Last updated: July 7, 2026

Privacy Policy

Maddy is a personal support app. Jeremy built it for his daughter first; now it helps other families too. It helps someone who needs a little extra scaffolding to get through their day, and it helps the people who love them stay connected and supportive. This policy explains what information the app collects, where it lives, who can see it, and how to get rid of it.

Plain language, no legalese. If something is unclear, email support@mymaddy.app.

What we collect

When you use Maddy, the app stores the following information:

• Account information. Your email address is used to create your Supabase Auth account. That is the only credential we store. Passwords are hashed by Supabase, so we never see them.
• Profile information. Your display name, chosen emoji, selected theme, and app preferences (sound on or off, notification time) are stored on your profile. If you're setting up a supported person's profile, that includes their name, emoji, pronouns, nickname, and companion personality details (interests, tone preferences).
• Daily check-ins. When the supported person checks in each day, their reported state, one of five options (tired, okay, restless, ready, or shutdown), is recorded along with the date. This is the core signal the app uses to adapt what the day looks like.
• Task and completion data. Tasks have names, schedules, values (in dollars), and optional settings like approval requirements or photo proof. Every time a task is completed, that completion is recorded. Partial completions, pending approvals, and redo requests are stored too.
• Photo proof. If a task requires photo evidence of completion, that image is uploaded to a private Supabase Storage bucket called task-proofs. The bucket is private: files are never reachable by a public link. The app loads them only through short-lived signed URLs (about one hour) that only circle members can generate.
• Voice notes. Caregivers can leave voice messages for the supported person. Those audio files are uploaded to a private Supabase Storage bucket called caregiver-replies. Same access: circle members only, served through the same short-lived signed URLs.
• Voice feedback. After a task, the supported person can leave a short voice memo about how it went. That audio is uploaded to a private Supabase Storage bucket called task-feedback. It is inner-circle only, meaning the supported person and their caregiver, and it is never visible to the wider circle.
• Felt feedback. Alongside the voice memo, the supported person can mark how a task felt, a positive note or a friction reason, with an optional written note. This is inner-circle only too.
• Circle warmth and shared wins. Encouragement notes from the wider circle, and milestones the supported person chooses to share, are stored so the people who love them can cheer them on.
• Earnings and payout records. When a task is completed, the dollar amount earned is recorded. When a caregiver marks a weekly payout as sent, that record is stored with the amount, date, and a note.
• Mood log. A legacy mood log still exists and is read by the companion feature. It follows the same circle-scoped access as everything else.
• Push notification token. If you enable notifications, your device's APNs push token is stored on your profile so reminders can reach you.

What we do not collect

• Biometric data. Face ID and Touch ID are handled entirely by your device's secure hardware. Maddy never receives, transmits, or stores a fingerprint, face scan, or any biometric template. The app asks your device "did this person authenticate?" and gets a yes or no. That's the full extent of it.
• Location data. The app does not request or store your location.
• Analytics or advertising data. There are no advertising networks in this app. There are no analytics SDKs tracking behavior for marketing purposes.

Waitlist signup

If you join the waitlist at mymaddy.app, we collect your email address. The signup form also includes an optional question, "Which best describes you?", with four answers: I have AuDHD, I love someone who does, I work with AuDHD clients, or Prefer not to say.

This question is optional. If you skip it, nothing is stored. If you answer, your response is stored alongside your email.

Why we ask: to personalize the emails Maddy sends to waitlist members. That means the welcome email after you sign up, a small number of update emails between now and our App Store launch, and the launch-day email. After launch, the same answer may shape the wording and topic mix of our regular Maddy email so it sounds like it was written for the person reading it. We do not use it for advertising, for sharing with third parties, or for any purpose beyond personalizing Maddy email.

How long we keep it: as long as you are subscribed to Maddy email. You can have it deleted at any time by emailing support@mymaddy.app, or by unsubscribing. When you unsubscribe, we delete your answer along with your email.

Sensitive personal information: under the California Consumer Privacy Act (as amended by the CPRA), self-identification as a person with AuDHD is sensitive personal information. You have the right to limit our use of it. Email support@mymaddy.app at any time and we will action your request and confirm by reply.

Where it's stored

All data is stored in a Supabase Postgres database, hosted on the gfqjgdisuwzebaqjqseg project in the US East region (AWS us-east-1). Supabase is the infrastructure provider. See Supabase's Privacy Policy for their commitments as a data processor.

Session credentials are kept locally on your device in expo-secure-store (encrypted secure storage, not regular AsyncStorage) so you stay logged in between app launches.

Who can see it

Your data is scoped to your circle. A circle is the small group of people connected in the app, typically the supported person and one or more caregivers. Postgres Row-Level Security (RLS) enforces this at the database level: every query is filtered to the groups you belong to. If you're not in the circle, you can't read the data, not through the app, and not by querying the database directly.

Two categories of people have broader access as a matter of infrastructure:

• Supabase staff have administrative access to the database they host, per their Data Processing Agreement.
• Anthropic staff may have access to this codebase and its configuration as part of the tools used to build and maintain it.

Neither of these parties has any business reason to access your data, and their respective policies govern what they can do with it.

Crash reporting

Maddy uses Sentry for crash and performance diagnostics. Crash and app-hang reports may include device type, OS version, app version, and a stack trace (with a short JS profile on hangs). Before any report leaves your device, the app strips personal identifiers: your email address, IP address, and authorization headers are removed. Diagnostics are not linked to your identity, and we do not use this data for advertising. Sentry's privacy policy applies to that data, where Sentry acts as our processor.

Push notifications

Morning reminders and other alerts are sent through Expo's push service, which relays them to Apple's Push Notification service (APNs) for delivery. As part of that relay, Expo receives your device push token and the notification payload (the reminder text) as a processor, and Apple then delivers it. Expo's and Apple's privacy policies govern that transmission. You can disable notifications at any time in your device's Settings app.

Subscriptions and purchases

If you subscribe to Maddy, the purchase itself happens through Apple and your App Store account. Maddy never sees your payment details. We use RevenueCat to know whether your circle's subscription is active: RevenueCat receives purchase receipts from Apple and tells us the subscription status (product, entitlement, renewal period), which we store in our database keyed to your circle. RevenueCat acts as our processor; their privacy policy is at revenuecat.com/privacy. When you delete your account, your subscription records are removed from our database and the customer record in RevenueCat is deleted as part of the same process.

Age and account holders

Maddy accounts are for people 18 and older. The app's account creation screen enforces this. The person being supported may be younger; in that case, an adult caregiver sets up and manages their account and consents to the information Maddy collects. We don't knowingly collect personal information from anyone under 13 without a parent or guardian's involvement. If you believe a child's data was submitted without appropriate consent, contact us at support@mymaddy.app.

How to delete your data

The app includes in-app account deletion under the caregiver's Settings tab (scroll to the bottom). Tapping "Delete account" and confirming twice triggers a deletion process that cascades through all data associated with your account:

• Database records removed (your circle's data cascades from the group record): groups and memberships, invites, subjects, profiles, tasks, task submissions, task completions, task change requests, task feedback, earnings, payouts, daily check-in states, the mood log, caregiver notes, companion messages, encouragement notes, milestone shares, peer presence, cover requests, subscriptions, and subscription events.
• Storage buckets cleared: all files in task-proofs, caregiver-replies, and task-feedback tied to your account.

Your Supabase Auth account is then deleted. There is no recovery after this point.

Retention

We keep your data until you delete your account. There is no background retention after deletion, no archiving, and no backups that persist beyond Supabase's own infrastructure snapshot windows (which are part of their service, not ours).

Changes to this policy

If this policy changes in a meaningful way, Jeremy will notify circle admins through the in-app caregiver message surface. Continued use of the app after that notification constitutes acceptance of the updated terms. The "Last updated" date at the top of this page will reflect the most recent version.

Contact

Questions, data requests, or concerns: support@mymaddy.app

Reck the Fort LLC
mymaddy.app