Privacy Policy

Effective date: July 14, 2026

This Privacy Policy explains what personal information Mala collects, how we use it, and the controls you have when using our website and mobile application.

Who we are

Mala is a digital wellness product focused on guided counting and routine support. For privacy requests, you can contact us at any time using the email address at the bottom of this page.

Information we collect

We collect the information you provide to create and use a Mala account, including your name, email address, authentication provider and account identifier. If you use Sign in with Apple, Apple may provide a private relay email address instead of your personal email address.

Mala also stores the wellness and practice preferences you choose during onboarding, including your meditation intention, preferred daily practice length and self-described stress level. We store practice records such as session time, bead and round counts, completed or reset sessions, app preferences and related timestamps so your history and settings can sync across devices. These are wellness preferences, not medical records, and Mala does not read from or write to Apple Health or HealthKit.

When you subscribe, we receive the product, store, transaction identifiers, entitlement status, renewal or expiry information and limited account-linking information needed to unlock and restore access. Apple, Google or Stripe processes the payment details; Mala does not receive your full card or store-account payment credentials.

If you contact us, join a waitlist or request updates, we collect the email address and message or form details you submit. We may also receive IP address, an app-specific installation identifier, app or browser version, device and operating-system details, crash reports and performance diagnostics needed to secure and maintain the service.

How we use your information

We use personal information to provide the service, maintain account and waitlist records, communicate requested updates, personalize the practice you request, sync practice history and preferences, verify and restore purchases, respond to support messages, secure the platform, detect abuse, diagnose failures and improve reliability. We do not use health or wellness selections for advertising.

Legal bases for processing

Where required by law, we process data based on one or more legal grounds: your consent, performance of a contract (for requested services), compliance with legal obligations, and our legitimate interests in security, analytics, and product operations.

Sharing and disclosures

We do not sell personal information and do not use it to track you across apps or websites owned by other companies. We disclose only the information needed to service providers that operate Mala: Supabase for authentication, database and backend infrastructure; Vercel for website hosting; Sentry for app crash and performance diagnostics; Resend for requested email and support communications; and Apple, Google or Stripe for billing and subscription processing. These providers process data under their own terms and privacy commitments. We may also disclose information when required by law or needed to protect users, Mala or the public.

International transfers

Your information may be processed in countries other than your own. When required, we apply contractual and organizational safeguards designed to protect transferred personal information.

Retention

We keep account, preference and practice data while your account is active. When you delete your account, we delete or de-identify account-linked profile, preference and session data, subject to short operational backups and records we must retain for legal, accounting, fraud-prevention or store-transaction obligations. Support, waitlist and marketing records are kept only as long as needed for the request or until you unsubscribe. Crash and security logs are retained for a limited period appropriate to investigation and reliability needs.

Security

We use administrative, technical, and organizational controls to protect personal information. No system is fully secure, but we continuously improve safeguards and incident response procedures.

Your privacy rights

Subject to local law, you may request access, correction, deletion, portability, or restriction of your personal information, and you may object to certain processing. You may also withdraw consent where processing is based on consent. You can correct your display name in Profile and initiate account deletion from Settings in the mobile app. Deleting a Mala account does not cancel an App Store or Google Play subscription; subscriptions must be managed in the applicable store settings.

Children's privacy

Mala is not intended for children under 13 years of age. If you believe a child has provided personal information, contact us and we will take appropriate action.

Policy updates

We may update this policy periodically. When we make material changes, we will update the effective date and, where appropriate, provide additional notice.

Contact

For privacy requests, email privacy@malaspace.com.