Privacy Policy

The short version

• No accounts. You don’t sign up for anything to use Mischi.
• No telemetry. The app sends no analytics, usage data or crash reports, to us or anyone else.
• Local storage. Pets, settings, reminders and notes are stored on your Mac. Content used by optional AI features may be sent to Groq as explained below.
• AI is optional. Only if you add your own Groq API key does the app contact Groq, directly from your Mac. We are never in the middle.
• Website data. The website processes connection information and information you choose to send through the newsletter or contact form. Optional usage analytics run only after you allow them. Contact drafts and privacy choices are saved in your browser.
• No sale or advertising use. We do not sell personal data or share it for targeted advertising.

Who we are

Mischi is an independent project operated by ARJUN NV (@ajjuism), based in Kerala, India (we, us). Mischi is a project name, not an incorporated company. ARJUN NV is responsible for deciding how the personal data described in this policy is used (the data controller, where that term applies). For privacy questions, requests or grievances, use the contact page or email hello@kuud.in.

The Mischi app

What stays on your Mac

Mischi stores the following locally. The app does not upload these files to us, although optional AI features can send relevant content directly to Groq:

• Pets you import, copied into ~/Library/Application Support/mischi/Pets. Your original files are never changed.
• Your settings, reminders, animation names, chat lines and pet characters, in Mischi’s standard macOS preferences.
• Notes you ask Mischi to remember, in ~/Library/Application Support/Standalone Codex Pets/notes.json.
• Your Groq API key, if you add one, in the macOS Keychain.
• Screenshots you ask for, saved to your clipboard or your Desktop.

Ask Mischi doesn’t save a conversation history in the app: each question is handled on its own. This does not determine how Groq handles requests sent to its service. The docs explain how to remove Mischi’s local data. Copies you make or retain in device backups are controlled by you and your backup provider.

Network access

From version 0.9.12, Mischi requests a small release file from mischi.app over HTTPS to check for updates. Automatic checks are enabled by default and run daily while the app is open; failed checks may retry after an hour. You can disable automatic checks in Preferences → About or check manually at any time. The request includes no pets, notes, settings, API keys, account identifiers or installed-version query parameters. Like any website request, it exposes your IP address and standard connection metadata to our hosting provider and may appear in its server logs. The update endpoint does not run website analytics or use cookies.

Earlier versions do not check for updates. With automatic checks disabled and no manual check or AI feature in use, the base pet experience works offline. Mischi has no analytics, advertising or crash-reporting code. macOS itself may collect diagnostics according to your Apple settings and policies.

macOS permissions

Mischi asks for these only when you first use the feature that needs them, and works without them:

• Microphone, for voice mode in Ask Mischi.
• Screen Recording, for Ask Mischi’s screenshot tool.

You can turn either off at any time in System Settings → Privacy & Security.

AI features and Groq

If you add a Groq API key, Mischi sends requests straight from your Mac to Groq, over an encrypted connection, only when you use an AI feature:

• Ask Mischi: your question, your pet’s character, and the results of any tools used to answer it. For example, if you ask about your clipboard, its text is included; if you ask about your notes, the matching notes are included. Screenshots are not sent.
• Voice mode: your recording, for transcription. The audio file is deleted from your Mac once it’s been transcribed.
• Generated chatter and Enhance: your pet’s character description and animation names.
• Model list and connection test: a request made with your key, containing no personal content.

Groq handles these requests under its own privacy policy, terms and your account settings. They do not pass through our servers. Groq’s retention and processing practices are separate from the app’s local storage; deleting data on your Mac does not delete copies held by Groq. Avoid including passwords, sensitive information or other people’s personal data in AI requests. If you ask Mischi to search the web or open a website, it hands off to your default browser, and that site’s own policies apply.

This website

Browsing and downloads

Our website code does not set advertising cookies or use advertising trackers. Fonts, images and videos are served from our own domain. Our hosting provider, Vercel, processes connection information such as IP address, browser information, request time and the pages or files requested, including app downloads and release checks. This information may appear in hosting and security logs used to deliver the service, diagnose problems and prevent abuse. See Vercel’s privacy policy.

Usage analytics and your choice

PostHog helps us understand use of the website, such as visits, downloads, docs usage and successful form submissions. It is optional: we do not initialise PostHog or send analytics events before you choose Allow analytics. Choosing No thanks, ignoring the prompt or withdrawing consent leaves analytics off without affecting downloads or use of the website. You can change your choice at any time using Privacy settings in the footer or here.

• Memory-only identifiers. The analytics integration keeps temporary identifiers in memory rather than saving them in cookies or browser storage. These identifiers can associate events during a visit. Person profiles and session recording are disabled.
• Usage and technical information. Events can include page paths, browser and device details, temporary identifiers, link categories, docs results opened, contact-topic categories and form-success events. We remove full page URLs, referring URLs, query strings, campaign properties and person-property fields from outgoing events. Analytics requests still expose connection information, including IP addresses, to the hosting and analytics providers. IP addresses may be used to derive approximate location.
• Limited event content. We do not include contact-form names, email addresses or message contents, newsletter email addresses, or the text you type into docs search in our analytics events. Automatic capture of form interactions is disabled.
• Browser privacy signals. If your browser exposes an enabled Do Not Track or Global Privacy Control signal to the website, we do not initialise PostHog or send website analytics events.

Events are sent through our own domain to PostHog for processing on our behalf. Using memory-only identifiers does not make all event or connection information anonymous. See PostHog’s privacy policy. Our own analytics configuration does not control the separate hosting and security logs described above.

We store your analytics choice, the choice version and its date in your browser’s local storage. A choice is valid for up to 180 days, after which analytics require a new opt-in. PostHog may also store a consent flag in local storage; this is a preference, not a persistent visitor identifier. Clearing site data removes these preferences. If storage is unavailable, your choice applies only to the current page session. Withdrawing consent stops new analytics capture and requests. We do not automatically retry failed analytics requests. Withdrawal cannot recall a request already in flight or erase events already received by the provider.

Download acknowledgement

The website download form asks you to agree to the Terms of Use and acknowledge this Privacy Policy. It sends that acknowledgement and the document versions to our server to start the download. We do not maintain a separate acceptance database or ask for your name or email to download the app. This acknowledgement does not give consent to analytics, subscribe you to the newsletter or waive your privacy rights. Standard hosting and security logs may still record the request.

Contacting us

When you submit the contact form, our server processes your email address and the details you provide, such as your name, topic, subject, message, links, and Mischi or macOS version. When email delivery is configured, our server sends this information through Resend to our inbox. The website does not maintain a separate message database, but our email providers process and may retain messages and delivery records. See Resend’s privacy policy. Your email address and a message are required to use the form; other details are optional.

The contact page saves an unsent draft, including any name and email you have entered, in your browser’s local storage so you can return to it. Saving a draft does not send its contents to us. The saved draft is removed after a successful form submission, when you choose Start fresh, or when you clear the site’s browser data. Opening your email app or copying the fallback message does not automatically clear that draft.

We use messages to respond to enquiries, provide support, investigate reported issues and improve Mischi. Sending a message does not subscribe you to the newsletter. You can also email us directly at hello@kuud.in.

The newsletter

Subscribing is optional, and nothing else on the site or in the app requires it.

• What we collect: the email address you enter and a label identifying the signup form. Newsletter providers may also maintain subscription status, consent and delivery records. The signup form does not ask for your name.
• Why: to send you news about new versions and occasional updates about Mischi.
• Who processes it: Kit (ConvertKit), and a private Google Sheet if our optional list backup is enabled. See Kit’s privacy policy and Google’s privacy policy.
• Unsubscribing: use the unsubscribe link in a newsletter email or contact us to stop receiving newsletters. You can also request deletion of your subscription data. Limited records may be retained to honour your opt-out or meet legal obligations.

Preventing repeated submissions

The contact and newsletter endpoints use IP addresses in server memory to limit repeated submissions. Inactive rate-limit records are scheduled for removal about one minute after the last newsletter attempt or ten minutes after the last contact-form attempt. These rate-limit records are not added to your newsletter subscription or contact email. Separate hosting and security logs may retain connection information as described above.

Legal bases

Where the EU or UK GDPR applies to our processing, the relevant legal bases are:

• Consent for the newsletter and optional website analytics. Withdraw newsletter consent by unsubscribing and analytics consent through Privacy settings.
• Legitimate interests in operating and securing the website, preventing abuse, responding to enquiries and investigating support issues, subject to your rights and interests.
• Contract where processing is necessary to provide a download you request under the Terms of Use.
• Legal obligations where we need to comply with applicable law, including responding to valid privacy requests.

Newsletter signup and contact-form submission are voluntary. Without an email address, we cannot deliver newsletters or reply by email. Neither is required to download or use the base app. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

Who we share data with

We use hosting, analytics, newsletter, email-delivery and email-inbox providers for the purposes described above. The integrations include Vercel, PostHog, Kit, Resend and, when enabled, Google Sheets. These providers may use their own subprocessors to deliver their services. We do not sell personal data or share it for cross-context behavioural advertising. We may also disclose information where required by law or where lawfully necessary to prevent abuse or establish, exercise or defend legal claims.

We are based in India, and our service providers may process data in the United States, the European Economic Area and other countries. The location depends on the service and its configuration. Where applicable law requires safeguards for an international transfer, those requirements apply to our use of the provider. You can contact us for information about the providers, processing locations and transfer arrangements relevant to your data.

How long we keep data

Retention depends on why the information is needed, the service involved and any legal obligations. We keep personal data only for as long as needed for those purposes. The criteria we use are:

• Newsletter: while you remain subscribed, with limited records afterwards where needed to record consent, respect an unsubscribe request or comply with law. Unsubscribing stops newsletters; it does not necessarily erase every provider record or backup immediately.
• Support correspondence: for handling the enquiry and related follow-up, and where necessary to investigate an unresolved issue or meet legal obligations.
• Hosting and security logs: according to the provider’s applicable retention settings and any need to investigate security incidents.
• Analytics: we use event history to compare website usage and evaluate improvements over time. Our current PostHog plan provides a one-year reporting window. This limits which events are available in reports; it is not a guarantee that older events are deleted. Deletion is handled separately through the provider’s deletion processes, subject to the ability to locate the relevant records and any applicable legal exceptions. See PostHog’s event-retention explanation. You can contact us about retention or deletion of your data.
• Contact drafts and app data: on your device until removed as described above. Device backups may retain separate copies.
• Analytics choices: we rely on a stored choice for up to 180 days. Stored preference records remain in your browser until replaced or cleared; an expired choice does not permit analytics.

Deletion requests are subject to applicable legal exceptions. Providers may retain limited backup, security or compliance records under their own retention arrangements. Contact us for details about a particular record or service.

Your rights

Depending on the law that applies to you and our processing, you may have rights to access, correct or delete personal data, receive a portable copy, restrict or object to processing, and withdraw consent. These rights have conditions and exceptions; not every right applies to every situation or jurisdiction. We do not discriminate against you for exercising applicable privacy rights.

To make a privacy request or raise a concern, contact hello@kuud.in. We may ask for information reasonably needed to verify your identity and locate the relevant records. We will respond in accordance with applicable law, including any required response period and permitted extensions.

Where applicable law provides this right, you may lodge a complaint with the competent data protection authority. For the EEA, see the list of supervisory authorities; in the UK, see the Information Commissioner’s Office. Contacting us does not limit that right.

You can remove local app data using the uninstall instructions. We cannot access or remotely delete data stored only on your Mac. Requests about data held by Groq under your own account should also be directed to Groq.

Security

We use safeguards appropriate to the information we handle, including HTTPS for the public website and encrypted connections for requests to Groq. The app stores your Groq API key in the macOS Keychain. These measures reduce risk but cannot guarantee absolute security. To report a security concern, email hello@kuud.in. This statement does not limit our obligations under applicable data protection law.

Children

The newsletter and contact service are not directed at children under 13. Where local law requires a higher age or parental authorisation for a particular use of personal data, those requirements also apply. We do not knowingly collect children’s personal data through these services without any authorisation required by law. If you believe a child has provided personal data that we should not hold, contact hello@kuud.in so we can investigate and take appropriate action, including deletion where required.

Changes to this policy

We may update this policy to reflect changes in the app, website or applicable requirements. The date at the top identifies the latest revision. Where required by law, we will provide additional notice of material changes and obtain consent before using personal data for a new purpose that requires it.

Contact

Questions about privacy, or want your data removed? Use the contact page or email hello@kuud.in.