Scope
This policy applies to the MADAR app and its backend services. Last updated: 15 August 2026.
Data the service processes
- Account, household, membership, and permission data.
- Tasks, schedules, bills, subscriptions, documents, and financial inputs you choose to enter.
- Voice or text you intentionally submit to obtain task suggestions.
- Technical data required for security, sessions, service operation, and fault diagnosis.
Voice and continuous-capture sessions
Granting microphone permission does not start recording. Continuous capture starts only after your explicit tap and shows an in-app indicator, elapsed time, and stop control; Android also shows a persistent service notification. A recording may continue while the screen is locked on iOS or Android, stops automatically after five minutes, and is not uploaded if it exceeds 15 MB. Upload and analysis do not begin in the background. After you stop recording, analysis starts only when the app and Capture screen return to the foreground.
The app keeps owner-bound state for a pending temporary audio file on the device so it can recover after a restart without exposing the file path. MADAR will not begin a new upload or analysis after a pending recording reaches 24 hours. If an in-flight request reaches that limit while the app is running, the client cancels it and ignores late results, although data already received by the server may already be processing. The app tries to remove an expired file on its next launch or foreground return and removes the local file after successful analysis. If analysis fails, you can retry or explicitly delete the pending recording. The account-bound review plan is encrypted before audio deletion and remains until you approve or delete its items.
How data is used
Data is used to provide requested features, protect the account, synchronize authorized records, and present suggestions for review. During a session you explicitly started, only a clear, high-confidence, low-risk task may be saved automatically with its source recorded in the audit trail. Optional, sensitive, recurring, ambiguous, or uncertain tasks remain for review. A suggestion is not execution, and MADAR does not automatically perform a sensitive financial or external action.
Loan-document analysis
A loan document is uploaded only after you select it and expressly consent. The app and server validate its type and size, then temporarily send content to OpenAI for structured fields and reviewable evidence under the approved provider-project data controls. MADAR requests no provider-side response storage, but provider processing and abuse-monitoring retention remain subject to those controls and terms. MADAR does not store document bytes or the report in its database or application logs and attempts to delete its temporary cache copy after the attempt; the operating system also controls temporary-cache lifecycle. Results are review estimates, not approval, financial advice, or an automatic action.
Notifications and financial rates
MADAR sends push, email, or SMS notifications only after you enable a channel and the provider and destination are configured and verified where required. Delivery may be delayed or fail because of the device, network, or provider. Central-bank rates are presented only from a server-approved official machine-readable source and are clearly separated from the APR of a loan or bank transaction. Calculators and alerts are estimates, not a bank offer or investment or credit advice.
External providers
The MADAR server sends a voice file you stopped to the configured OpenAI transcription and analysis service. Data is not sent to another connector unless that connector is configured and you use its related feature. These services may include calendar, email, or notification providers and are also subject to the selected provider’s terms.
Retention and protection
Data is retained as needed to provide the service and meet security and operational requirements. After account deletion, necessary security and audit records may remain after de-identification, and shared household data remains for other members. The service applies household permissions and isolation, but no digital service is completely risk free.
Your choices
You can stop recording at any time, delete a pending recording, edit many records, or disconnect connectors and notification channels in the app. You can start account deletion in app settings or through the web account-deletion resource.
Background task-sync outbox
On supported native mobile builds only, MADAR may keep supported task mutations in an encrypted local outbox so it can synchronize them safely. Each operation is bound to the user, household, session, and authentication generation and is sent with an idempotency key. The outbox does not hold audio files, documents, connector data, or financial-analysis data. Launch, foreground resume, and network reconnect remain the primary retry paths. The operating system may grant one additional bounded, deferred background attempt, with no guaranteed schedule or execution.
Operations and the encryption key for an earlier session are removed when the account changes, on sign-out, or through the account-deletion path. An operation that cannot be sent stops after bounded attempts and appears for review; you can retry it or discard it locally. Background synchronization does not mean microphone monitoring, audio upload, or financial execution.
Identity verification and household invitations
When you request a new registration, the server temporarily retains the email address, password hash, display name, household name, locale, and a network-address digest until the request is confirmed, expires, or is revoked, after which it remains subject to the security and operational retention schedule. For verification, password recovery, and household invitations, a configured transactional-email provider may process the address, locale, message purpose, and action link. A household invitation is restricted to the matching verified email and also retains an address digest, a masked hint, the role, and acceptance or revocation state.
The database does not store the raw action token. It stores a keyed digest with purpose, expiry, delivery, consumption or revocation state, and a network-address digest. The token is short-lived and single-use and travels in the URL fragment after # so it stays outside the HTTP request target, but it remains a secret that must not be shared. Token digests and invitation state may remain after use or expiry for the period required for security, audit, and abuse prevention. Transactional-email provider data and verified action links—HTTPS web links or Universal/App Links according to the release scope—are used only when the durable delivery channel and links are configured and approved; otherwise the flows fail closed.
Current feature state: Durable verification, recovery, and invitation delivery and verified action links are enabled in this deployment. The PWA uses HTTPS links on madarlife.app; Universal/App Links remain specific to store releases. Each action message is atomically placed in an encrypted outbox and then sent by the configured worker. A retry after a rare crash can deliver a message more than once, but its token remains short-lived and single-use.