nav.links.legal
Privacy Policy
This Privacy Policy explains in simple terms how we handle personal data when you use m-pathy.
Last updated: 11 January 2026
1. Controller
The controller responsible for data processing in connection with m-pathy is: NAAL UG (limited liability) Maria-Theresia-Str. 11 81675 Munich, Germany E-mail: support@m-pathy.ai
2. Privacy by design
m-pathy follows privacy by design and by default. • Data is processed only when necessary • Processing scope and duration are minimised • No implicit user profiles are created Privacy is enforced architecturally, not situationally.
3. Categories of data
Depending on usage, the following categories of data may be involved: • account and contact data (if actively provided), • technical usage data (security and stability only), • payment data (processed by external providers), • user prompts and responses (technical processing only). Prompt content is not used for profiling, advertising, behavioural analysis, or training.
4. Local processing and storage
Prompt content is processed locally or transiently and is not permanently stored on servers in identifiable or reconstructable form.
5. Local archive and context injection
m-pathy allows users to store selected content locally in an archive. Users may explicitly select archived items and inject them into a new chat. • operates exclusively on local storage, • requires deliberate user action, • injected context is fully visible, • no automatic or implicit memory exists.
6. Verification and Triketon
When users verify content (e.g. news articles), m-pathy uses Triketon. • content is transmitted to the server solely for verification, • a cryptographic truth hash is computed, • a public verification key is generated or associated, • the original content is not stored, • only hash, public key, and minimal technical metadata are retained. Stored data does not allow reconstruction of the original content.
7. Prompt normalisation and drift prevention
Before execution, MAIOS 2.0 analyses prompts. If a prompt is structurally ambiguous, inconsistent, or drift-prone, the system may restructure the phrasing. • user intent is preserved, • only structure and safety clarity are adjusted, • no prompt is stored, • no learning or profiling occurs.
8. Local storage and devices
All user-generated content is stored exclusively in local storage on the user’s device. • local storage is persistent until deleted by the user, • deleting local storage results in irreversible data loss, • no server-side backups exist. Each device receives a distinct public key. Data is isolated per device.