Privacy Policy
Mermaid lets you use your computer, a Mac or a Windows PC, from your phone and ask it to carry out tasks for you. This policy explains what information Mermaid handles, why, who else processes it, how long it is kept, and the choices you have.
Who we are
Mermaid is provided by GODAAN SERVICE PRIVATE LIMITED ("we", "us"). This policy covers the Mermaid iPhone app, Mermaid for Mac, Mermaid for Windows, Mermaid for Android when it is available, and the online services they use. Mermaid for Windows works as Mermaid for Mac does: where this policy describes your Mac, the same applies to your Windows PC, except where Mermaid for Windows says otherwise. It does not cover other products that share the addmermaid.com website. Questions about privacy: support@addmermaid.com.
Summary
- We use your information to provide Mermaid, not for advertising. We don't sell it and we don't track you across other apps or websites.
- Your Mac's screen, your control of your Mac, your files and your clipboard travel between your phone and your Mac encrypted end to end. Our relay cannot read them.
- To carry out a task, your Mac sends your request and what the task needs, which can include screenshots of your Mac's screen, to Mermaid's AI service, which uses a third-party AI provider to process it. Mermaid for Mac carries out the task on your Mac, checks every action against Mermaid's own safety rules and asks for your approval before consequential actions. The app asks for your permission before anything is sent for AI processing.
- Voice requests are turned into text, and replies are read aloud, by a third-party speech service. This also needs your permission first.
- Mermaid for Mac keeps an encrypted memory on your Mac of what you tell it that is worth keeping and of your conversations with it, so it can pick up your work from any of your phones. It is not stored on our servers.
- Mermaid for Windows works the same way on your PC, including its encrypted memory; Mermaid for Windows describes where it differs.
- You can turn AI processing off, unpair a Mac or PC, or delete your account in the app at any time.
Information we handle
Your account
To create your account and sign you in: your email address, the sign-in method you use (Sign in with Apple, Google, a one-time code sent by email, or a password), and the identifier Apple or Google gives us for your account. If you sign in with Google and Google shares them, we also receive your name and a link to your profile photo. With Sign in with Apple you can choose to share a private relay email address instead of your own. Your name, email address and photo are shown in the app and on the Macs you pair.
Your phones and Macs
To pair your devices and connect them, including from away from home: an identifier and public keys for each phone and Mac you use with Mermaid, the device name, the app version, and when the device was last connected. Private keys never leave the device that created them.
Usage records
To run the service and its free usage limits: the number of tasks and AI requests, the amount of AI processing used and its cost, timing, and whether requests succeeded. These records do not contain your requests, your screen or your files.
Purchases
If you subscribe in the iPhone app, Apple processes your payment; we do not receive your payment details. We and RevenueCat, which manages subscriptions for us, receive the purchase record (the plan, purchase and renewal dates, renewal status and Apple's transaction identifiers), linked to your Mermaid account, to give you the plan you paid for and to handle renewals, cancellations and refunds. When Mermaid for Android is available and offers subscriptions, Google Play processes the payment in the same way, and we and RevenueCat receive the same kind of purchase record with Google Play's order identifiers.
If you subscribe in Mermaid for Mac or Mermaid for Windows, Dodo Payments sells the subscription to you as our merchant of record: it runs the checkout, processes your payment, handles the applicable taxes and issues your invoices. You enter your payment and billing details with Dodo Payments; we do not receive your card details. To open your checkout, we give Dodo Payments your email address and your account's internal ID. We receive the purchase record (the plan, the subscription and payment identifiers, the amount and currency, and the payment, renewal, refund and dispute status), linked to your Mermaid account, to give you the plan you paid for and to handle renewals, plan changes, cancellations and refunds. Dodo Payments also processes your information under its own privacy policy.
The iPhone beta
If you join the iPhone beta on our website, we send your email address to Apple to add you to our TestFlight beta, and Apple emails you the invitation. We keep your email address, when you joined, the state of your TestFlight invitation, and a one-way code made from your browser's description (its user agent), not the description itself. We use your email address only for the beta and do not email you ourselves. To limit abuse, our database briefly keeps a one-way code made from your IP address with a random value that changes every day. It is deleted within a day, and we never keep the IP address itself.
Technical logs
Our hosting providers record technical information such as IP addresses and request times when the app connects to our services. We use it to keep the service secure and working.
Tasks and AI processing
When you ask Mermaid to do something, your request goes from your phone to your Mac, encrypted end to end. Your Mac then sends your request and the information the task needs to Mermaid's AI service, our own server, hosted by Fly.io in Singapore. It checks that the request comes from your signed-in account and applies your plan's usage limits. What your Mac sends can include screenshots of your Mac's screen, text shown on it, and the contents of files the task uses. Our AI service passes this information to a third-party AI provider for processing and returns the result to your Mac.
Mermaid for Mac reads your screen, carries out each step in your apps, and checks every action against Mermaid's own safety rules before it runs. Those rules decide when Mermaid must ask for your approval, such as before something is sent, posted, deleted or bought. Live Screen, Take Over, sending files, Mac controls such as Lock and Sleep, and pairing do not use AI processing.
- Permission first. The app asks for your permission before your first request is sent for AI processing, and sends nothing for AI processing until you allow it. Live Screen, Take Over and sending files work without it.
- Turning it off. You can turn AI processing off at any time in the app (Account › AI Processing). A running task stops, and nothing more is sent.
- Not stored by us. Mermaid's servers, including our AI service, do not store your requests, screenshots, screen text or file contents. We keep only the usage records described above.
- Third-party processing. Our AI provider processes this information to return a result, under its terms and privacy policy, which may allow it to keep the information for a limited time, for example to prevent abuse.
- No training by us. Mermaid does not use your requests, screen content or files to train AI models.
Voice
When you tap the microphone to speak a request, your phone sends the audio directly to our third-party speech service, which turns it into text. When Mermaid reads a reply aloud, the reply text is sent to the same service to create the speech. Mermaid's servers do not receive your audio. The speech service processes it under its terms and privacy policy. Voice needs the same permission as AI processing, and the microphone listens only while you speak a request.
Reports you send
If you report one of Mermaid's replies in the app, we receive the reason you choose, any note you add, the text of that reply as it was shown, an identifier of the reply and its task, and which app and version you used. Nothing else is sent: no screenshots, files, screen text or other messages. We use reports only to review Mermaid's replies, fix problems with them and keep Mermaid safe. Reports are linked to your account, only authorized members of our team can read them, and we do not share them. They are kept for 180 days and deleted with your account.
Live Screen, Take Over, files and clipboard
Your Mac's screen, your touches and typing in Take Over, files you send and clipboard contents travel directly between your phone and your Mac, encrypted end to end. When you are away from your local network they pass through Mermaid's relay, which forwards encrypted data it cannot read and does not record. Sending files works only when your phone and Mac are on the same network.
On your Mac and your phone
Mermaid for Mac keeps a log of each task on your Mac (your request, the steps taken and short text read from the screen) to help with problems. It stays on your Mac and is deleted after 7 days. Your recent tasks are part of the encrypted conversation history described below. Only if that encrypted memory is unavailable on a computer does Mermaid keep, for each paired phone, a short history of that phone's recent tasks (your request, how it ended and a short summary) without encryption instead, for up to 7 days; it stays on that computer and goes when you unpair that phone. On your iPhone, your sign-in is stored in the iOS Keychain. In Mermaid for Android, when it is available, your sign-in is encrypted with a key kept in the Android Keystore and is excluded from device backups and device-to-device transfer. Mermaid contains no advertising, analytics or crash-reporting software.
Memory and conversation history
Mermaid for Mac keeps a memory for your Mermaid account so it can continue your work, whichever of your phones you use. It holds things you tell Mermaid that are worth keeping (for example a preference), anything you ask it to remember, tasks it could not finish, and your conversation with Mermaid: your requests, its replies and short summaries of what it did. This memory stays on your Mac. It is encrypted, and its key is kept in your Mac's Keychain, where only Mermaid for Mac can use it. It is not stored on Mermaid's servers, and Mermaid does not copy it to your other Macs. When a task needs it, the relevant parts are sent with your request for AI processing, as described above.
- Shared by your phones. The phones you pair with your Mac under the same Mermaid account share one memory on that Mac. Another Mermaid account signed in on the same Mac cannot read it.
- Passwords and codes. Remembered items never include anything that looks like a password, a verification code, or a card, account or phone number. The only exception is your own phone number, if you ask Mermaid to remember it. Your conversation history keeps your requests and Mermaid's replies as they were, encrypted, so don't put passwords or codes in a request.
- Forgetting. You can ask Mermaid to forget something it remembered, or to forget everything. This does not remove your conversation history, which stays on your Mac until you remove it there.
- Signing out. When you sign out of Mermaid for Mac, its memory is locked until you sign in again.
- Removing it from a Mac. To delete Mermaid's memory and conversation history from a Mac, quit Mermaid. Then, in Finder, choose Go › Go to Folder, enter ~/Library/Application Support, and delete the MacAgent folder.
- Deleting your account. Deleting your Mermaid account deletes your information on our servers. It does not yet remove the memory and conversation history on your Macs: they stay there, encrypted and locked once Mermaid for Mac signs out. Remove them as described above.
- Backups. Mermaid excludes its memory from Time Machine backups. Local snapshots that macOS keeps on its own expire on macOS's schedule.
Mermaid for Windows
Mermaid for Windows handles your information as Mermaid for Mac does, with these differences.
- Your consent on the PC. Windows has no permission like the Mac's Screen Recording and Accessibility. Instead, Mermaid for Windows reads your screen and acts in your apps for a task only after you turn on computer control in Mermaid on that PC, and you can turn it off at any time.
- Your sign-in. Your sign-in and the PC's pairing keys are kept in Mermaid's folder in your Windows account's local app data (%LOCALAPPDATA%\Mermaid), protected by Windows for your Windows account: another Windows user, or a copy of the files on another PC, cannot read them.
- Memory and conversation history. Mermaid for Windows keeps the same encrypted memory and conversation history described in Memory and conversation history, in Mermaid's folder in your Windows account's local app data. Its key is protected by Windows for your Windows account, where a Mac keeps it in its Keychain. Other programs running under your Windows account could ask Windows to unlock that key, so this protection is weaker than the Mac Keychain's. As on a Mac, signing out locks the memory until you sign in again.
- The task log stays on your PC and is deleted after 7 days, as on a Mac.
- Removing it from a PC. Uninstalling Mermaid for Windows leaves its folder on your PC, including the encrypted memory, its key and your sign-in. To delete them, quit Mermaid, open File Explorer, enter %LOCALAPPDATA% in the address bar, and delete the Mermaid folder. Earlier copies can remain in Windows restore points or shadow copies, which Windows removes on its own schedule. As on a Mac, deleting your Mermaid account does not yet remove the memory and conversation history from your PC: remove them as described here.
- The Microsoft Store. If you install Mermaid for Windows from the Microsoft Store, Microsoft handles the download and installation under its own privacy statement, and gives us reports about installations and app reliability that Windows collects.
Who processes your information
| Provider | What for | Information |
|---|---|---|
| Supabase | Accounts, sign-in and the service database | Account, devices, usage records, purchase records, the beta list |
| Vercel | Hosting our website, including the beta form | The email address you enter, passing through (not stored), and technical logs |
| Fly.io | Hosting our AI service and relay | Requests passing through (not stored), encrypted relay traffic, technical logs |
| Our AI provider (a third-party company) | Processing the requests our AI service sends to carry out your tasks | Requests, screenshots, screen text and file contents a task needs |
| Our speech service (a third-party company) | Speech to text and text to speech | Voice audio and reply text |
| Resend | Sending one-time sign-in codes | Email address |
| RevenueCat | Managing App Store subscriptions, and Google Play subscriptions when Mermaid for Android offers them | Your account identifier and purchase records |
| Dodo Payments | Selling Mermaid for Mac and Mermaid for Windows subscriptions as our merchant of record: checkout, payments, taxes, invoices and managing your subscription | Your email address and account's internal ID, the payment and billing details you enter at checkout, and purchase records |
| Apple | Sign in with Apple, if you choose it, payments for subscriptions, and TestFlight invitations | Sign-in identifiers, name and email as Apple shares them, purchase records, and your email address if you join the beta |
| Microsoft | Distributing Mermaid for Windows through the Microsoft Store, if you install it from there | Your Store download and installation, under Microsoft's privacy statement, and the installation and app-reliability reports Windows collects |
| Sign-in, if you choose it; for Mermaid for Android when it is available, distribution through Google Play and payments for subscriptions | Sign-in identifiers, name, email and profile photo link as Google shares them, and purchase records |
We share information with these providers only to provide Mermaid, and only under terms that require them to protect it. Your information may be processed outside your country, including in South Korea (our database), Singapore (our AI service and relay), the United States and other countries where our providers operate.
How long we keep information
| Information | Kept |
|---|---|
| Account | Until you delete your account |
| Devices | Until you unpair or delete your account. A device unused for 180 days loses access from away from home, and its record is deleted 30 days after that. |
| Usage records | 2 to 35 days, depending on the record |
| Purchase and credit records (your plan, purchases and the AI usage charged to them) | While your account exists. After you delete it, kept for accounting and refunds. They still contain your account's internal ID (a random code) and the store's transaction identifiers (Apple, Google Play for Android purchases, or Dodo Payments for Mac and Windows purchases), but not your email address, name or sign-in. |
| Records of requests that reached a usage limit | 90 days, or until you delete your account |
| Reports of replies you send | 180 days, or until you delete your account |
| Security records of connection requests | 1 day |
| The beta list (your email address) | Until the iPhone app is available on the App Store, or sooner if you ask us to remove you. An address TestFlight does not accept: 7 days. Apple keeps your TestFlight tester record under its own terms until we remove it. |
| Codes used to limit beta signups | 1 day |
| Requests, screenshots and files sent for AI processing | Not stored by Mermaid |
| Task log on your Mac or PC | 7 days, on that computer only |
| Plain recent-task history for each paired phone, kept only when encrypted memory is unavailable on that computer | Up to 7 days, on that computer only, until you unpair that phone |
| Memory and conversation history on your Mac or PC | On that computer only, encrypted, until you remove it from that computer. What Mermaid remembered also goes when you ask it to forget (see Memory and conversation history) |
| Hosting providers' technical logs | For the limited period set by each provider |
Your choices and rights
- AI processing: allow or turn off in the app (Account › AI Processing).
- Permissions: microphone, camera, local network and Face ID can be turned off in iPhone Settings; Screen Recording, Accessibility and Automation in System Settings on your Mac; on a Windows PC, computer control in Mermaid on that PC. The permissions Mermaid for Android asks for, when it is available, can be turned off in Android Settings.
- Devices: unpair a Mac or PC in the app or on that computer.
- Memory: ask Mermaid to forget something or everything, or remove its memory and conversation history from a Mac (see Memory and conversation history).
- Delete your account: in the app, Account › your profile › Delete Account. See Delete your account for what is deleted. Deleting your account does not cancel an App Store subscription: cancel it with Apple first. Apple keeps its own purchase records under Apple's privacy policy. The same applies to a Google Play subscription, once Mermaid for Android offers them: cancel it in Google Play first. A Mermaid for Mac or Mermaid for Windows subscription bought through Dodo Payments is cancelled when you delete your account, without an automatic refund; Dodo Payments keeps its own records of your purchases under its privacy policy.
- Purchase history at RevenueCat: RevenueCat keeps the purchase history it holds under your account's internal ID after you delete your account. You can ask us to delete it by emailing support@addmermaid.com from your account's email address, before or after you delete your account. We find that history through your account, so after your account is deleted we may not be able to identify it. If we can identify it, we delete it at RevenueCat and tell you when it is done. If we cannot, we tell you.
- Requests: you can ask us for a copy of your information, to correct it, or to delete it, by writing to support@addmermaid.com. Depending on where you live, you may have further rights, including to object to or restrict processing and to complain to your data protection authority.
Security
Connections between your phone and your Mac or PC are authenticated and encrypted end to end, and connections to our services use TLS. App Lock, if you turn it on in Settings, requires Face ID to open Mermaid on your iPhone. In Mermaid for Android, when it is available, App Lock uses your phone's own biometric check: your biometric data stays with your phone's system, and Mermaid only learns whether the check passed.
Children
Mermaid is not directed to children under 13, and we do not knowingly collect information from them.
Changes
We will update this policy when Mermaid changes. If a change is significant, we will tell you in the app, and if it changes what is sent for AI processing, the app will ask for your permission again.
Contact
GODAAN SERVICE PRIVATE LIMITED · support@addmermaid.com