Privacy policy

Last updated: October 2026

This is a translation for convenience. The German version (Datenschutzerklärung) is legally binding.

This privacy policy applies to the website heymalu.app and to the app “Malu”, which is currently in a closed beta and provided via Apple TestFlight.

1. Controller

2. Website

Hosting and server log files

When you visit the website, our server processes technically necessary data (IP address, date and time, page requested, browser type). This serves the secure and stable operation of the website (Art. 6(1)(f) GDPR). Log files are deleted as soon as they are no longer needed for this purpose.

No cookies, no tracking

The website sets no tracking or marketing cookies and uses no analytics services. Fonts are loaded locally from our server; there is no connection to Google Fonts or other third parties.

Contact by email

If you write to us, we process your details to answer your request (Art. 6(1)(b) or (f) GDPR) and delete them as soon as they are no longer needed.

3. The “Malu” app

Beta test via Apple TestFlight

To take part in the beta test, you use Apple TestFlight. Apple provides us with your name and email address (if you were invited by email) as well as feedback you send voluntarily, crash reports and usage statistics of the test version. Apple is responsible for TestFlight itself; Apple’s privacy policy applies.

User account

To use the app, you create an account with an email address and password, or sign in with “Sign in with Apple” or Google. For this we store your email address, an encrypted form of your password or the identifier of the sign-in service, and your app settings (Art. 6(1)(b) GDPR).

Your entries and health data

Malu processes information you provide yourself – such as ratings of mood, sleep or tension, chat messages, goals, and information about people, places and activities that matter to you. This data may allow conclusions about your health and therefore belongs to the special categories of personal data. We process it solely on the basis of your explicit consent (Art. 9(2)(a), Art. 6(1)(a) GDPR) in order to provide you with the app’s features.

Apple Health

If you agree, Malu reads selected data from Apple Health (e.g. sleep, steps, activity). You decide in iOS which data types Malu may read and can change this at any time in your iPhone’s settings. Data from Apple Health is not used for advertising and is not sold to third parties.

Location

If you agree, Malu processes your location, e.g. to determine the time you spend at home. For weather information, our server determines the nearest weather station; only the station’s identifier – not your location – is sent to the weather service Bright Sky (data from the German Weather Service, DWD). You can withdraw location access at any time in the iOS settings.

Voice input and voice output

Voice input is converted into text by your device’s speech recognition. If you use voice output, Malu’s reply text is sent to a speech synthesis service (see section 4).

AI responses

So that Malu can reply, your chat messages and the necessary context from your entries are sent to an AI service (see section 4). You are always talking to an AI, not to a human.

Improving and training the AI

We want to keep improving Malu. To do so, we use your chat messages, entries and Malu’s replies to further develop Malu’s AI features and to train and evaluate AI models. Because this data may allow conclusions about your health, we only do this with your explicit consent (Art. 9(2)(a), Art. 6(1)(a) GDPR). Consent is voluntary; you can also use Malu without it. You can withdraw it at any time with effect for the future; from that point on, we will no longer use your data for training.

Push notifications

If you allow notifications, we store a device token in order to send you reminders. You can turn off notifications at any time in the iOS settings.

Technical logs

For troubleshooting and secure operation, the app and server log technical events (e.g. error messages, timestamps, device and app version). These logs contain no chat content (Art. 6(1)(f) GDPR).

4. Recipients and processors

We use the following service providers, with whom data processing agreements are in place or who act as independent controllers:

• Hetzner Online GmbH, Germany – hosting of servers and databases (located in Germany).
• Microsoft Ireland Operations Ltd. (Azure OpenAI Service, Azure Speech) – generating AI responses and voice output; processing in data centres in the EU.
• ElevenLabs Inc., USA – voice output (when you use voice output).
• Google Ireland Ltd. (Firebase Cloud Messaging; Google sign-in) – delivery of push notifications; sign-in with Google, if chosen.
• Amazon Web Services EMEA SARL – technical logs and sending system emails.
• Apple Distribution International Ltd. – TestFlight, “Sign in with Apple”, Apple Health and push service.
• Bright Sky (brightsky.dev) – retrieval of public weather data using a station identifier, without personal data.

5. Transfers to third countries

Some of the providers listed, or their parent companies, are based in the USA. Transfers take place on the basis of the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission), where the provider is certified, and additionally on the basis of EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

6. Storage period and deletion

We store your data for as long as you use your account. You can delete your account at any time in the app under Settings; your personal data will then be deleted unless statutory retention obligations apply. After the beta phase ends, we will let you know how things continue.

7. Data security

We protect your data with appropriate technical and organisational measures, including encrypted transmission (TLS), access restrictions and servers in Germany. However, no system can guarantee complete protection against all risks.

8. Minimum age

Malu is intended for people aged 18 and over. If we learn that an account was created by a younger person, we will delete it together with the associated data.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). Simply write to us at support@heymalu.app.

You also have the right to lodge a complaint with a data protection supervisory authority, for example in the member state where you live. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

10. No automated decision-making

Malu makes no decisions about you with legal effect within the meaning of Art. 22 GDPR. The app’s hints and suggestions are non-binding.

11. Changes

We update this privacy policy when the app or legal requirements change. We will inform you of significant changes in the app or by email. The version published here applies.

12. Important note

Malu is a digital companion for your mental well-being. Malu makes no diagnoses, makes no treatment decisions and is not an emergency service. If you are in acute distress in Germany: Telefonseelsorge 0800 111 0 111 (free, around the clock), medical on-call service 116 117, in an emergency 112.

Information about the provider can be found in the legal notice.