Privacy Policy

1. Who We Are

The data controller responsible for Mevra is:

Ertaga Jakub Godlewski
contact@ertaga.com

Questions, privacy requests, and complaints may be sent to the email address above.

2. Information We Collect

Account and authentication information

When you create or use an account, we or our authentication provider, Clerk, may process your name, email address, encrypted or securely managed authentication credentials, verification status, social sign-in information from Google or Apple, account identifiers, session tokens, and account security information. Mevra's backend stores a Clerk authentication identifier rather than your password.

Profile, social, and public leaderboard information

We process your leaderboard display name, role, XP, level, rank, achievements, friend requests, friend relationships, and related progression information. Participation in the global leaderboard is automatic. Your leaderboard name, rank, XP or level, and other leaderboard information may be visible to other users. Your email address and legal name are not intended to appear on the leaderboard unless you choose to use them as your public display name.

Alarms, focus plans, and session activity

We process information needed to synchronize and run the Service, including alarm names, schedules, selected days, durations, ringtones, volume, absence allowances, time zone, device-generated identifiers, desktop readiness and camera-permission status, session start and end times, session status, completion or failure reasons, early endings, disconnections, and presence or absence intervals.

Blocking preferences

We process the applications and websites you choose to add to a Mevra blacklist, including identifiers, names, platform, changes, and synchronization metadata. These selected blacklist entries may be synchronized across your devices through our backend.

Progress and game information

We process statistics derived from focus sessions, including streaks, completed time, XP, levels, coins, rewards, Expedition position and unlocked tiles, chests, keys, cards, inventory, and achievement progress.

Purchase and paywall information

Mevra is currently free. If paid features are introduced, Apple, Google, RevenueCat, and Superwall may process product identifiers, paywall interactions, app-store transaction identifiers, purchase and trial status, renewal and expiration information, entitlement status, and related subscription metadata. We do not directly receive or store full payment-card details.

Technical, diagnostic, and usage information

When you access the Service, we and our providers may automatically process information such as your IP address, approximate location derived from IP, device and browser type, operating system, app version, language, time zone, device or installation identifiers, request times, pages and features used, button or paywall interactions, session events, performance data, error reports, crash traces, network information, and referring URLs.

Communications

If you contact us, respond to research questions, join a mailing list, or communicate with support, we process your email address and the contents and metadata of your communications.

3. Camera and Presence Detection

During supported focus sessions, Mevra may use your desktop camera to determine whether a person appears to be present. Camera frames are analyzed locally on your device using an on-device MediaPipe model.

The Service may send presence-related events to our backend, such as whether presence changed, the start and end of an absence interval, camera availability or permission errors, and session status. These events are used for focus-session accountability, alarms, rewards, and troubleshooting.

You control camera permission through your operating-system settings. Features that depend on presence detection may not work if permission is denied or withdrawn.

4. App and Website Blocking

Mevra's desktop applications, mobile applications, accessibility components, Screen Time integrations, and browser extensions may need broad permissions to detect and block applications or websites selected by you during an active focus session.

Depending on your platform, this can involve locally checking the active application, package or bundle identifier, browser tab, navigation URL, or domain. Mevra uses this access to compare current activity against your blacklist and enforce your chosen blocking rules.

We do not transmit or retain a general history of websites you visit or applications you open. Selected blacklist entries and the minimum session or enforcement state needed to synchronize and operate blocking may be sent to our backend. Browser vendors and operating systems separately govern the permissions you grant.

5. Local Storage, Cookies, and Similar Technologies

Mevra stores information locally where needed, including authentication sessions, device identifiers, QR connection information, queued synchronization changes, alarm data, blacklist data, and runtime session state. Depending on the client, this may use secure storage, SQLite, local storage, Electron storage, cookies, or equivalent technologies.

Our web services and Clerk may use cookies or similar technologies that are necessary to authenticate you, protect sessions, prevent abuse, remember settings, and operate the Service. Analytics providers may use identifiers or similar technologies to measure usage. Where applicable law requires consent for non-essential analytics technologies, we will request it before using them and provide a way to change your choice.

Blocking essential storage may prevent account or Service features from working.

6. How We Use Information

We use information to:

• create, authenticate, secure, and administer accounts;
• provide alarms, focus sessions, device connection, synchronization, presence detection, and blocking;
• calculate statistics, streaks, achievements, leaderboards, rewards, and Expedition progress;
• display public leaderboard information and support friend features;
• provide customer support and respond to privacy requests;
• measure feature usage, improve usability, conduct product research, and develop new features;
• detect, diagnose, and repair crashes, errors, abuse, fraud, and security incidents;
• present and manage paywalls, trials, purchases, and entitlements if paid features are introduced;
• send essential account, security, service, and policy communications;
• send promotional, research, feedback, and product-update emails where you have consented or where otherwise permitted by law; and
• comply with law, enforce our Terms, and establish or defend legal claims.

7. Legal Bases for Processing

If laws such as the GDPR or UK GDPR apply, we rely on one or more of these legal bases:

• Contract: to create your account and provide the Service you request.
• Legitimate interests: to secure and improve Mevra, prevent abuse, troubleshoot problems, understand aggregate product use, operate public and social features, and communicate with existing users, where those interests are not overridden by your rights.
• Consent: for optional analytics or storage where required, promotional or research emails where required, and permissions you choose to grant. You may withdraw consent at any time without affecting earlier lawful processing.
• Legal obligations: where processing is necessary to comply with applicable law.

Providing account and core session information is necessary to use account-based Service features. Optional analytics, marketing, camera access, and blocking permissions can be declined, although the associated features may then be unavailable.

8. Service Providers and Disclosures

We disclose information only as reasonably necessary for the purposes described in this Policy. Our providers may include:

• Clerk for authentication, account security, social sign-in, and session management;
• Hostinger for website and backend hosting;
• Neon for managed PostgreSQL database infrastructure;
• Sentry for error, crash, and performance monitoring;
• PostHog and Amplitude for product analytics, feature measurement, and product improvement;
• Superwall for paywall presentation and measurement;
• RevenueCat for purchase validation, entitlements, and subscription management;
• Apple and Google for app distribution, social sign-in, device services, purchases, subscriptions, billing, and refunds;
• Expo/EAS for mobile build, delivery, and update infrastructure where used; and
• professional advisers, authorities, or other parties where reasonably necessary to comply with law, protect rights and safety, investigate misuse, or complete a business reorganization.

These providers process information under their own terms and privacy notices and may act as our processors or, for some activities, independent controllers.

We do not sell personal information, share it for cross-context behavioral advertising, or use it to display third-party targeted advertising. We have not sold or shared personal information in this sense during the preceding 12 months.

9. Analytics and Automated Processing

PostHog and Amplitude may help us understand how users move through Mevra, which features are used, and where users encounter difficulty. Sentry helps us diagnose crashes and technical errors. Superwall and RevenueCat may measure paywall and subscription events. We configure these services to receive only information reasonably needed for their purpose.

Mevra automatically calculates presence status, focus-session outcomes, XP, rewards, achievements, streaks, and leaderboard positions. These automated calculations affect features inside Mevra but are not used to make decisions that produce legal or similarly significant effects such as employment, credit, insurance, or healthcare decisions.

10. Marketing and Product Research

With your consent where required, we may email you about Mevra features, offers, updates, surveys, interviews, and requests for feedback. These messages are optional and separate from essential account, security, transaction, and policy communications.

You can withdraw from promotional and research email at any time by using the unsubscribe link in the message or contacting contact@ertaga.com. We may keep a minimal suppression record so that we continue to honor your choice.

11. International Data Transfers

We are based in Poland and make the Service available worldwide. Our providers may process information in Poland, elsewhere in the European Economic Area, the United States, and other countries whose laws may differ from those where you live.

Where required, we use recognized transfer mechanisms such as adequacy decisions, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful safeguard. You may contact us for more information about applicable safeguards.

12. Data Retention

• Account, synchronized content, profile, social, session, progression, and subscription data are generally retained while your account remains active.
• Operational and security logs are normally retained for no longer than 30 days unless a longer period is needed to investigate a security incident, prevent abuse, comply with law, or establish or defend a claim.
• Analytics and diagnostic information is retained according to configured provider retention periods and is deleted or aggregated when it is no longer reasonably needed for product measurement, reliability, or security.
• Support and research communications are retained as needed to respond, maintain a record of the request, improve the Service, or meet legal obligations.
• Marketing information is retained until you unsubscribe or the information is no longer needed, after which we may retain a minimal suppression record.
• When you delete your account, deletion from active systems is initiated promptly and completed within 30 days, subject to limited legal, security, fraud-prevention, and claims-related exceptions. Protected backup copies are removed through the applicable provider's normal backup-expiration cycle and are not restored for ordinary use.

13. Account and Data Deletion

You can delete your account using the delete-account option in Mevra. Account deletion is intended to delete the account from Clerk and remove or anonymize data linked to it in Mevra's active systems, including alarms, sessions, blacklist entries, progression, leaderboard profile, and friend information, subject to the limited exceptions described above.

You may also request deletion or assistance by emailing contact@ertaga.com. We may need to verify your identity before acting. Deleting an application from a device does not, by itself, delete your Mevra account or synchronized server data.

Local data can be removed by using available in-app controls, signing out where applicable, clearing browser or application storage, or uninstalling the relevant application or extension.

14. Your Privacy Rights

Depending on where you live, you may have rights to access, receive a copy of, correct, delete, or restrict the use of your personal information; object to certain processing; withdraw consent; obtain portable data; or appeal a refusal. You may also have the right not to be discriminated against for exercising a privacy right.

You may exercise applicable rights through available account controls or by emailing contact@ertaga.com. An authorized agent may submit a request where permitted by law. We may request information needed to verify the request and the agent's authority.

EEA users may complain to their local supervisory authority, including Poland's President of the Personal Data Protection Office (UODO). UK users may complain to the Information Commissioner's Office. Residents of other regions may contact their competent privacy regulator.

California and other U.S. state disclosures

The categories collected in the preceding 12 months may include identifiers; account and customer-record information; internet or other electronic activity; approximate geolocation derived from IP; commercial and subscription information if paid features are introduced; and inferences such as product preferences derived from usage. Sources include you, your devices and browsers, social sign-in providers, app stores, and our service providers. We use and disclose these categories for the business purposes described in Sections 6 and 8.

We do not knowingly sell or share personal information for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of users under 16. Where applicable, residents may request to know, access, correct, delete, or receive a portable copy of personal information and may use an authorized agent. We do not use or disclose sensitive personal information for purposes that require a right to limit under California law.

15. Children

Mevra is not intended for children under 13, and we do not knowingly collect personal information from anyone under 13. If you are under the age of legal majority where you live, a parent or legal guardian must review and agree to the Terms on your behalf where required by law.

If we learn that we collected information from a child under 13, we will take reasonable steps to delete it. A parent or guardian may contact contact@ertaga.com. Promotional email will be sent to minors only where valid consent, including guardian consent where required, has been obtained.

16. Security

We use reasonable technical and organizational safeguards designed to protect information, including authenticated access, encrypted network transport, restricted provider access, credential redaction in logs, and security controls offered by our infrastructure providers. No system is completely secure, and we cannot guarantee absolute security.

17. Third-Party Links and Platforms

The Service may link to third-party websites or operate through app stores, browsers, operating systems, and identity providers. Their processing is governed by their own privacy notices. This Policy does not cover a third party's independent practices.

18. Changes to This Policy

We may update this Policy to reflect changes in Mevra, our providers, or applicable law. We will post the updated version and change the date above. If a change is material, we will provide additional notice through the Service, by email, or by another reasonable method where required.

19. Contact Us