR and the Data Protection Act 2018.

How to contact us:

• Online: https://meloa.io/support
• Email: support@meloa.io
• Post: see How Can You Contact Us About This Notice?

What happens after you complain:

• We will acknowledge your complaint within 30 days of receiving it.
• We will investigate without unjustifiable or excessive delay.
• We will keep you informed of progress and explain the outcome.

If you're not happy with our final response, you can refer your complaint to the UK Information Commissioner's Office (ico.org.uk/make-a-complaint, helpline 0303 123 1113, or by post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF). If you're in the EEA or UK, you also have the right to complain to your Member State data protection authority or the UK data protection authority. If you're in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent: If we are relying on your consent to process your personal information, you have the right to withdraw it at any time by contacting us using the details in How Can You Contact Us About This Notice? below. This won't affect the lawfulness of processing before your withdrawal, nor processing conducted on a lawful basis other than consent.

Account Information

If you'd like to review, change, or terminate your account, you can log in to your account settings and update your account directly. Upon a request to terminate your account, we will schedule the deletion, which completes within 30 days and can be cancelled during that window; after that your account and information are removed from our active databases — though we may retain some information in our files to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, and/or comply with legal requirements.

Cookies and similar technologies: Most browsers accept cookies by default — you can usually set your browser to remove or reject them, though this may affect certain features of our Services.

If you have questions or comments about your privacy rights, you may email us at support@meloa.io.

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature you can activate to signal your preference not to have your online browsing activity monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized, so we do not respond to legacy DNT signals specifically.

We do, however, recognize the Global Privacy Control (GPC) signal, as required under California's CCPA/CPRA. If your browser or device sends a GPC opt-out signal, we automatically treat it as a request to limit our use of your sensitive personal information — the same effect as turning on "Limit the Use of My Sensitive Personal Information" yourself in Settings → Privacy, which also turns off analytics and AI-feature data sharing. You can always confirm or change this from that same page.

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we've processed it, correct inaccuracies, get a copy of, or delete your personal information, and to withdraw your consent to our processing of it. These rights may be limited in some circumstances by applicable law.

Categories of Personal Information We Collect

The table below shows the categories of personal information we've collected in the past twelve (12) months. For a comprehensive inventory, see What Information Do We Collect? above.

We may also collect other personal information outside of these categories through:

• Receiving help through our customer support channels; and
• Facilitation in the delivery of our Services and responding to your inquiries.

We use and retain collected personal information as needed to provide the Services, or for:

• Category A (Identifiers) — as long as you have an account with us
• Category B (California Customer Records) — as long as you have an account with us
• Category D (Commercial information) — as long as you have an account with us
• Category F (Internet activity) — as long as you have an account with us
• Category L (Sensitive personal information — consumer health data) — as long as you have an account with us

Sources of Personal Information

See What Information Do We Collect? for the sources of personal information we collect.

How We Use and Share Personal Information

See How Do We Process Your Information?.

Will your information be shared with anyone else? We may disclose your personal information to our service providers under a written contract with each — see When And With Whom Do We Share Your Personal Information?. We may also use your information for our own business purposes, such as internal research for technological development — this is not considered "selling" your personal information.

We have not sold or shared any personal information with third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed the following categories of personal information to third parties for a business purpose in that period: Category A (Identifiers), Category B (California Customer Records), Category D (Commercial information), and Category F (Internet activity) — the categories of third parties are listed in When And With Whom Do We Share Your Personal Information? above.

Your Rights

You have rights under certain US state data protection laws, though they are not absolute and we may decline a request as permitted by law. These include the right to know whether we're processing your data, to access it, to correct inaccuracies, to request deletion, to obtain a copy of what you've shared with us, to non-discrimination for exercising your rights, and to opt out of processing used for targeted advertising, the sale of personal data, or certain profiling. Depending on your state, you may also have the right to access the categories of personal data processed, obtain a list of categories (or specific parties) we've disclosed data to, review/correct how your data has been profiled, limit use of sensitive personal data, or opt out of collection via voice/facial recognition — as permitted under the applicable law of your state.

How to Exercise Your Rights

You can exercise these rights by visiting meloa.io, emailing us at support@meloa.io, or using the contact details at the bottom of this document. Under certain state laws, you can designate an authorized agent to make a request on your behalf — we may deny a request from an agent who doesn't submit proof of valid authorization.

Request Verification

Upon receiving your request, we will verify your identity to confirm you are who our records say you are, using only the information provided in your request. If we can't verify your identity from information we already hold, we may request additional information for verification and fraud-prevention purposes. If submitted through an authorized agent, we may need additional information plus a written and signed permission from you authorizing the agent.

Appeals

If we decline to act on your request, you may appeal by emailing support@meloa.io. We will respond in writing with the reasons for our decision. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" Law

California Civil Code Section 1798.83 lets our California-resident users request, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names/addresses of those third parties in the prior calendar year. To make such a request, contact us using the details in How Can You Contact Us About This Notice?.

Meloa LLC provides productivity, scheduling, and executive functioning tools for general informational and organizational purposes only. Meloa is not a licensed medical device, clinical diagnostic tool, therapy service, or healthcare provider. Features within Meloa — including Subjective Units of Distress Scale (SUDS) trackers, anxiety/focus ratings, decompression timers, or AI-generated schedule estimates — do not constitute medical, psychological, or clinical advice, diagnosis, or treatment. Meloa does not establish a doctor-patient or therapist-client relationship.

Meloa is not monitored by medical personnel. If you are experiencing a mental health emergency or severe psychological distress, immediately contact emergency services (call 911, or call/text 988 for the Suicide & Crisis Lifeline).

Schedule breakdowns, buffer calculations, and transition estimates are generated algorithmically using third-party artificial intelligence. Users are solely responsible for verifying their schedules and managing personal time commitments. Meloa LLC is not liable for missed appointments, late arrivals, or indirect/consequential damages resulting from app use or downtime.

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this notice. If we make material changes, we may notify you by prominently posting a notice or sending you a direct notification. We encourage you to review this notice frequently.

If you have questions or comments about this notice, or you want to exercise any of the rights described above, email us at support@meloa.io. We answer every request sent there, and it is the fastest route for any of them.

To report a security vulnerability, email security@meloa.io (see also our security.txt).

Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we've processed it, correction of inaccuracies, or deletion of your personal information. You may also have the right to withdraw your consent to our processing of it. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, visit meloa.io, use the "Download your data" and "Delete Account" controls in your profile settings, or submit a request directly through our data subject request portal.

In Short: The extension reads page text on your device to decide what looks distressing, and sends nothing anywhere. The only text that ever leaves your computer is a passage you explicitly choose to discuss with Talu, and it goes to your own Meloa account.

We publish an optional browser extension ("Meloa — Talu reads it with you"). It is not required to use Meloa, it is installed separately from the Chrome Web Store, and removing it removes everything described in this section.

What it reads, and where that reading happens

On a fixed list of major news websites, and on any additional site you have specifically turned it on for, the extension reads the visible text of the page — headlines, paragraphs and captions — together with the descriptions attached to images. In Gmail, it reads the subject and preview line of the messages in your list, and the subject and body of a message you have opened. On meloa.io it reads nothing from the page at all.

Sites are added one at a time, by you. Beyond the built-in news list, the extension has no access to a website until you open it, click the Meloa toolbar icon, and choose "Soften this site". You can withdraw that access at any time from the same button, or from your browser's extensions settings, which also shows you the full list of what you have granted.

Nothing in your inbox is hidden, moved or marked. Where a message looks distressing, its subject and body are blurred in place until you choose to reveal them, and a note above it says what KIND of difficult it appears to be — health, money, housing, work, or news about someone — worked out on your device from which words matched. That is a category, never a summary: producing a summary would mean sending the message somewhere, which is precisely what this extension does not do. Nothing is deleted, archived, or marked read or unread, and every blurred thing is one click from being read.

Images are judged by their words, not their content. Nothing on your device can examine a photograph itself, and sending images somewhere to be examined is exactly what this extension does not do. An image is softened based on its own alt-text description and the text surrounding it. The image data is never read, copied, or transmitted.

All of that reading is analyzed entirely on your own device, by a fixed word list that ships inside the extension. There is no server call in that path. We do not receive the text, we do not receive the result, and we do not receive the fact that the extension examined anything. Nothing is logged, stored, or transmitted — the text is scored and discarded as you browse. Where your browser provides its own built-in on-device language model, the extension may use it for a second opinion on borderline cases; that model also runs locally and sends nothing to us or to anyone else.

The one thing that is transmitted, and only if you ask

If — and only if — you choose "Go through it together" on an email, or select text and choose "Go through this with Talu", that specific passage is handed to your own signed-in Meloa account so Talu can discuss it with you. It is capped at 8,000 characters. It travels to Meloa the same way anything else you type into Talu does, and from there it is processed as described in Do We Offer Artificial Intelligence-Based Products? — including that AI-assisted features require your separate opt-in consent, which is off by default. If you have not turned that on, the passage is not processed by any AI provider.

The passage is never placed in a web address, and it is never sent to us in the background. It is held on your device only for the moment it takes to move it into the Meloa tab, and is deleted as soon as it has been read.

What the extension stores

• Your settings — the master on/off switch, which surfaces to soften (headlines, body text, images, email), and how sensitive to be — kept in your browser's own extension storage.
• A single yes/no answer to "can this account go through something together", so the extension can tell you what a button will do before you press it rather than after. This contains no billing details and no personal information.

Both stay in your browser. Neither is transmitted to us, and clearing your browser data or uninstalling the extension removes both.

What the extension does not do

• It does not collect, transmit, or sell browsing history.
• It does not send us the contents of any page, email, or message.
• It does not track you across sites, and contains no analytics or advertising code.
• It does not download or run code from anywhere; everything it does ships in the package.
• It does not read email in the background — only a message you have opened yourself.

Consistent with the Chrome Web Store User Data Policy, including the Limited Use requirements: data handled by the extension is used solely to provide the user-facing features described here, is not sold, is not used for advertising or credit-assessment purposes, and is not transferred to anyone except as necessary to deliver a walkthrough you explicitly requested to your own account.