Privacy Policy

1. The short version

• Mellow is local-first. Your drink log, your estimates and your check-ins are stored on your device.
• A photo is sent to an AI model only when you choose to use photo recognition, and only after you consent to it.
• Mellow's servers do not keep your photos. Recognition evidence — not the image — may be recorded for accounts that are signed in.
• Mellow is a drinking companion. It is not a medical device, not a breathalyzer, and not a safe-to-drive determination.

2. What Mellow collects

2.1 Data you create (stored on your device)

Mellow keeps your session data in your device's local database. Based on the app's data model, this includes:

• Drink log entries — what you logged, when, and how much
• The inputs you give for estimates (for example body and timing inputs)
• Your night-state readings and estimate ranges
• Subjective check-ins — how you said you felt
• Any manual breathalyzer readings you enter
• Night sessions and their timeline
• Your Drinking Style reading and any personal model documents built from your nights
• A random anonymous identifier generated on your device

This data is stored locally under Mellow's own database on your device. It is not uploaded for storage as part of normal use.

2.2 Photos

When you use photo recognition, the photo you take is processed to identify drinks. See section 3 for exactly what leaves your device.

2.3 Usage events

Mellow records behavioural usage events — for example that a check-in was opened, a photo was confirmed, or local data was deleted. Based on the current implementation these events are dispatched inside your browser or app only and are not transmitted to a server. The event payload is limited to a name, your anonymous identifier, a session ordinal, a coarse bucket for observation counts, app version, platform and a timestamp.

Mellow's own configuration carries an explicit instruction that analytics must never be configured to transmit night-state or subjective-state data.

TODO If a third-party analytics adapter is enabled in a future release, this section must be updated before that release ships.

3. Photos and AI processing

This is the part of Mellow that leaves your device, so it is described in detail.

3.1 When a photo is sent

Photo recognition is optional. It only happens when you actively use it. Before a photo is dispatched, the app sends an explicit photo-consent marker with the request; a request without that marker is rejected by the server.

3.2 Where it goes

The recognition path is:

1. Your photo is sent from the app to a Mellow API route over an encrypted connection.
2. Mellow's route forwards the image to OpenRouter, an AI model gateway.
3. OpenRouter routes the request to a pinned provider, Alibaba Cloud, running a Qwen vision-language model. Fallback to other providers is disabled for this request.
4. The model returns text — visual observations and any printed text it could read (for example a brand name or an ABV figure printed on a label). It does not return an image.

3.3 What Mellow asks the provider to do with it

The outgoing request sets a data-collection directive of deny, instructing the gateway not to permit the provider to use the request data for its own purposes.

TODO We have not yet independently confirmed how OpenRouter and Alibaba Cloud interpret and enforce that directive under their current published terms, or how long they retain request data on their side. This must be confirmed, and this section updated with a direct citation, before publishing.

3.4 What Mellow does with the photo

• Mellow's server does not write your photo to disk or to any database.
• The image is held in memory only for the duration of the request, and the in-memory buffer is explicitly zeroed once the request finishes.
• Mellow's own recognition endpoint states, in its response metadata, that Mellow does not store photos and that provider processing follows the provider's own policy.

TODO Mellow also maintains a short-lived recognition cache (perceptual reuse, configured with a default 30-day time-to-live). We need to confirm whether that cache stores any image-derived data, where it lives, and whether it is shared between accounts, then describe it here. It is not described above because it has not been confirmed.

3.5 Photos and limits

For reliability, recognition requests are size- and rate-limited (an image size ceiling, a short per-minute and per-account allowance, and daily cost guardrails). These limits exist to prevent runaway cost and abuse; they do not change what is collected.

4. Third-party processors

TODO The final production hosting provider for the app and this website must be confirmed and listed here.

5. Server-side records

Some Mellow builds create an account record on Mellow's servers. Where that applies, the following categories of record exist server-side. All of them are linked to your account record and are configured to be removed when that account record is deleted.

Note that recognition evidence is text derived from your photo — for example a drink name or a printed alcohol percentage. It is not the photo, but it is information about what was in the photo, and it is treated as your data.

6. How long data is kept

• On your device: until you delete it in the app, or clear the app's storage. Mellow does not expire it for you.
• Your photos: not retained by Mellow's servers.
• Server-side account records: TODO an explicit retention period is not yet defined in Mellow's configuration and must be set and stated here before publishing.

7. Your choices

• Photo recognition is optional. You can log drinks without it.
• You confirm what was recognised. Mellow presents candidates and you choose or correct them.
• You can delete your local data at any time from within the app.
• You can contact us at support@mellow.example to ask what is held about you or to ask for deletion.

Depending on where you live, you may have statutory rights to access, correct, export or delete your personal data, or to object to certain processing. We will honour those requests. To make one, contact us at the address above.

8. Deleting your data

Mellow currently provides an in-app action that deletes your local data from your device. For the full picture, including what is not yet automated, see Delete your account and your data.

9. Children

Mellow is intended for adults of legal drinking age in their jurisdiction. It is not directed at children, and we do not knowingly collect data from anyone below that age.

TODO The exact minimum age to state here must be confirmed against the App Store age rating and the jurisdiction of the operating entity.

10. Security

Data in transit between the app and Mellow's servers is encrypted. Local data is protected by your device's own security. No system is perfectly secure, and Mellow does not claim otherwise.

11. Changes to this policy

If this policy changes in a way that affects what is collected or how it is used, we will update the date at the top of this page and, where the change is significant, tell you in the app.

12. Contact

Questions about this policy, or about your data: support@mellow.example

TODO The operating entity's registered name and contact address must be confirmed and stated here.