Privacy Policy

Effective November 10, 2026

Mandala is built so your chart stays yours. There's no account and no ads, and we don't sell or share your personal information. This policy explains exactly what leaves your device, why it leaves, and how to turn it off or have it deleted.

Mandala ("Mandala", "we", "us") is an iPhone app and widgets operated by Milo Messina. This policy covers the app, its widgets and the Mandala server that drafts suggestions. Questions or requests: optiqinquiries@gmail.com.

The short version

Your chart lives on your device and in your own iCloud account if you use iCloud. We can't see it.
When you ask Mandala to draft pillars, moves or questions, the text needed for that request is sent to our server and our AI provider to write the suggestions. We don't store it.
Anonymous usage analytics (for example "a check-in happened") help us improve the app, but only if you say yes when the app asks. They never include what you type. You can change your answer anytime in Mandala › ⋯ › Privacy & Terms.
Apple Health is optional and read only. If you connect it, Mandala reads workouts and sleep on your iPhone to suggest check-offs and show your stats. Health data never leaves your device: it isn't sent to our server, our AI provider, analytics or iCloud, and Mandala never writes to Health.
Purchases are handled by Apple. We use RevenueCat to know whether you have Mandala Plus.
We don't use the advertising identifier, don't track you across other apps or websites, and don't sell or share your personal information. Analytics and purchase records are filed under random or app-specific IDs, never your name, email or Apple ID.

1. Your chart and check-ins

Your goal, your "why", pillars, moves, cadences, reminder times, check-ins, streaks, color theme and similar content are stored on your iPhone. If iCloud is turned on for Mandala, Apple syncs this data through your private iCloud database so it appears on your other devices. That database belongs to your Apple Account: we can't access, read or delete it on your behalf. Apple's handling of iCloud data is described in Apple's privacy policy.

Widgets read the same data on your device to show today's moves. Reminders are scheduled on your device by iOS. Mandala doesn't send push notifications from a server.

2. Apple Health

Connecting Apple Health is optional (Mandala › ⋯ › Connected Apps). If you allow it, Mandala reads two types through Apple's HealthKit: workouts (type, date, duration and distance) and sleep. It uses them only on your iPhone, to suggest checking off a move you already did (for example, a run that matches "Easy 3-mile run"), to show workouts and sleep in Stats, and to let Nine suggest a lighter move after a short night. It never checks anything off without your tap.

Health data is processed only on your device. It is never sent to our server, to Anthropic or any other AI provider, to analytics (PostHog), to RevenueCat or to any third party; it isn't stored in iCloud or CloudKit; and it is never used for advertising, marketing or sold. Mandala doesn't write anything to Apple Health. You can turn off access anytime in the Settings app › Health › Data Access & Devices › Mandala (or Settings › Privacy & Security › Health), and disconnect it in Mandala › ⋯ › Connected Apps.

3. AI drafting

Mandala asks your permission the first time you use an AI feature, and you can change your answer anytime in the app under ⋯ › Privacy & Terms › Draft with Claude AI. If you don't allow it, or you write a blank chart yourself, none of your text is sent: Mandala drafts with Apple's on-device model where it's available, or with built-in templates. When you have allowed it and ask Mandala to draft (building a chart, adding a chart, redrafting pillars or moves, or asking Nine to change your chart in a chat), it sends the text needed for that request to the Mandala server, hosted by Vercel. If the server can't be reached, Mandala uses Apple's on-device model (Apple Intelligence) where it's available, and that processing stays on your device.

That text is your goal, your "why" if you wrote one, your answers to the setup questions, and the pillar or moves being drafted. For a chat with Nine, it's your message, the last few messages of that chat, and your chart's goal, pillars and moves. Chats aren't saved: they disappear when you close them. The server passes it to Anthropic's Claude API to write the suggestions and returns the result to your device. Like any internet request, it also carries your IP address.

To stop anyone from abusing the drafting service with fake requests, Mandala uses Apple's App Attest. The app creates a key in your iPhone's Secure Enclave, Apple confirms to our server that the key belongs to a genuine copy of Mandala, and each drafting request is signed with it. Our server receives the key's random ID and public key; they don't identify you and aren't linked to your analytics or purchases. We keep them only inside a signed token stored on your device, and in memory for up to an hour for rate limiting.

The Mandala server doesn't save the content of drafting requests or keep a log of them. To stop abuse and cap AI costs, it uses your IP address and App Attest key ID in two ways: short-term rate limits held in the server's memory (typically for up to an hour, and never written to disk), and daily usage counters that record how much drafting a device and a network used today. The counters are filed under a one-way hashed ID, never your IP address or key ID itself, and are deleted after two days. They're kept in the server's memory or, when enabled, in Upstash, a database service provided through our host Vercel.
Vercel keeps standard short-lived request logs (such as time, IP address and response code) to run its service.
Anthropic processes the text to produce the suggestions. Under its commercial terms it doesn't use API content to train its models, and it may retain it for a limited time for trust and safety purposes.

Please don't put sensitive information you wouldn't want processed this way (such as health conditions or other people's details) into your goal or answers. If no drafting service is reachable, Mandala uses built-in templates and nothing is sent.

4. Usage analytics

We use PostHog (United States) to understand how Mandala is used, so we can fix what's confusing and keep what works. Analytics is off until you agree: the first time you start building a chart, Mandala asks "Help improve Mandala?", and nothing is sent unless you tap Share. When analytics is on, the app sends events such as:

which onboarding step you reached, how long chart building took, and whether you used "Suggest 3";
check-ins and undos (with the move's cadence and streak length, never its name);
chart created, switched or deleted, theme and appearance changes, and edits (the kind of cell, never its text);
paywall views and skips, and purchases started, completed, cancelled or failed (the plan, not payment details);
app opened, installed, updated or backgrounded.

Each event carries a random identifier created by the app (not your name, email, Apple ID or advertising identifier), whether you have Plus, and basic technical details such as app version, iOS version, device model, language and time zone. We've configured PostHog to discard IP addresses, so analytics doesn't record your location. Analytics never includes your goal, pillar or move titles, your "why", or anything else you type.

Turning it off: go to Mandala › ⋯ › Privacy & Terms and switch off "Share usage analytics". The app then stops sending events. Analytics is off in builds used for development.

We keep analytics events for no longer than our PostHog plan retains them (currently one year), then they're deleted.

5. Purchases (Mandala Plus)

Subscriptions and the lifetime purchase are sold and billed by Apple through the App Store. We never receive your card, billing address or Apple ID password.

We use RevenueCat (United States) to check whether you have Plus and to keep that working across reinstalls and devices. RevenueCat receives a random app user ID, Apple's vendor identifier for Mandala on your device (an ID unique to our apps on that device, not the advertising identifier), App Store transaction and receipt details (such as product, price, currency, store country, purchase and renewal dates, and trial status), and basic technical details (app version, iOS version, device model). If analytics is on, the app also gives RevenueCat the random PostHog identifier so purchase events appear alongside usage analytics. RevenueCat keeps purchase records for as long as needed to provide the service and meet tax and accounting obligations.

6. How we use information, and our legal bases

To provide the app (drafting suggestions, unlocking Plus, syncing through your iCloud): necessary to perform our agreement with you.
To understand and improve Mandala (analytics): your consent, which you give by tapping Share and can withdraw at any time by switching analytics off.
To prevent abuse and keep the service secure (rate limiting, request logs): our legitimate interest and yours in a working, affordable service.
To meet legal obligations (for example purchase records): legal obligation.

We don't use your information for advertising, don't build advertising profiles, and don't make decisions about you that have legal or similarly significant effects.

7. Who we share it with

Only the service providers named above, each acting on our behalf to run Mandala: Vercel (server hosting), Upstash (the hashed daily usage counters, when enabled), Anthropic (AI drafting), PostHog (analytics) and RevenueCat (purchases). Each may use the information only to provide its service to us, and each is bound by its terms with us to protect it in a way that provides the same or equal protection as this policy. Apple provides the App Store, iCloud and on-device processing under its own terms. We may also disclose information if the law requires it, to protect people's safety, or as part of a sale or transfer of Mandala, in which case this policy continues to apply to it.

We don't sell personal information and don't "share" it for cross-context behavioral advertising, as those terms are defined in California law.

8. Where it's processed

Mandala's providers process data in the United States. If you're outside the US, your information is transferred there. Where the law requires it, these transfers rely on the providers' standard contractual clauses or equivalent safeguards.

9. Keeping it safe

All traffic between the app and our server and providers is encrypted in transit (HTTPS). Your chart is protected by your device's security and, if you use it, iCloud's security. No method of transmission or storage is perfectly secure, but we collect as little as we can, which limits what could ever be exposed.

10. Your choices and rights

Delete your chart: in Mandala › ⋯ › My Charts, swipe a chart and delete it. This removes it and its check-ins from your device and your iCloud. Deleting the app removes the data on that device.
Stop analytics: switch off "Share usage analytics" in Privacy & Terms.
Access or delete analytics and purchase records: email optiqinquiries@gmail.com with the "Anonymous ID" shown in Privacy & Terms. Because we don't know who you are, that ID is how we find your records. We'll respond within 30 days, or sooner where the law requires.
Depending on where you live (for example the EU, UK, or US states like California), you may have rights to access, correct, delete or port your personal information, to object to or restrict processing, and to complain to your local data protection authority. We won't discriminate against you for using these rights.

11. Children

Mandala is a general-audience app intended for people 13 and older, and it isn't directed to children under 13. We don't knowingly collect personal information from children under 13. If you're a parent or guardian and believe your child under 13 has used Mandala's drafting or analytics, email us and we'll delete what we can identify. Users under 18 should use Mandala with a parent's or guardian's permission.

12. Changes

If we change this policy, we'll update the date at the top. If a change is significant, such as collecting a new kind of data, we'll also tell you in the app before it takes effect.

13. Contact

Milo Messina, Mandala. Email optiqinquiries@gmail.com.