Is Meloa safe?

Is it safe to connect Google Calendar to Meloa?

Meloa asks for two narrow Google permissions and no others: permission to read and write calendar events, and permission to list your calendars so you can choose which one to use. It deliberately does not request the broad calendar scope, so it cannot change your calendar's settings, its sharing permissions, or who has access to it. Connecting is optional — the app works fully without it — and you can disconnect at any time, which revokes the token with Google.

Scopes are declared in lib/googleCalendar.ts and must match the approved Google OAuth verification.

Where are my Google credentials stored, and are they encrypted?

The access and refresh tokens are encrypted with AES-256-GCM before they are written to the database, using a key held outside it. That is deliberately stronger than relying on database permissions alone: if a database backup, an admin console session, or a service key were ever exposed, the tokens in it would not be usable Google credentials.

lib/tokenCrypto.ts.

Can I add two-factor authentication to my Meloa account?

Yes. You can turn on two-step verification with any authenticator app (TOTP) from Settings → Account, and save a one-time recovery code in case you lose the device. Passwords themselves must be at least 12 characters, and Meloa checks them against known data-breach lists so a password that has already leaked somewhere can't be used here.

components/MfaSettings.tsx and lib/mfaRecovery.ts; MIN_PASSWORD_LENGTH in lib/auth/password.ts (locked in by tests/password.test.ts); the breach check is Supabase Auth's leaked-password protection, surfaced in components/AccountSettings.tsx.

Can my therapist see my Meloa data?

No. There is no clinician login, no dashboard, and no notification of any kind sent to a therapist. Meloa has no way to contact your therapist about you. The only way a therapist sees anything is if you generate a PDF yourself, choose which sections go into it, and hand it to them.

Can other Meloa users see my data?

No. Every table is row-level isolated per account, enforced by the database rather than by application code, so one account cannot read another's calendar or health data. That includes people on a shared billing plan: Meloa's group plan is a billing bundle only — five separate private accounts, with no shared visibility of any kind.

Do you sell my data, or use it to train AI models?

No to both. Meloa does not sell personal data and does not use your content to train AI models. AI-assisted features are switched off until you separately opt in, which is a distinct choice from paying for any plan.

What happens to my data if I delete my account?

Deleting your account deletes your data, including your calendar entries, your check-ins, and any connected-calendar tokens. You can also export everything you have logged before you go.

Is Meloa HIPAA compliant, and is it a medical device?

Meloa is a self-monitoring app you use yourself. It is not a medical device, it is not treatment, and it does not diagnose anything. It is not a HIPAA-covered entity, because it is not a healthcare provider and does not bill insurance — your data belongs to you rather than sitting in a clinical record. Exports are formatted to be handled as protected health information once they reach a clinician, which is where those obligations begin.

Does Meloa monitor me or alert anyone in a crisis?

No. Meloa does not watch your scores in real time and will never contact anyone on your behalf, including emergency services or your therapist. In a crisis the app directs you to call or text 988 in the US, or 911 for emergencies.