Privacy Policy

Last updated: September 2026

The short version. mial remembers the things you want off your mind: tasks, people, plans. Your data is scoped to your account, encrypted in transit and at rest, never sold, and never used to train general-purpose AI models (one narrow provider-side safety exception is described below), and shared only with providers needed to run mial. You can export or delete your account at any time.

This policy applies whenever you use mial or sign up for our updates.

Who this applies to

mial is operated by Bendwater Labs LLC ("we", "us", "our"). This policy covers getmial.com and the mial web app, and applies to anyone who signs up for an account or uses the app.

What we collect

Account info. Email address and a password, which our authentication provider hashes. We never see or store your password in readable form. Your subscription tier.

What you put in mial. Anything you add to the app: tasks, appointments, notes, people, profile details. This is your product data.

Usage. Operational metadata only: when you log in, the usage counts we need to enforce limits, your subscription tier, and aggregate page-view counts on the website. We don't run granular click-tracking or behavioral analytics, and we don't build a profile of how you use the app.

Payment info (paid plans). If you subscribe, our payment processor collects payment details. We never see or store full card numbers.

Security signals. When you sign in, or when a request is checked against our abuse and rate limits, we record your IP address, your browser's user-agent string, and a timestamp. We use these only to protect accounts, investigate abuse, and enforce limits.

What we don't collect. Advertising cookies, cross-site trackers, precise location (no GPS, no location permissions; note that the IP address we record for security is coarse location by nature), your contacts, or your calendar. Voice input is handled by your browser's own speech feature, which may send audio to the browser maker under its policy. We don't receive or store the audio.

How we use it

• To run the product (store and display what you've added, authenticate sessions, apply your tier's features).
• To send essential email (account confirmation, password reset, billing receipts) and occasional product updates you can opt out of. Because mial is operated by Bendwater Labs LLC alongside other current and future products, we may also use the contact information you give us (such as your email) to share announcements about other Bendwater products and services. Every non-essential message includes a way to opt out (such as the unsubscribe link in email).
• When you use AI features, we send the relevant context to an AI provider through our own proxy. We only use providers whose terms prohibit training their general-purpose AI models on your content. One narrow exception sits on the provider's side: content flagged by a provider's automated safety systems may be retained and used to improve its internal safety classifiers, under its own policy. If you don't use AI features, nothing is sent for this purpose.
• To enforce rate limits and protect against abuse.

Who we share with

We use a small set of well-known infrastructure providers. Each is engaged to provide one specific service. We do not sell your data, and we do not authorize these providers to use mial data for their own purposes.

• Cloud database and authentication. Stores your account and the items you add, and signs you in.
• Website and app hosting. Serves getmial.com and the app.
• AI provider. Powers AI features, under terms that prohibit training general-purpose models on your content.
• Payment processor. Handles billing for paid plans. We never see or store your card details.
• Transactional email provider. Delivers account email such as sign-in confirmations and password resets.
• Email hosting for our support address. Receives and stores messages you send us and our replies.
• Traffic measurement. Counts page views on getmial.com so we know which pages people actually read. Cookieless and aggregate: no profile of you, and nothing that follows you to other sites.
• Error monitoring. Receives crash and error reports so we can keep the service running and secure. It is configured not to attach personal details such as your IP address or request contents, though an error message can occasionally carry a fragment of what triggered it.

Where your data lives

When you create an account, your data is stored in our hosted cloud database so you can sign in from any device and find it there. Access is scoped to your account, and we don't access your content except to operate and secure the service, to answer a request you make, or where the law requires it.

To be precise about what that means: the web app is not end-to-end encrypted. Your content is encrypted in transit and at rest, but our service can read what it stores, which is what makes features that read your content possible. Where the product offers encrypted cross-device sync, that sync payload is end-to-end encrypted with a key derived on your device, and we cannot read it.

Data follows you across devices: sign in on a new device, your data is there.

Cookies and local storage

We use session cookies and local storage to keep you signed in. We don't use advertising, retargeting, or analytics cookies.

Information about other people

Much of what you put in mial is about other people: relationships, birthdays, preferences, notes about how someone is doing. You are responsible for what you choose to record about others. That information sits in your account under this policy and is never sold. It is handled exactly like the rest of your content: the providers listed above, our AI provider if you use AI features, and wherever you send it yourself when you export. A good rule: record what you would be comfortable with that person knowing you keep.

When you export

Export produces a file containing everything in your account, including anything you have recorded about other people. Once exported, the file is yours and outside our control. If you paste it into another AI tool, that tool's terms and privacy practices apply to the copy you gave it, not ours, and they can differ materially: some consumer AI tools use pasted content for model training unless you opt out. Check the destination tool's data settings before pasting sensitive context.

Your rights

• See it. Everything in your account is visible inside the app.
• Export it. You can download a copy of your data from inside the app.
• Edit it. Delete items, change your email or password, update your profile from inside the app.
• Delete the whole account. Deleting your account from inside the app removes everything: your items, your people, your profile, your sign-in, and any active subscription. You can export first. If a step doesn't complete, we'd rather leave the account intact than half-deleted, and you can email us to confirm. If you'd rather we did it, email hello@getmial.com from your registered address.
• Opt out of email. Every non-essential email has an unsubscribe link. Transactional email (password reset, billing receipts) continues as long as you have an account.

These abilities are how the product works for every user, wherever you live. You can see, export, correct, and delete everything, and we will not make that difficult. mial does not sell personal information.

Data retention

We keep your data for as long as you have an account. When you delete your account, your data is removed as described above. Copies inside our database provider's routine backups age out on that provider's rolling backup cycle. Backups are only ever restored to recover from a serious failure, not to look anything up.

Security

Your data is encrypted in transit and at rest. Passwords are hashed by our authentication provider and we never see or store them in readable form. Access controls scope every account to its own data. No system is unbreakable, but we treat your data the way we'd want ours treated. If we become aware of a breach affecting your personal data, we'll notify you as required by law.

Children's privacy

mial isn't designed for anyone under 13. We don't knowingly collect data from children under 13 and will delete any account we find that violates this. Parents who think their child has signed up can email hello@getmial.com.

International transfers

mial's infrastructure operates in the United States. If you use the service from elsewhere, your data is stored and processed in the United States.

Changes to this policy

If we make a material change to how we handle data, we'll update this page and change the date above. Where the change is significant and we can give notice in advance, we'll email account holders before it takes effect.

Contact

Questions, requests, or complaints: hello@getmial.com.

Our Terms of Service cover your account, billing, and the rules for using mial.