Privacy Policy
Last updated: 9 July 2026
MARAEL is built to hold something deeply personal — messages for the people you love, meant to reach them one day. We treat that responsibility seriously. This policy explains, in plain language, what we collect, what we can and cannot see, and the rights you have. MARAEL is operated by GRETIFY s. r. o. (“we”, “us”), the data controller.
The short version
We cannot read your messages. They are encrypted on your device before they ever leave it, and on our servers there is only unreadable ciphertext — openable one day only by the cooperation of two of your three chosen verifiers, never by us.
We collect the little we need to run the service safely: an account, the people you nominate, and technical signals to keep the check-in and delivery working. We never sell your data.
What we collect
- Account: an identifier from Sign in with Apple or Google Sign-In, and an email address. We never see or store a password.
- Your messages: only as ciphertext. We cannot decrypt them.
- The people you nominate: names, email addresses, phone numbers and relationship labels for your recipients, verifiers and optional emergency contact — the details needed to reach them at the right time.
- Service data: your check-in activity, delivery configuration and subscription status, so the dead-man’s-switch can run.
- Technical diagnostics: app version, device model, OS and a short error log — technical only, never your content or personal data (Rule 26).
What we cannot see
The contents of your messages. Each message is sealed with a key that is split into three shares (a 2-of-3 scheme); each share is wrapped with a secret only the corresponding verifier holds. We store the ciphertext and the wrapped shares — never a readable key. A breach of our servers reveals nothing readable.
How we use what we collect
- To run the check-in → verification → delivery process you set up.
- To contact your nominated people at the defined moments (reminders, verification requests, and, only after confirmation, delivery).
- To provide the subscription, prevent abuse, and keep the service secure.
We do not use your data for advertising, and we do not profile you.
The people you nominate
Your recipients, verifiers and emergency contact are real people whose personal data we hold on your instruction. Each is contacted only for their role, is told what MARAEL is, and can ask to be removed at any time. A verifier is never also a recipient of the same person. If someone withdraws, we tell you so you can nominate a replacement.
After you are gone
Delivery happens only after a long, staged period of silence and confirmation by at least two of your three verifiers — with a final grace window before anything is sent. When delivered, each recipient receives only their own message, over a secure one-time link. Undelivered data is retained while your account remains active and is handled per the retention rules below.
Who we share it with
We do not sell your data and never share it for others’ marketing. We use a small set of processors purely to run the service: our hosting and email provider (hostcreators) and our app-backend provider (Cloudflare) for the encrypted, server-side switch; and Apple / Google for sign-in and subscriptions. Each processes data only on our instructions. We may disclose data if strictly required by law.
How long we keep it
We keep your data while your account is active. If your subscription lapses, nothing is deleted abruptly — there is a long grace period and your verifiers are notified before anything is lost, never a silent deletion. You can delete your account and data at any time from the app; this also removes the cloud copy. Some minimal records may be kept where the law requires.
Security
Messages are end-to-end encrypted with keys we never hold. All traffic uses TLS. Our backend endpoints are gated so only the genuine, unmodified app can call them. We follow the security practices described in our documentation and review them regularly.
Your rights
Under the GDPR and similar laws you can request access to, correction of, or deletion of your data; object to or restrict certain processing; and receive a portable copy in a structured, commonly-used, machine-readable format. To exercise any of these rights, write to info@marael.app and we will act on your request. You may also complain to the Slovak Data Protection Authority (Úrad na ochranu osobných údajov SR) or to the authority in your own country.
Children
MARAEL is not intended for people under 18 and is not directed at children. We do not knowingly collect their data.
Changes to this policy
If we make a material change we will update this page and, where appropriate, notify you in the app. The “last updated” date above always reflects the current version.
Questions about this? Email us at info@marael.app.