Privacy Policy

This summary provides key points from our Privacy Notice — see the table of contents below for the full detail on any of them.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us, the choices you make, and the products and features you use.

Do we process any sensitive personal information? Yes. Because Meloa is an anxiety-aware calendar and nervous-system tracking tool, we process the consumer health data you choose to log — mood and anxiety ratings, mental health assessment scores (GAD-7, LSAS, PHQ-9), and medication logs — with your consent. We describe this in detail in our Consumer Health Data Privacy Policy. We do not process other special categories such as racial or ethnic origin, sexual orientation, or religious beliefs.

Do we collect any information from third parties? Only when you connect one. If you sign in with Google or Apple, or link your Google Calendar, we receive limited information from that provider (such as your name, email, and — for Calendar — the event details needed to show and buffer your schedule). We do not buy or collect personal information from data brokers or other unaffiliated third parties.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We only process your information when we have a valid legal reason to do so.

How do we keep your information safe? We have reasonable organizational and technical measures in place to protect your personal information, though no method of transmission or storage is 100% secure.

What are your rights? Depending on where you're located, applicable privacy law may give you certain rights over your personal information — see the sections on privacy rights below.

How do you exercise your rights? The easiest way is to visit meloa.io or contact us directly. We will consider and act on any request in accordance with applicable data protection laws.

Personal information you disclose to us

In Short: We collect personal information that you provide to us when you register on the Services, express interest in our products, participate in activities on the Services, or otherwise contact us.

The personal information we collect may include:

• names
• email addresses
• usernames
• passwords
• contact preferences
• contact or authentication data

Sensitive Information — Consumer Health Data. As an anxiety-aware calendar and nervous-system tracking tool, we process consumer health data: mood and anxiety ratings, mental health assessment scores (GAD-7, LSAS, PHQ-9), medication logs, and related entries you choose to log. This is described in detail, separately from this general notice, in our Consumer Health Data Privacy Policy, as required by Washington's My Health My Data Act — including who it's shared with, why, and how to withdraw consent.

Payment Data. We may collect data necessary to process your payment if you make a purchase, such as your payment instrument number and its associated security code. All payment data is handled and stored by Stripe. You may find their privacy notice at https://stripe.com/privacy.

Social Media Login Data. We may let you register using your existing social media account details. If you do, we collect certain profile information from that provider, as described in How Do We Handle Your Social Logins? below.

Application Data. If you use our application(s), we may also collect the following if you grant access or permission:

• Geolocation Information. We may request access to location-based information from your mobile device, continuously or while using the app, to provide location-based services. You can change this in your device's settings at any time.
• Mobile Device Access. We may request access to certain device features, including your calendar, reminders, and storage. You can change this in your device's settings.
• Mobile Device Data. We automatically collect device information (device ID, model, manufacturer), operating system and configuration, application identification numbers, browser type, hardware model, service provider/carrier, and IP address.
• Push Notifications. We may send push notifications about your account or app features. You can turn these off in your device's settings.

This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for internal analytics and reporting.

All personal information you provide to us must be true, complete, and accurate, and you must notify us of any changes.

Information automatically collected

In Short: Some information — such as your IP address and/or browser and device characteristics — is collected automatically when you visit our Services.

This information does not reveal your specific identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use our Services. We also collect information through cookies and similar technologies. The information we collect includes:

• Log and Usage Data — service-related, diagnostic, usage, and performance information our servers automatically collect, including your activity in the Services (date/time stamps, pages/files viewed, searches, features used) and device event information (system activity, error reports, hardware settings).
• Device Data — information about the computer, phone, tablet, or other device you use, including IP address, device/application identification numbers, browser type, hardware model, service provider/carrier, operating system, and system configuration.
• Location Data — precise or imprecise information about your device's location. You can opt out by disabling Location permissions in your device settings, though some features may not work as a result.

Google API

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes only with your consent.

We process your personal information for a variety of reasons, including to:

• Facilitate account creation and authentication and otherwise manage user accounts.
• Deliver and facilitate delivery of services you request.
• Respond to user inquiries and offer support.
• Send administrative information — product changes, changes to terms/policies, and similar information.
• Request feedback and contact you about your use of our Services.
• Protect our Services, including fraud monitoring and prevention.
• Identify usage trends so we can improve our Services.
• Save or protect an individual's vital interest — for example, to prevent harm.

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so — with your consent, to comply with law, to provide services or fulfill a contract, to protect your rights, or to fulfill our legitimate business interests.

If you are located in the EU or UK, this section applies to you.

The GDPR and UK GDPR require us to explain the valid legal bases we rely on:

• Consent — where you've given us permission for a specific purpose. You can withdraw consent at any time.
• Performance of a Contract — where necessary to fulfill our contractual obligations to you.
• Legitimate Interests — where reasonably necessary to achieve our legitimate business interests, such as analyzing how our Services are used to improve them, diagnosing/preventing fraud, and understanding user experience.
• Legal Obligations — to comply with law, cooperate with law enforcement/regulators, or exercise/defend legal rights.
• Vital Interests — to protect your vital interests or those of a third party, such as situations involving potential threats to safety.

If you are located in Canada, this section applies to you.

We may process your information with your express or implied consent, which you can withdraw at any time. In some exceptional cases permitted by law we may process information without consent — for example, for fraud detection and prevention, certain business transactions, identifying injured/ill/deceased persons, or complying with a subpoena, warrant, or court order.

In Short: We may share information in specific situations described in this section and/or with the following categories of third parties.

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third parties who perform services for us or on our behalf. We have contracts in place designed to safeguard your personal information — they cannot use it beyond our instructions, share it with others, or retain it beyond the period we instruct.

The categories of third parties we may share personal information with:

• AI Platforms
• Cloud Computing Services
• Data Analytics Services
• Data Storage Service Providers
• Payment Processors
• Map and Location Services
• Performance Monitoring Tools
• User Account Registration & Authentication Services
• Website Hosting Service Providers

The specific vendors in these categories today:

We may also need to share your personal information in the following situations:

• Business Transfers — in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or part of our business.
• When we use Google Maps Platform APIs — we use certain Google Maps Platform APIs (e.g. Google Maps API, Places API) to retrieve information for location-specific requests, including geographic/location data and search/route data. Google Maps uses GPS, Wi-Fi, and cell towers to estimate your location (GPS is accurate to about 20 meters; Wi-Fi/cell towers help indoors where GPS is weak) — this is not always perfectly precise. We cache your location on your device for one (1) month. You may revoke your consent at any time by contacting us using the details at the end of this document.

In Short: We use a small set of cookies — the essential ones needed to run the app, plus optional product-analytics cookies that stay off unless you turn them on. We do not use advertising or cross-site tracking cookies.

We use cookies and similar technologies (like browser local storage) to keep you signed in, honor your privacy choices, prevent fraud during checkout, fix bugs, and — only if you opt in — measure how features are used so we can improve them. We do not use advertising cookies, cross-site tracking, or third-party marketing pixels, and we never store your health data in a cookie.

Product-analytics cookies are disabled by default and are set only for signed-in users who have turned on analytics sharing and whose browser is not sending a Global Privacy Control signal. To the extent any use of these technologies is deemed a "sale"/"sharing" under applicable US state law, you can opt out as described in Do United States Residents Have Specific Privacy Rights? below.

For the full list of cookies we set, their purposes, and how to control them, see our Cookie Policy.

In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

As part of our Services, we offer AI-powered products and features ("AI Products") designed to enhance your experience.

Use of AI Technologies

We provide our AI Products through a third-party AI Service Provider, Google Cloud AI. Your input, output, and personal information are shared with and processed by this provider to enable your use of our AI Products.

Our AI Products

Our AI Products are designed for:

• AI automation
• Image analysis
• Text analysis

How We Process Your Data Using AI

All personal information processed using our AI Products is handled in line with this Privacy Notice and our agreements with third parties, to safeguard your information throughout the process.

In Short: If you choose to register or log in using a social media account, we may have access to certain information about you.

Where you register using a third-party social media account (like Google or Apple), we receive certain profile information from that provider — often your name, email address, and profile picture, along with other information you've made public on that platform.

We only use this information for the purposes described in this Privacy Notice. We do not control, and are not responsible for, other uses of your information by your social media provider — we recommend reviewing their own privacy notice.

In Short: We may transfer, store, and process your information in countries other than your own.

Our servers are located in the United States. Regardless of your location, your information may be transferred to, stored by, and processed by us and the third parties we share it with (see When And With Whom Do We Share Your Personal Information? above), including facilities in the United States and other countries.

If you are a resident of the EEA, UK, or Switzerland, those countries may not have data protection laws as comprehensive as your own — we take measures to protect your information in accordance with this Privacy Notice and applicable law, including relying on the European Commission's Standard Contractual Clauses for cross-border transfers. Our Standard Contractual Clauses and further safeguard details can be provided upon request.

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice, unless otherwise required by law.

We will only keep your personal information for as long as necessary for the purposes set out in this Privacy Notice, unless a longer period is required by law. No purpose in this notice requires us to keep your personal information longer than the period of time in which you have an account with us.

When we have no ongoing legitimate business need to process your information, we will either delete or anonymize it, or — if that isn't possible (e.g. because it's stored in backup archives) — securely store it and isolate it from further processing until deletion is possible.

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, no electronic transmission or storage technology can be guaranteed 100% secure, so we cannot promise that hackers, cybercriminals, or other unauthorized third parties will never defeat our security. Transmission of personal information to and from our Services is at your own risk — please only access the Services within a secure environment.

In Short: We do not knowingly collect data from or market to children under 13 years of age (or the equivalent age as specified by law in your jurisdiction).

By using the Services, you represent that you are at least 13 (or the equivalent minimum age in your jurisdiction), or that you are the parent/guardian of a minor dependent and consent to their use of the Services. If we learn we've collected personal information from a user under 13, we will deactivate the account and take reasonable measures to promptly delete that data. If you become aware of any such data, contact us at support@meloa.io.

In Short: Depending on your state of residence in the US or region (such as the EEA, UK, Switzerland, and Canada), you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time.

In some regions (the EEA, UK, Switzerland, and Canada) you have certain rights under applicable data protection laws, which may include the right to: (i) request access to and a copy of your personal information; (ii) request rectification or erasure; (iii) restrict processing of your personal information; (iv) data portability, where applicable; and (v) not be subject to automated decision-making. If a decision producing legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. You may also have the right to object to processing in certain circumstances. Contact us using the details in How Can You Contact Us About This Notice? below — we will consider and act on any request in accordance with applicable law.

If you are in the UK and unhappy with how we've handled your information, you can complain directly to us first. This is in addition to your rights under the UK GDPR and the Data Protection Act 2018.

How to contact us:

• Online: https://meloa.io/support
• Email: support@meloa.io
• Post: see How Can You Contact Us About This Notice?

What happens after you complain:

• We will acknowledge your complaint within 30 days of receiving it.
• We will investigate without unjustifiable or excessive delay.
• We will keep you informed of progress and explain the outcome.

If you're not happy with our final response, you can refer your complaint to the UK Information Commissioner's Office (ico.org.uk/make-a-complaint, helpline 0303 123 1113, or by post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF). If you're in the EEA or UK, you also have the right to complain to your Member State data protection authority or the UK data protection authority. If you're in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent: If we are relying on your consent to process your personal information, you have the right to withdraw it at any time by contacting us using the details in How Can You Contact Us About This Notice? below. This won't affect the lawfulness of processing before your withdrawal, nor processing conducted on a lawful basis other than consent.

Account Information

If you'd like to review, change, or terminate your account, you can log in to your account settings and update your account directly. Upon a request to terminate your account, we will deactivate or delete your account and information from our active databases — though we may retain some information in our files to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, and/or comply with legal requirements.

Cookies and similar technologies: Most browsers accept cookies by default — you can usually set your browser to remove or reject them, though this may affect certain features of our Services.

If you have questions or comments about your privacy rights, you may email us at support@meloa.io.

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature you can activate to signal your preference not to have your online browsing activity monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized, so we do not respond to legacy DNT signals specifically.

We do, however, recognize the Global Privacy Control (GPC) signal, as required under California's CCPA/CPRA. If your browser or device sends a GPC opt-out signal, we automatically treat it as a request to limit our use of your sensitive personal information — the same effect as turning on "Limit the Use of My Sensitive Personal Information" yourself in Profile → Privacy & Consent, which also turns off analytics and AI-feature data sharing. You can always confirm or change this from that same page.

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we've processed it, correct inaccuracies, get a copy of, or delete your personal information, and to withdraw your consent to our processing of it. These rights may be limited in some circumstances by applicable law.

Categories of Personal Information We Collect

The table below shows the categories of personal information we've collected in the past twelve (12) months. For a comprehensive inventory, see What Information Do We Collect? above.

We may also collect other personal information outside of these categories through:

• Receiving help through our customer support channels;
• Participation in customer surveys or contests; and
• Facilitation in the delivery of our Services and responding to your inquiries.

We use and retain collected personal information as needed to provide the Services, or for:

• Category A (Identifiers) — as long as you have an account with us
• Category B (California Customer Records) — as long as you have an account with us
• Category D (Commercial information) — as long as you have an account with us
• Category F (Internet activity) — as long as you have an account with us
• Category G (Geolocation data) — as long as you have an account with us
• Category L (Sensitive personal information — consumer health data) — as long as you have an account with us

Sources of Personal Information

See What Information Do We Collect? for the sources of personal information we collect.

How We Use and Share Personal Information

See How Do We Process Your Information?.

Will your information be shared with anyone else? We may disclose your personal information to our service providers under a written contract with each — see When And With Whom Do We Share Your Personal Information?. We may also use your information for our own business purposes, such as internal research for technological development — this is not considered "selling" your personal information.

We have not sold or shared any personal information with third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed the following categories of personal information to third parties for a business purpose in that period: Category A (Identifiers), Category B (California Customer Records), Category D (Commercial information), Category F (Internet activity), and Category G (Geolocation data) — the categories of third parties are listed in When And With Whom Do We Share Your Personal Information? above.

Your Rights

You have rights under certain US state data protection laws, though they are not absolute and we may decline a request as permitted by law. These include the right to know whether we're processing your data, to access it, to correct inaccuracies, to request deletion, to obtain a copy of what you've shared with us, to non-discrimination for exercising your rights, and to opt out of processing used for targeted advertising, the sale of personal data, or certain profiling. Depending on your state, you may also have the right to access the categories of personal data processed, obtain a list of categories (or specific parties) we've disclosed data to, review/correct how your data has been profiled, limit use of sensitive personal data, or opt out of collection via voice/facial recognition — as permitted under the applicable law of your state.

How to Exercise Your Rights

You can exercise these rights by visiting meloa.io, emailing us at support@meloa.io, or using the contact details at the bottom of this document. Under certain state laws, you can designate an authorized agent to make a request on your behalf — we may deny a request from an agent who doesn't submit proof of valid authorization.

Request Verification

Upon receiving your request, we will verify your identity to confirm you are who our records say you are, using only the information provided in your request. If we can't verify your identity from information we already hold, we may request additional information for verification and fraud-prevention purposes. If submitted through an authorized agent, we may need additional information plus a written and signed permission from you authorizing the agent.

Appeals

If we decline to act on your request, you may appeal by emailing support@meloa.io. We will respond in writing with the reasons for our decision. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" Law

California Civil Code Section 1798.83 lets our California-resident users request, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names/addresses of those third parties in the prior calendar year. To make such a request, contact us using the details in How Can You Contact Us About This Notice?.

Meloa LLC provides productivity, scheduling, and executive functioning tools for general informational and organizational purposes only. Meloa is not a licensed medical device, clinical diagnostic tool, therapy service, or healthcare provider. Features within Meloa — including Subjective Units of Distress Scale (SUDS) trackers, anxiety/focus ratings, decompression timers, or AI-generated schedule estimates — do not constitute medical, psychological, or clinical advice, diagnosis, or treatment. Meloa does not establish a doctor-patient or therapist-client relationship.

Meloa is not monitored by medical personnel. If you are experiencing a mental health emergency or severe psychological distress, immediately contact emergency services (call 911, or call/text 988 for the Suicide & Crisis Lifeline).

Schedule breakdowns, buffer calculations, and transition estimates are generated algorithmically using third-party artificial intelligence. Users are solely responsible for verifying their schedules and managing personal time commitments. Meloa LLC is not liable for missed appointments, late arrivals, or indirect/consequential damages resulting from app use or downtime.

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this notice. If we make material changes, we may notify you by prominently posting a notice or sending you a direct notification. We encourage you to review this notice frequently.

If you have questions or comments about this notice, you may email us at support@meloa.io or contact us by post at:

Meloa LLC
805 Neighborhood Rd
Lake Katrine, NY 12449
United States

To report a security vulnerability, email security@meloa.io (see also our security.txt).

Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we've processed it, correction of inaccuracies, or deletion of your personal information. You may also have the right to withdraw your consent to our processing of it. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, visit meloa.io, use the "Download your data" and "Delete Account" controls in your profile settings, or submit a request directly through our data subject request portal.