Privacy Policy

1. The short version

Mori is built to keep your information on your phone. We do not run advertising, we do not sell your data, and we do not track you across other apps or websites.

This policy explains exactly what is stored, where, why and for how long, who else handles it, and how you control it.

This policy is a draft for legal review. [Draft for legal review]

2. Who is responsible for your information

Lycoris Labs Inc, [Registered address, Dubai, UAE], is the controller of personal data processed through Mori ("Mori", "we", "us"). You can contact us about privacy at [email protected]. [Draft for legal review: name a Data Protection Officer or privacy contact if one is required.]

This policy covers the Mori mobile apps, the Mori web app and the Mori website (together, the "Service"). It works with our Terms of Service.

3. What stays on your device

In the current version Mori has no account and no cloud copy of your pet data. These items are stored on your own phone or browser (in the app's local storage and its own files):

Your profile and settings: your name if you enter it, your emirate and area, language, units (metric or imperial), reminder settings, and your choices about saving conversations and theme.

Your pets: names, kind (dog, cat, bird, falcon, other), breed, sex, birthday or age, allergies, weight, diet, microchip or vet details if you add them, and the photo you choose.

Your care data: tasks and routines, completed or skipped history, health records (vaccines, medicines, vet visits, with the doses you type), and weights.

Your activity in Mori: saved places, places you contacted through Mori's call and message buttons, conversations with Maggy (if saving is on), reports you made about answers, and your consent records (which version of the Terms and Privacy Policy you accepted, when, and your device's language and a short device description).

We cannot see this data. It is not sent to us. If you lose or reset your phone, or delete the app, it may be lost, because we do not hold a copy. Use Export my data to keep a copy.

4. Maggy and AI processing

When you send a message to Maggy and the answer service is switched on, the following is sent over an encrypted connection to our backend and then to an AI model provider so an answer can be written: your message; a small set of details about your selected pet (name, kind, breed, sex, age, weight, allergies, diet and meals or walks per day); a short recent history of the conversation; and your language.

Our AI model provider is Anthropic, PBC, which processes these inputs on our behalf to produce answers. We ask providers not to use this content to train their models. [Draft for legal review: confirm the contract terms, data location and training restrictions with the provider.]

Some of Maggy's work happens on your device without sending anything: finding places in the built-in directory, showing emergency clinics, answering from our checked UAE rules notes, and checking your message against our safety rules.

Our safety checks look for attempts to misuse the assistant, for emergencies and for requests that Maggy cannot help with. When a message is blocked as unsafe or abusive, we record only a category and a short one-way fingerprint for abuse prevention and we do not keep the text of the blocked message. These records are deleted after 30 days.

Please do not put sensitive information in a message to Maggy, such as passwords, one-time codes, card or bank details, identity, passport or Emirates ID numbers, other people's private details or health information about people. Maggy does not need it, and we may block or discard messages that appear to contain it. [Draft for legal review: confirm once sensitive-information screening is released.]

When the answer service is used, answered messages and the answers can be stored in our backend so a conversation can continue. They are tied to a random account identifier, not to your name. We keep them for as long as the conversation exists or until you delete it, and we plan to delete conversations that have not been used for [12] months. [Draft for legal review: confirm retention period.] Your "Save conversations" setting controls whether conversations are kept on your own device.

We also keep a small per-day counter of how many messages were sent and blocked from your account to enforce fair-use limits. The counter does not contain message text.

Maggy's answers are generated by AI, may be wrong, and are not made by a person about you. We do not use them to make decisions that have legal or similarly significant effects on you.

5. Location

Mori does not track your location. You choose an emirate and area by hand. If you tap Use my current location in Discover, your phone asks for permission and Mori reads your approximate position once, only while the app is open, and uses it on your device to work out distances to places.

Your position is not sent to us, not sent to any AI provider, and not stored after you close the app or choose to use your area instead. You can turn the permission off at any time in your phone's settings.

When you tap Directions, your chosen place's name and address (or its map position) is handed to the maps app you pick (for example Apple Maps or Google Maps), which then has its own privacy practices.

6. Photos and camera

If you choose a photo for your pet, Mori asks permission to use your photo library or camera at that moment. Mori reads only the picture you choose. A copy is kept in the app's own storage on your device and is used only to show your pet in the app. It is not uploaded unless a future feature clearly tells you so and asks you first. You can change or remove the photo, or erase everything, at any time.

7. Notifications

Reminders are scheduled locally on your device. Mori asks for notification permission only when you choose to turn reminders on. Reminder text can contain your pet's name and the task title, but never a medicine dose. We do not send marketing notifications.

8. The directory and where its data comes from

The directory of places is not personal data about you. It is built from public sources: businesses' own websites, government and tourism authority pages, insurers' published vet lists, published guides and directories, and OpenStreetMap. Each place shows its sources and the date we checked.

Places are marked Unverified unless the business has confirmed its details to us. Map positions and some details are from OpenStreetMap, © OpenStreetMap contributors, available under the Open Database Licence (ODbL).

If you contact a place using Mori's call, WhatsApp or email buttons, your phone opens the relevant app with a prefilled message. The message may mention your pet's name and kind. That conversation is between you and the place and is governed by the place's and the app's privacy practices. Mori keeps only a note on your device that you contacted that place.

9. Backend and processors

Some features use a backend hosted on Supabase (database, authentication and server functions), in a region of [region, to be confirmed]. Its infrastructure may be provided by third-party cloud providers. The backend currently holds the directory and, when the answer service is enabled, conversation, safety and consent records as described above. [Draft for legal review: confirm which user data is stored in the backend at launch, and the hosting region.]

We use service providers that process data for us, such as hosting and AI model providers (section 4). We give them only what they need and require them to protect it. We do not sell personal data and we do not share it for advertising.

Your information may be processed outside the UAE where our providers operate. Where we transfer personal data outside the UAE, we do so in line with UAE law, for example to countries or providers with adequate protections or under contractual safeguards. [Draft for legal review: counsel to confirm the transfer mechanism.]

10. Advertising, analytics and tracking

Mori contains no advertising and no third-party analytics or tracking tools today. We do not build advertising profiles. We do not use cookies on the website for tracking.

If we ever add analytics, crash reporting that includes personal data, or anything else that collects usage information, we will say so here, keep it minimal, and ask for your permission first where the law or the app stores require it.

11. The website

The Mori website does not use advertising or tracking cookies and does not load third-party analytics. It stores a small note in your browser (localStorage) to remember that you dismissed a prompt, and your light or dark theme choice. If you join the waitlist, the email address you enter is used only to tell you when Mori launches. [Draft for legal review: describe the waitlist provider, storage and retention once the waitlist backend is chosen.]

12. Why we use information and our legal bases

We use information to provide the Service you asked for (your reminders, records, directory and Maggy), to keep it safe and prevent abuse, to improve and fix it, to meet our legal obligations, and to answer you when you contact us.

Under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), the main bases we rely on are your consent (for example, location, photos, notifications and accepting these documents, which you can withdraw), what is necessary to provide the Service you requested, our legitimate interests in safety, security and improvement where these are not overridden by your rights, and legal obligations. [Draft for legal review: counsel to confirm which bases apply to each activity and whether any other law, such as the laws of other jurisdictions where users are located, applies.]

13. How long we keep information

On your device: until you delete it or the app, or use Erase everything. Reminders are cancelled when you erase.

In the backend (when enabled): conversation text for the life of the conversation or until you delete it, subject to the inactivity period in section 4; fair-use counters for a short period; blocked-message fingerprints for 30 days; consent records for as long as needed to show that you accepted a version (these are append-only so we can prove acceptance).

We may keep limited information for longer when the law requires it or to protect legal rights, and in routine backups for a short period before they are overwritten.

14. Your rights and how to use them

Subject to UAE law (and, where it applies to you, other laws such as the GDPR), you have the right to: know what we hold and how we use it; get a copy; have inaccurate information corrected; have information erased; restrict or object to some uses; withdraw consent at any time (this does not affect what was done before); and receive your data in a portable format. You can also object to automated decision-making.

In the app: use Settings > Privacy and data > Export my data to get a file of everything Mori holds on your device. Use Erase everything to delete it all from your device immediately. You can edit or delete pets, tasks, records, conversations and saved places at any time. You can turn off conversation saving.

By email: contact [email protected]. We may need to confirm it is you, and we will reply within the time the law requires (and within 30 days where the law does not say otherwise). We may decline a request where the law allows, and we will tell you why.

Complaints: please contact us first. You also have the right to complain to the UAE Data Office or the data protection authority that applies to you. [Draft for legal review: counsel to confirm the supervisory authority and contact details.]

15. Children

Mori is not directed at children under 16, and you must be at least 16 to use it unless a parent or guardian agrees to our Terms for you. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us and we will help to remove it. Parents and guardians can use Erase everything on the child's device.

16. Security

We take reasonable technical and organisational steps to protect information: encrypted connections for anything that leaves your device, access controls and row-level security on backend data, limits on what servers can see, input and output screening for Maggy, secrets kept out of the apps, and keeping software up to date. Data on your device is protected by your phone's own security, so please use a passcode and keep your phone updated.

No system is completely secure. If a breach affects your personal data in a way that the law says we must tell you about, we will notify you and the regulator as required, without undue delay.

17. Changes to this policy

We may update this policy. We will change the version and date, and where the change is important we will ask you to review and accept the new version. The latest version is always in the app (Settings) and at the web address shown in the consent screen.

18. Contact

Lycoris Labs Inc, [Registered address, Dubai, UAE]. Email: [email protected].