Privacy Policy

At Maexry, we believe that your emails are your business, not ours. Only you hold the keys that can decrypt your data — Maexry never does. Anything that rests on or passes through our servers is ciphertext we have no key to open; unlocking it would take your device key or your password — neither of which we ever hold — and is computationally infeasible without them. This is the foundation of our "Sovereign Privacy" commitment.

1. Geographic Availability

Maexry is currently available to users in the following regions ("Supported Regions"):

• United States (excluding the State of California)
• Australia

Maexry does not offer its services outside of Supported Regions. If you are not located in a Supported Region, please do not create an account or use the service. Accounts identified as being outside Supported Regions may be terminated.

California is excluded because Maexry has determined that it does not meet California Consumer Privacy Act (CCPA) requirements at this time. Other jurisdictions — including the European Union, European Economic Area, and the United Kingdom — are excluded because Maexry has not implemented General Data Protection Regulation (GDPR) compliance. We may expand the list of Supported Regions as compliance is achieved.

2. Zero-Knowledge Architecture

Maexry is a "Headless Sovereign" application. This means:

• Local Processing: Your emails are fetched directly from your provider (e.g., Google) to your device. They are never transmitted to Maexry's servers. When you use AI features, your device communicates directly with your chosen AI provider — see Sections 4 and 5 for details.
• Local Encryption: All data stored on your device is encrypted using SQLCipher (AES-256).
• Hardware Keys: The keys to decrypt your data are generated and stored in your device's Apple Secure Enclave (macOS). Maexry does not have access to these keys.

We call this zero-knowledge because we hold no key that can decrypt your data — not a promise that nothing of yours ever rests on our servers. Encrypted derived data, a transfer relay, and (if you enable Cloud Recovery) your recovery backup can live on our servers as ciphertext we can't open.

3. Bring Your Own AI (BYOK) Privacy

Maexry does not route your emails through a centralized AI proxy.

• When you use AI features (Summarization, Drafting, Categorization), Maexry communicates directly from your device to the AI provider (OpenAI, Anthropic, or Google Gemini) using your personal API key.
• Your data stays between you and your chosen AI provider. Maexry never sees the content of these requests.

4. How Your Data Flows

Maexry is designed so that your email content stays under your control at every stage. Here is precisely what happens at each point in the system:

What Maexry servers never receive:

• Plaintext email content, subjects, or sender information
• Your AI provider API keys
• Your encryption keys or Apple Secure Enclave secrets (macOS)
• Plaintext classification results, summaries, action items, or extracted entities (contacts, dates, amounts) (when cross-device sync is enabled, these are included in encrypted Dark Blobs — see below — but never in plaintext)
• Gmail OAuth tokens (stored only on your device)

What stays on your device:

• All email content fetched from Gmail via the Gmail API (your device connects to Google directly)
• Your local encrypted database (SQLCipher, AES-256)
• Your encryption keys (Apple Secure Enclave on macOS)

How AI features work:

When you use AI features (classification, summarization, drafting, triage), your device sends email content directly to your chosen AI provider (e.g., OpenAI, Anthropic, or Google Gemini) via API calls. The AI provider processes the content and returns results to your device. Maexry's servers are never involved in this process.

What you send to your AI provider, and how that provider handles it, is governed by your relationship with that provider and their privacy policy.

What Maexry servers receive when you enable cross-device sync (optional):

Encrypted data packages called "Dark Blobs." Cross-device sync is an opt-in Pro feature; when you enable it, these contain encrypted derivatives of your email intelligence — classification results, summaries, preferences, and extracted entities (contacts, dates, amounts) — so that your other devices do not need to re-process your entire mailbox. On the free tier, or with sync off, even this derived data stays on your device.

Dark Blobs are sealed on your device before transmission using keys stored in your Apple Secure Enclave (macOS) — keys we never hold. Maexry servers store this ciphertext; without your device key or password, its contents are computationally infeasible to decrypt — including by us. In technical terms: we possess ciphertext, not plaintext.

If you enable Cloud Recovery, we also store a backup of your encryption seed, sealed with a password only you know. It can be restored only with that password — which we never hold — and is hardened with Argon2id, so an offline attack is computationally infeasible.

What Maexry servers always receive:

• Your user ID and subscription entitlement status — specifically, your Base licence status (whether purchased, and through which channel) and your Pro subscription status (tier, billing period, and expiry date), stored as separate records tied to your Firebase UID. This data is used solely to determine which features you can access and is not shared with third parties beyond the payment processors described in Section 7
• Your Google account email address, name, and profile picture (received via Google's OpenID Connect / userinfo scopes when you sign in with Google) — used to identify your account, display your identity in the app, and associate your data with the correct user
• Account creation and last sign-in timestamps, and authentication provider identifier (stored by Firebase Authentication as part of the sign-in process)
• Device identifiers and IP addresses associated with your authenticated requests, used for security, abuse prevention, and routing
• Your eligibility attestation record, collected when you create your account: age confirmation, country, state or province, IP address, attestation timestamp, and the versions of the Terms of Use and Privacy Policy you accepted. We collect this data to verify your eligibility under our geographic and age requirements (see Terms of Use, Section 1), to comply with applicable age verification laws, and to prevent fraud. Your IP address is persistently stored as part of this attestation record, not merely observed in transit.
• Basic account metadata necessary to authenticate your devices
• A trial-eligibility marker used to prevent repeat free-trial abuse ("trial farming"). When you start a free trial, we create a pseudonymized, keyed marker derived from the sign-in identity assigned by your sign-in provider (for example, your Google or Apple sign-in) — a cryptographic hash (HMAC-SHA256) computed inside Google Cloud's Key Management Service (KMS) from the provider subject identifier (provider:sub) tied to your account. We store only the resulting irreversible hash, your sign-in provider's name, the hashing-key version, and timestamps. We never store your raw sign-in identifier, email address, name, or payment data in this marker. The marker is non-reversible and re-linkable only with a secret key held under our control (in KMS); it is used solely to enforce the one-free-trial limit — never for profiling, advertising, or identifying you beyond that limit. This marker is deliberately retained after account deletion (see Sections 10 and 11) so that deleting and recreating an account cannot reset your free trial.

For each mailbox you connect — including the first mailbox you connect when you set up Maexry — we create the same kind of pseudonymized, keyed marker for that mailbox, so a mailbox that has already used a free trial can't be moved to a new account to start another. It is a cryptographic hash (HMAC-SHA256) computed inside Google Cloud KMS from the mailbox's Google sign-in identity (mail:provider:sub). We store only the resulting irreversible hash, the provider's name (Google), the hashing-key version, timestamps, and a keyed hash of the account that used the trial — never the mailbox address, your raw sign-in identifier, email content, or payment data. Like the account-level marker, it is non-reversible without a secret key under our control, is used solely to enforce the one-free-trial-per-mailbox limit, and is retained on the same basis (see Sections 10 and 11).

• An admin-access audit record, created only when authorized Maexry staff look up your account for support, security, or abuse investigation. Each record holds the staff member's Maexry admin email, the action taken, a pseudonymized reference to your account (a keyed one-way hash, HMAC-SHA256, of your account email — re-identifiable only with a secret key we hold separately, never plaintext), a timestamp, and a scheduled deletion date. It is generated by us, not collected from you, and it records access to account and subscription metadata only — never your email content, encryption keys, or Dark Blobs. See Sections 10 and 11 for retention.

Telemetry (optional, off by default):

If you opt in, telemetry includes: app version, operating system version, device model, de-identified session identifiers, crash stack traces, performance metrics (e.g., feature load times), and feature usage events. It contains no email content, subjects, sender information, message identifiers, or AI provider keys. You can disable telemetry at any time in Settings.

5. Google API Services Limited Use Disclosure

Maexry's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

"Google user data" in this section includes both Gmail content accessed via the gmail.modify scope and basic user identification information accessed via OpenID Connect and the userinfo scopes (your email address, name, and profile picture). All of the following commitments apply to all Google user data Maexry receives.

Specifically:

• Purpose limitation. We use Google user data only to provide user-facing features that are prominent in Maexry's interface — specifically, email classification, summarization, drafting, label application, and email organization. Email classification, summarization, and drafting are performed by your chosen AI provider via direct API calls from your device. We do not use Google user data for any other purpose. We do not use your email content to train models, generate analytics, or for any purpose other than delivering the features described in this policy.
• No third-party transfer. We do not transfer Google user data to third parties except (a) as necessary to provide the user-facing features described above, (b) as required to comply with applicable law, or (c) as part of a merger, acquisition, or asset sale, in which case we will provide affected users with prior notice.
• No advertising use. We do not use Google user data to serve advertisements, including retargeting, personalized advertising, or interest-based advertising.
• No human access to content. We do not allow humans to read Google user data unless: (a) the user has given explicit, affirmative consent for access to specific messages; (b) it is necessary for security purposes or to investigate abuse; (c) it is required by applicable law; or (d) the data has been aggregated and de-identified such that it can no longer be associated with an individual user, and is used solely for internal operations.
• Adherence to Limited Use requirements. Our use of Google user data is limited to the practices explicitly disclosed in this policy. We do not retain Google user data beyond what is necessary to provide the features described above.

6. OAuth Scopes and Feature Mapping

Maexry requests the following Google OAuth scopes:

Why these scopes:

The first three scopes (openid, userinfo.email, userinfo.profile) are the standard "Sign in with Google" combination. They authenticate you to Maexry, identify which Gmail account is connected, and display your name and avatar in the app interface. Without these, Maexry cannot know which user's Gmail to access.

gmail.modify is the narrowest scope that supports both reading email content and applying organizational changes (labels, archive, drafting). gmail.readonly would allow Maexry to read your emails, but would not allow it to apply labels or move emails — the core actions that make classification useful. There is no combination of narrower scopes (e.g., gmail.readonly + gmail.labels) that covers both reading email content and applying organizational changes. gmail.modify is the single narrowest scope that supports read + label + move operations without granting destructive or administrative capabilities.

We do not request gmail.compose because Maexry uses the Gmail API directly for draft operations rather than launching Gmail's compose UI, and gmail.modify covers the necessary draft API operations.

Scopes we do not request:

• We do not request gmail.settings.basic or gmail.settings.sharing (no access to your Gmail settings).
• We do not request mail.google.com (full mailbox access including permanent deletion and send-as).
• We do not request any scope that permits permanently deleting messages or modifying your account settings.

7. Third-Party Services

The services below support our website and customer support — not your mailbox. Your email content, AI provider keys, and encryption keys never reach any of them, and the zero-knowledge architecture described in Sections 2–4 is unchanged. They process only the operational data you choose to send us, such as a support request.

• Google/Gmail: Maexry uses the Gmail API to access your email. See Sections 5 and 6 for our Limited Use disclosure and scope details.

• AI Providers: Your use of OpenAI, Anthropic, or Google Gemini is subject to their respective privacy policies. Maexry facilitates the connection between your device and your chosen AI provider but does not intermediate, store, or inspect the data exchanged.

• RevenueCat + Stripe (subscription checkout and payment processing): When you subscribe to a paid Maexry plan or purchase Base, your purchase runs through RevenueCat's checkout, which collects your payment details and submits them to Stripe, Inc. for processing on Maexry's Stripe account. You enter your payment information into the secure forms operated by RevenueCat and Stripe — Maexry's own servers never receive or store your payment card numbers, CVV codes, or full bank account details. Maexry remains the merchant of record. RevenueCat's role is detailed in the next bullet; Stripe's handling of payment data is detailed in the paragraph that follows.

  Stripe receives the following information to process your transactions: your name, email address, billing address (if collected), transaction amount, transaction date, IP address, and basic device information for fraud detection. Stripe acts as a processor for the transactions you initiate with Maexry, and as an independent controller for purposes that Stripe determines, including fraud prevention, regulatory compliance, and Stripe's own service improvement. Stripe's processing is governed by the Stripe Privacy Policy and the Stripe Services Agreement.

  Stripe is a US company and processes payment data primarily in the United States. Maexry receives from Stripe only the information needed to manage your subscription (subscription status, plan tier, billing cycle, last-four-digits of payment method for display purposes) — not your full payment details.

• Firebase (authentication and database services): Maexry uses Firebase Authentication to manage user sign-in via Google, and Firebase Firestore to store account metadata including eligibility attestation records. Firebase is a Google Cloud Platform service hosted in the United States. Firebase Authentication processes your email address, name, profile picture, and sign-in metadata. Firebase Firestore stores your eligibility attestation record (age confirmation, country, state, IP address, timestamps, Terms of Use and Privacy Policy versions). Firebase Firestore also stores pseudonymized trial-eligibility markers (account-level and per-mailbox — derived, keyed markers containing no email content or payment data). Firebase does not have access to plaintext email content — it stores only account metadata and, if cross-device sync is enabled, encrypted Dark Blobs.

• RevenueCat (subscription checkout, management, and billing emails): Maexry uses RevenueCat to operate subscription checkout, manage subscription entitlements and in-app purchases, and send transactional billing emails (purchase receipts and renewal reminders) on Maexry's behalf. RevenueCat identifies your account by your Firebase user ID, not your email address. It also receives your email address — solely to send billing receipts — along with your subscription status, purchase history, and basic device metadata. RevenueCat acts as a processor (sub-processor): it processes this data only to provide subscription checkout and management for Maexry. It does not receive your email content, AI provider keys, or encryption keys. RevenueCat is a US company and processes data in the United States, governed by the RevenueCat Privacy Policy.

• Google Cloud Platform (GCP): Maexry's backend infrastructure, including Firebase, is hosted on GCP in the United States (us-west1, Oregon). GCP processes encrypted Dark Blobs and account metadata; it does not have access to plaintext email content.

• Supabase (support-case storage): Managed cloud database operated by Supabase, Inc. and hosted on Amazon Web Services. It stores the support requests you submit through our website chat — the name and email you provide, the contents of your support conversation, a one-way hashed IP address, and your browser user-agent. Supabase does not receive your email content, AI provider keys, or encryption keys. US company; hosted in the United States (us-east-2, on AWS).

• Resend (transactional email for support): Resend, Inc. sends you a confirmation email when you submit a support request. It receives your email address and the text of your support message, which it includes in that confirmation. It does not receive your mailbox email content, AI provider keys, or encryption keys. United States.

• Slack (internal support-desk routing): Support requests you submit are routed to Maexry's internal Slack workspace (Slack Technologies / Salesforce, Inc.) so our team can respond. Receives the support-chat transcript and the name/email you provide. United States.

• Cloudflare (CDN, edge delivery, and DDoS protection): Cloudflare, Inc. is the content-delivery and edge network in front of our website; it terminates TLS and protects against attacks. As the network layer carrying your traffic, it processes your IP address, request metadata, and browser user-agent. It does not store your account data or email content. Globally distributed edge network (Cloudflare, Inc., United States).

For reference, the following table summarizes the sub-processors described above:

8. Security Measures

We implement the following technical safeguards to protect your data:

• Encryption in transit: All communications between your device and Maexry's servers use TLS 1.3 where supported, TLS 1.2 minimum. All communications between your device and your AI provider use TLS.
• Encryption at rest (on your device): Your local database is encrypted using SQLCipher with AES-256 encryption.
• Hardware-backed key storage (macOS): Encryption keys are generated and stored in the Apple Secure Enclave. These keys never leave the secure hardware and cannot be exported or accessed by Maexry.
• Encrypted sync (optional): When cross-device sync is enabled, data is encrypted on your device before transmission. Our servers store only ciphertext they cannot decrypt.
• No plaintext email storage on our servers: Maexry's backend infrastructure never receives, processes, or stores plaintext email content.
• No third-party crash reporting or analytics: Maexry does not use third-party services such as Sentry, Crashlytics, Firebase Analytics, Mixpanel, or similar tools. When telemetry is enabled (off by default), crash reports and performance metrics are sent only to Maexry's own infrastructure and are not shared with third parties for their own independent purposes. Separately, operational data you submit through our website — such as a support request — is stored and processed using the third-party sub-processors listed in Section 7 (Supabase, Resend, Slack, and Cloudflare). Each processes that data on Maexry's behalf, except where a provider acts as an independent controller for its own security, fraud-prevention, or legal-compliance purposes (for example, Cloudflare's network-security processing).
• Location-independent access controls: All Maexry personnel access to production systems requires encrypted devices, multi-factor authentication, and adherence to documented access policies, regardless of personnel location. These controls apply uniformly whether personnel are working from the United States or any other country.

9. International Data Transfers

Maexry's backend infrastructure is hosted on Google Cloud Platform (GCP) in the United States (us-west1, Oregon). If you are located in Australia, any personal data we process (user ID, subscription status, account email address, encrypted Dark Blobs) is transferred to and stored in the United States. This includes payment-related information processed by Stripe and subscription/checkout data processed by RevenueCat, both of which operate primarily in the United States.

Maexry's personnel may be located in various countries, including Vietnam, while accessing infrastructure for legitimate business purposes such as development, maintenance, and support. Personnel access does not change where your data is stored (United States) or how it is protected. All personnel are subject to the same security controls described in Section 8, including encrypted devices, multi-factor authentication, and documented access policies, regardless of their physical location.

We maintain the following safeguards for cross-border transfers:

• All data is encrypted in transit using TLS 1.3 where supported, TLS 1.2 minimum.
• Encrypted Dark Blobs are encrypted on your device before any cross-border transfer, using keys stored in your Apple Secure Enclave (macOS). Our servers store only ciphertext they cannot decrypt.
• Personnel access to production systems is subject to location-independent security controls (see Section 8).
• We take reasonable steps to ensure that personal information transferred overseas is handled in accordance with the Australian Privacy Principles.

10. Your Rights

You have the following rights with respect to any personal data we hold:

• Access. You may request a copy of the personal data we hold about you. Note that encrypted Dark Blobs, by design, can only be decrypted by your devices — we can provide the ciphertext on request, but cannot decrypt it for you.
• Correction. You may request that we correct inaccurate personal data.
• Deletion. You may request that we delete your personal data, including your account, subscription records, and any encrypted Dark Blobs stored on our servers. You may delete your account from Settings within the app, or by contacting us at [email protected]. Deleting the app and your local database permanently removes all data from your device — we have no copy of this data. Attestation records (eligibility confirmation, country, state, IP address, timestamps) are retained for up to 3 years after account closure for legal compliance purposes (age and geographic eligibility verification), then permanently deleted. These records are excluded from immediate deletion requests due to legal compliance requirements. For anti-abuse reasons, your trial-eligibility markers — account-level and per-mailbox (Section 4) — are retained for up to 3 years from when each free trial began (not reset by account deletion) and are excluded from deletion requests. They are pseudonymized, keyed markers, re-linkable only with a secret key held under our control, and are used solely to enforce the one-free-trial limit — not to identify you for any other purpose. Admin-access audit records (Section 11) — the log of when authorized staff looked up an account for support, security, or abuse investigation — are likewise retained for 12 months from when each record is written and are excluded from deletion requests, because they are security records. In each record the reference to the account is a pseudonymized, keyed one-way hash, re-identifiable only with a secret key we hold; deleting the record of an access would defeat its accountability purpose.
• Portability. You may request your personal data in a structured, machine-readable format.
• Opt-out of telemetry. If you have opted in to telemetry, you may opt out at any time in Settings.
• Appeal. If we deny your privacy request, you may appeal the decision within 60 days by emailing [email protected] with the subject line "Privacy Rights Appeal." We will respond to appeals within 60 days.

Global Privacy Control. Maexry's website does not engage in the sale or sharing of personal data. Global Privacy Control (GPC) signals are acknowledged; as there is no sale or sharing activity to opt out of, the signal is satisfied by default.

How to exercise your rights:

Contact us at [email protected]. We will respond within 30 days. No fees are charged for reasonable requests.

For Australian users:

Maexry handles personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Under Australian Privacy Principle 8, Maexry's accountability extends to the handling of your personal information by all of Maexry's overseas service providers and operational personnel, including our hosting infrastructure (Google Cloud Platform, United States) and personnel who may access systems from locations outside Australia (see Section 9). Maexry takes reasonable steps to ensure that overseas recipients of personal information handle it in accordance with the APPs. If you believe we have breached the APPs or have a complaint about our handling of your personal information, you may contact us at [email protected]. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

For US users:

If you believe your privacy rights have been violated, you may file a complaint with the Attorney General of your state of residence.

Children and minimum age:

Maexry is not directed at children under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that data promptly. If you believe a child under 18 has provided us with personal data, please contact us at [email protected].

11. Data Retention

• Attestation records (eligibility confirmation, country, state, IP address, attestation timestamp, Terms of Use and Privacy Policy versions): Retained for the duration of your active account plus 3 years after account closure for legal compliance purposes (age and geographic eligibility verification), then permanently deleted.
• Trial-eligibility markers (account-level and per-mailbox): Retained for up to 3 years from when the free trial begins (the moment the marker is created), then automatically and permanently deleted. This clock starts at trial-start and is not reset by account deletion — the marker is deliberately retained after account closure to enforce the one-free-trial limit (anti-abuse). Each is a pseudonymized, keyed marker (an HMAC-SHA256 hash computed inside Google Cloud KMS) containing no raw sign-in identifier, email address, mailbox address, email content, or payment data. This is one of a few narrow, purpose-limited exceptions to our deletion practices — alongside attestation records (active account plus 3 years after closure), subscription/licence records (90 days after closure), and admin-access audit records (12 months after each record is written).
• Admin-access audit records (admin_audit_log) — the acting staff member's Maexry admin email, the action taken, a pseudonymized reference to the account looked up, the timestamp, and a scheduled deletion date: Written only when authorized Maexry staff look up an account for support, security, or abuse investigation. Retained for 12 months from the moment each record is written, then automatically and permanently deleted (enforced by an automatic time-to-live rule). The reference to the looked-up account is pseudonymized — a keyed one-way hash (HMAC-SHA256) of the account email, re-identifiable only with a secret key we hold separately, and never stored in plaintext. The only plaintext identifier in the record is the staff member's own admin email, kept for accountability. Our lawful basis is our legitimate interest in the security and accountability of the service. This admin access reaches account and subscription metadata only — never your email content, your encryption keys, or your encrypted Dark Blobs. Like our other narrow, purpose-limited records, these audit records are excluded from account-deletion and erasure requests: deleting the record of who accessed an account would defeat its purpose as a security record.
• Subscription and licence records (user ID, Base licence status, Pro subscription tier, expiry, purchase source): Retained for the duration of your active account plus 90 days after account closure, after which they are permanently deleted. Billing records may be retained longer if required by tax or financial reporting law.
• Encrypted Dark Blobs (cross-device sync data): Deleted from primary storage within 30 days of account closure. Backups are the one exception, and we will be precise about it. For disaster recovery, residual encrypted copies of your data may remain in our backup systems for up to roughly 105 days — daily snapshots retained for 98 days, plus a rolling 7-day point-in-time-recovery window. Your email content is held only as end-to-end-encrypted data — we never keep it in readable form. The backups also contain routine account metadata, such as account and subscription state. They exist for a single reason: to recover from a system failure. They are never used to restore data you have deleted. If we ever restore from a backup, we automatically re-apply every account deletion that took effect before the restore point. A restore can never bring a deleted account, or its data, back. These disaster-recovery backups are distinct from the limited records we retain for specific legal and operational reasons — such as attestation and subscription history — which are disclosed separately in this policy. Since we cannot decrypt these blobs, deletion means permanent removal of ciphertext from our infrastructure.
• Cloud Recovery seed backup (if enabled): retained until you delete your account, then permanently removed.
• Telemetry data (if opted in): Aggregated or de-identified data is retained for up to 12 months for product improvement purposes. Raw telemetry events are deleted within 90 days of collection.
• Payment records (held by Stripe): Stripe retains transaction records for the period required by applicable financial, tax, and anti-money-laundering regulations, typically seven years or longer. Maexry has no control over Stripe's retention of payment data. See Stripe's Privacy Policy for Stripe's specific retention practices.
• Local data (on your device): Entirely under your control. Uninstalling Maexry or deleting your local database removes all local data permanently. We have no access to and no copy of this data.

12. Cookies and Tracking

The Maexry website (maexry.ai) sets no cookies and loads no third-party trackers. We use no advertising networks, no social media trackers, no analytics scripts, and no tracking pixels or fingerprinting of any kind. We do not collect website analytics — not in your browser and not on our servers. The only third party involved in delivering the site is our content-delivery network, Cloudflare, which routes and protects web traffic (see Section 7); it is not an analytics or tracking service.

13. Breach Notification

In the event of a security breach affecting personal data, we will:

• Notify affected users promptly, and no later than required by applicable law, via email or in-app notification.
• Notify the relevant authorities as required by applicable law, including the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme for Australian users, and relevant state authorities under applicable US state breach notification laws.
• Provide a clear description of the nature of the breach, the data affected, and the measures taken to address it.

Given our zero-knowledge architecture, a breach of our servers would expose only encrypted ciphertext (Dark Blobs), the Cloud Recovery seed backup (password-wrapped, if enabled), account metadata (user IDs, subscription and licence status, account email addresses, device identifiers, IP addresses), attestation records (country, state, IP address, age confirmation, attestation timestamps, Terms of Use and Privacy Policy versions), trial-eligibility markers (account-level and per-mailbox — pseudonymized, keyed HMAC-SHA256 markers, re-linkable only with a secret key under our control, containing no raw sign-in identifier, email address, mailbox address, email content, or payment data), and admin-access audit records (each holding an authorized staff member's Maexry admin email in plaintext, plus a pseudonymized, keyed HMAC-SHA256 reference to the account looked up that is re-identifiable only with a secret key under our control — no end-user email content) — not plaintext email content, subjects, sender information, or AI provider keys.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, features, or legal requirements. We will notify users of material changes via in-app notification at least 30 days before changes take effect, except where a shorter period is required by law or to address a security risk. The "Last Updated" date at the top of this page indicates when the current version was published. We encourage you to review this policy periodically.

15. Contact Us

If you have any questions about our Sovereign Privacy model, please contact us at: [email protected]

Maexry LLC, 3372 Peachtree Road NE, Atlanta, GA 30326, USA