Privacy policy

Last updated: 1 November 2026

This policy explains how Merdi collects, uses, stores, and shares information when you use our website at merdi.ai and our language-learning app, including app.merdi.ai.

Information we collect

• Account information. When you register or sign in, we receive your email address, an account identifier, and authentication information. Depending on your sign-in method, we may also receive your name and profile picture. Email passwords are handled by our authentication provider, Supabase.
• Conversations and learning preferences. We store messages you send, AI replies, translations and learning tips, your selected language friend and learning level, and settings such as favourites, archived status, and read status.
• Service and device information. Merdi and its hosting providers process technical information such as IP addresses, browser or device information, request times, errors, and usage counts to deliver and protect the service.

Signing in with Google

If you choose Google sign-in, Google shares basic account information with Merdi through Supabase: your Google account identifier, email address and verification status, and profile information such as your name and picture. We use this information to create or identify your account, keep you signed in, and display your profile.

Merdi does not receive your Google password. We do not request access to your Gmail messages, Google Drive files, contacts, or calendar. We do not sell Google account information, use it for advertising, or use it to train AI models. Google account information is handled by our authentication and infrastructure providers as needed to operate your account.

How we use information

We use information to authenticate you, save and retrieve your conversations, adapt language practice to your selected level and conversation context, generate replies and explanations, and keep the service reliable. We also use technical information and usage counts to diagnose failures, enforce usage limits, prevent abuse, and protect accounts.

AI conversations

Merdi’s language friends are fictional AI characters. When AI replies are enabled, your message and relevant recent conversation history are sent to OpenRouter and the model provider it routes the request to. The request also includes your learning level and the selected character’s instructions. These services process that information to generate a reply, translation, and language tip.

We do not deliberately include your sign-in email, Google profile information, password, or authentication tokens in AI requests. If you type personal information into a conversation, however, that information can be included in the conversation sent for processing.

Our AI requests are configured to exclude providers that allow prompt data to be collected for training. This setting is not a promise of zero retention: OpenRouter and model providers may retain information for operational, security, or legal purposes under their own policies. Read more in OpenRouter’s privacy policyand its provider data handling documentation.

Conversations are processed on servers to provide the AI service and are not end-to-end encrypted. Please avoid sharing passwords, payment details, or sensitive information that is unnecessary for language practice.

Services that help run Merdi

• Supabase provides account authentication and database storage.
• Google Cloud hosts our backend service.
• Vercel hosts our website and web app.
• Cloudflare provides domain and DNS services.
• OpenRouter and model providers process messages for AI replies.
• Sign-in providers, such as Google, authenticate you when you choose them.

These services receive information needed for their role. We may also disclose information when required by law, to respond to valid legal requests, or to protect people, accounts, and the service. Merdi does not sell personal information or share it for targeted advertising.

Storage and security

Account and conversation data are stored with Supabase. Our current database is hosted in Ireland and our backend runs in London. Hosting, authentication, and AI providers may process information in other countries, including countries outside where you live.

We use HTTPS for data in transit, authentication checks, and database access controls to restrict access to account and conversation data. Our application access logs exclude message bodies and authentication credentials. No online service can guarantee absolute security.

How long information stays

Account information and saved conversations are retained while your account is active so you can return to them. Archiving a conversation hides it from your main chat list; it does not delete it. Signing out, uninstalling the app, or removing browser data does not delete the server-side account or saved conversations.

Information may be retained where needed for security, service operation, or legal obligations. When records are deleted from active systems, copies may remain temporarily in backups or provider logs according to the relevant provider’s retention processes.

Your choices

You choose what to share in a conversation and can stop using Merdi at any time. You can sign out of your account, clear locally stored browser or app data, and remove Merdi’s Google connection in your Google account settings. Removing that connection stops future Google account access; it does not itself delete information already stored by Merdi.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information, or to object to or restrict certain processing. Nothing in this policy limits rights provided by applicable law.

Cookies and local storage

The web app stores session information in your browser to keep you signed in. Native apps use the device’s secure storage for session credentials. The installable web app also caches public files, such as fonts and icons, so it can load reliably. Its offline cache does not store private API responses or sign-in callback pages. Authentication providers may use their own cookies during sign-in. Merdi does not include advertising trackers.

Children

Merdi is not directed to children under 13, or anyone below the minimum age for using online services without parental consent in their country. We do not knowingly collect personal information from children below those ages.

Changes to this policy

We may update this policy as Merdi develops. The date above shows the latest revision. For material changes to how we use personal information, we will provide notice through the service and seek consent where required by applicable law.

Read our terms of service for the conditions of using Merdi.