Privacy policy
What we keep, and why.
Just Mate is a chat app. The things you tell a mate are the whole point of the product, so this policy is mostly about how we look after those conversations. We've written it in plain English. If anything is unclear, email us and we'll explain.
Who we are
Just Mate is operated by [legal name of the operator, trading as Just], [postal address]. We're the people behind Just Second Brain. For anything in this policy, write to dev@justsecondbrain.com. We're the data controller for the personal data described here.
What we collect
Your account. When you sign in with Apple or Google, we receive the email address and user identifier those services give us, and your name if you choose to share it. We don't see or store your Apple or Google password.
Your conversations. Every message you send to a mate and every reply they give is stored so the conversation can continue, and so the mate can refer back to it. This includes anything you choose to share about your life, relationships, work or health.
Memories. Mates remember things you tell them. We extract short notes from your conversations (for example "wants to call their dad on Thursday") and store them alongside a numeric representation that lets the mate find relevant notes later. Each mate's memories are kept separate from the others'.
Goals and check-ins. When you and a mate agree on a check-in, we store the goal, the schedule you agreed, and whether each check-in was sent and answered.
Subscription status. Whether you have an active subscription, which plan, and when it renews or ends. We don't receive your card number or payment details; Apple and Google handle payment.
Push notification tokens. A device token so a mate can message you when it's time for a check-in. You can turn notifications off in your phone's settings at any time.
Usage and diagnostics. Which screens you open, taps on buttons, how many messages you send, crashes and errors, and your device type and app version. We also record session replays of how you use the app's interface. In those recordings every piece of text and every image is masked before it leaves your device, so the recording shows the layout you tapped through, not what you or a mate wrote.
We don't collect your contacts, photos, precise location or anything from other apps.
Why we use it
- To run the service: deliver replies, keep conversations and memories, and send the check-ins you asked for. This is necessary to perform our contract with you.
- To manage your subscription and give you what you paid for. Also necessary for the contract.
- To keep the app working and improve it: fix crashes, understand which features get used, and spot where people get stuck. We rely on our legitimate interest in running a reliable product. We keep this data as light as we can and mask what we don't need.
- To keep the service safe: detect abuse, protect our systems, and comply with the law. Legitimate interest and legal obligation.
We don't sell your data. We don't use your conversations for advertising. We don't use your conversations to train AI models, and our model provider is contractually prevented from doing so too.
Who processes it for us
We use a small number of providers to run the service. Each one only receives what it needs.
- Supabase hosts our database, sign-in and server code. Your data is stored in the European Union (Frankfurt, Germany).
- OpenAI generates the mates' replies and the numeric representations used for memory search. The relevant parts of your conversation and memories are sent to OpenAI's API to produce each reply. OpenAI processes this in the United States under its API data-processing terms, which prohibit using API data to train its models and limit retention to abuse monitoring.
- RevenueCat keeps track of subscription status across Apple and Google.
- Apple and Google handle sign-in, payment, app distribution, and delivery of push notifications to your device. Their own privacy policies apply to the parts they handle.
- PostHog stores usage analytics, error reports and masked session replays. We use PostHog's EU hosting.
Where data leaves the European Economic Area (currently only to OpenAI in the United States), we rely on the European Commission's standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.
How long we keep it
- Conversations, memories, goals and check-ins: for as long as you have an account, because the mates need them to remember you.
- Subscription records: for as long as you have an account, plus as long as tax and accounting law requires.
- Push tokens: until you sign out, uninstall, or the token stops working.
- Usage analytics and error reports: up to 12 months.
- Session replays: up to 30 days.
When you delete your account, we delete your conversations, memories, goals, check-ins and push tokens within 30 days, and ask our providers to do the same. Backups are overwritten on a rolling basis within a further 30 days.
Your rights
If you're in the EEA, the UK or Switzerland, you have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, and receive a copy in a portable format. You can also withdraw consent where we rely on it, and complain to your local data-protection authority. People elsewhere have similar rights under their local law, and we'll honour reasonable requests from anyone.
To use any of these rights, email dev@justsecondbrain.com from the address on your account. We'll reply within 30 days. To delete your account and everything in it, open Profile in the app and tap "Delete account"; it takes effect immediately. If you can't get into the app, email us with the subject line "Delete my account" and we'll confirm when it's done.
Security
Data is encrypted in transit and at rest. Access to production systems is limited to the people who run the service, and each mate can only read the data it needs through server-side rules. No system is perfectly secure, so if we ever discover a breach that affects you, we'll tell you and the relevant authority as the law requires.
Children
Just Mate is for adults. You must be at least 18 to use it. We don't knowingly collect data from anyone under 18, and if we learn we have, we'll delete it.
The mates are AI
Atticus, Iris, Theo and Hugo are characters generated by an AI model. They aren't people, and they aren't therapists, doctors, lawyers or financial advisers. What they say isn't professional advice, and it isn't read by a human unless you ask us for support or we need to investigate abuse.
Changes
If we change this policy in a way that matters, we'll tell you in the app before it takes effect. The date at the top always shows the current version.