Privacy Policy

1. Controller and data processed

Mubu is the controller of the data described in this Policy. For privacy requests, use Profile > Help & contact in the app.

Account and profile data: name, email, account identifiers, protected credentials, profile photo, language and preferences. When you choose to sign in with Apple or Google, we receive the data the identity provider authorizes.

Data you provide in the features: onboarding answers, goals, tasks, habits, focus, app blocking, journal and media, mood, sleep, workouts, water, nutrition, weight, body measurements and diet information, challenges and financial records.

Operational data: device and notification identifiers, IP address, access, security and error logs. For purchases, we receive product, transaction and access-status information sent by the stores and by RevenueCat; your full card details stay with the store.

2. How we use data

We use account data and content to provide the features you request, save and sync records, offer support and manage purchases. We also use technical logs to protect accounts, prevent fraud, fix errors and meet legal obligations. These activities rely on performance of the contract, legal obligations or legitimate interest where applicable.

Information that reveals health or other sensitive data is used only for the feature you activate and requires its own legal basis under Brazil's General Data Protection Law (LGPD). Providing it is optional. Device permissions do not replace any specific consent required by law.

If you use AI meal analysis, the data and images sent to the feature are processed to produce an estimate. Review the result before saving it. We do not sell personal data, and we do not use health, diet or journal records for third-party behavioral advertising.

3. Permissions and providers

Camera, photos, microphone, notifications and app-blocking permissions are requested according to the feature you use. You can manage them in your device settings; revoking them may prevent the corresponding feature from working.

We share only the data needed with providers that operate the service: hosting and database, Cloudflare R2 for media, Apple and Google for purchases and sign-in, RevenueCat for paid access, Expo for notifications and Google Gemini for nutrition analysis when you request it. Journal content and photos may be synced to private storage.

We may also share data to comply with the law, protect rights or fulfill your requests. Providers may process data outside Brazil; we apply the safeguards the LGPD requires for international transfers.

4. Storage, security and deletion

We take technical and administrative measures to protect data, such as access control and secure connections. No system removes every risk. Data may stay on your device until it syncs; synced media is kept in private storage.

We keep data while your account is active and for as long as needed for the stated purposes. When you delete your account, we erase the linked records and request removal of the associated media. Data required by law, purchase records kept by the stores and temporary technical copies may remain until they expire.

To delete your account, use Profile > Delete my account. Deletion does not cancel an active subscription; cancel it in the App Store or Google Play. If you lost access to your account, request deletion through the support channel shown on the app's store page. We may verify your identity before handling the request.

5. Your rights

Under the LGPD, you may request confirmation of processing, access, correction, information about sharing, portability where applicable, anonymization, blocking, deletion, objection and review of automated decisions. You may also withdraw consent when it is the basis for processing. Make your request in Profile > Help & contact or through the support channel shown on the app's store page.

You may file a complaint with Brazil's National Data Protection Authority (ANPD) if you believe your rights were not respected.

6. Children, changes and contact

Mubu is not intended for children under 13. If we find that a child's data was processed improperly, we will take steps to remove it and assist the child's parent or legal guardian.

Material changes to this Policy will be announced in the app or through an appropriate channel. The current version shows its update date. For questions or requests, use Profile > Help & contact in the app.