Who we are
Space Cadet d.o.o.
Ulica Ivana Šibla 17
10000 Zagreb, Croatia
Space Cadet d.o.o. ("Mayday", "we", "us") is responsible for the personal data described in this policy. It covers the Mayday iOS app, mayday.sh, and support communications. Contact us at hello@mayday.sh for privacy questions or to exercise your rights.
Information we process
- Account information: email address, account identifiers, authentication and session information. Clerk handles credentials and sign-in.
- Your private record: checkpoint and imported photos, product photos, dates, notes, routines, products, schedules, completion logs, and preferences.
- Optional hair history: age or timing information you provide, areas of concern, reported changes, family history, and health, lifestyle or treatment context. Some of this can be health data. Do not include relatives’ names or identifying details.
- Hairline and AI results: confirmed outline points and eye anchors, submitted requests, generated readings or images, consent version, and request metadata.
- Purchases: Apple transaction and product identifiers, subscription status, expiry, revocation information, and an account token used to associate purchases. We do not receive your payment-card details.
- Support and technical information: messages you send us and service information needed to deliver requests, authenticate access, diagnose failures and prevent misuse. Infrastructure providers may process IP addresses and request logs.
Why we use it
We use account, record and purchase information to provide the service you request: sign-in, private sync, routines, comparisons, exports, and Pro access. Where applicable, this processing is necessary to perform our contract with you.
Optional AI processing requires your agreement before the request. Where information reveals health data, explicit consent is required for that processing. You can decline optional AI features, remove optional history, or contact us to withdraw consent. Withdrawal does not undo processing that was lawful before withdrawal.
We use limited technical information for our legitimate interests in maintaining security, preventing abuse and resolving support issues, balanced against your rights. We may also retain information where required by law or necessary to establish or defend legal claims. Launch emails are sent only when you request them; you can ask us to stop at any time.
Storage and service providers
Clerk provides authentication. Convex stores and syncs account-owned records and private photos. Apple handles App Store billing. RevenueCat processes purchase records, subscription status, product identifiers and a pseudonymous Mayday account identifier to manage Pro access and subscription reporting. Our backend checks this status. We do not send hair photos, hair history or routines to RevenueCat. OpenAI processes optional AI requests as explained below. Our website is intended to be hosted on Vercel. Email providers deliver messages you send to support.
A local account cache also exists on your device. Sample journeys and unfinished capture drafts remain on the device. Ordinary camera framing and photo-quality checks run on-device. Cloud hairline detection is a separate, optional AI request.
We do not sell personal data or share it for targeted advertising. We may disclose information when legally required or to protect the service and people’s rights. Service providers receive information necessary for their roles.
Providers may process data outside your country, including in the United States. Where European data-protection law requires it, international transfers must have a valid safeguard, such as an adequacy decision or standard contractual clauses. Contact us for information about the safeguards applicable to your data.
Optional AI features
Before an AI request, Mayday explains what will be sent and asks for your agreement. Requests pass through our authenticated backend to OpenAI:
- Hair-history reading: the saved hair-history information included in the request, including family and health context you entered.
- Hairline detection: the selected, resized photo to estimate its visible hairline. You review the result before saving. Local eye alignment helps position the outline.
- Illustration: the selected, resized photo and chosen visual style to create an edited image.
We strip EXIF metadata from images sent for AI processing. We do not send your entire photo library. OpenAI does not use API inputs and outputs to train its models by default. Its abuse-monitoring logs may retain content for up to 30 days, subject to legal obligations and applicable exceptions. We request no stored Responses history. See OpenAI’s data controls.
AI can make mistakes. Outlines are estimates for you to review; trend drawings are conditional illustrations, not validated medical predictions. These features do not identify people, diagnose a condition, or make decisions with legal or similarly significant effects. Your original photos remain unchanged.
Retention and deletion
We keep your account records while needed to provide your account and until you delete them or request account deletion, subject to any lawful retention requirement.
- AI recovery cache: results and request metadata expire after 24 hours and are removed by scheduled cleanup. The cache does not contain submitted source photos or history. Saved outline points become part of your journey instead.
- Saved AI readings on your device: the app keeps your latest ten readings in protected account storage, excluded from device backup and cloud sync. You can remove a reading individually. Clearing hair history, deleting local data, or deleting the account on that device also removes saved readings. Each reading retains its date and a source-history fingerprint so the app can identify an older reading.
- Anonymous AI usage counters: aggregate daily service-use counters expire after 72 hours and are removed by scheduled cleanup.
- Account deletion: Mayday blocks further sync, removes account-linked cloud records, photos, entitlements and cached AI results, and requests deletion of your Clerk account. The app shows progress if deletion needs retrying.
- Deletion receipt: a minimal identity reference, deletion time and receipt may remain to prevent a deleted identity from recreating an account through an old session. This does not contain your journey or photos.
Provider security logs and backups may follow separate retention cycles. Information needed for legal obligations or disputes may be retained for that purpose. Contact us for details relating to your request.
Signing out hides the local account cache; it is not an account-deletion request. Uninstalling the app does not delete your cloud account. Exported or shared copies and a separate device-only record are not removed by cloud-account deletion. Deleting your account does not cancel an Apple subscription.
Your choices and rights
Use Profile → Account settings → Delete account to request deletion. You can also email hello@mayday.sh if you cannot access the app. We may need to verify account ownership; never send a password or verification code.
Depending on applicable law, you can request access, correction, erasure, a portable copy, or restriction of processing, and object to processing based on legitimate interests. You can withdraw consent and object to marketing at any time. We normally respond to European data-rights requests within one month; if a lawful extension is needed, we will explain it.
You may complain to your local data-protection authority. In Croatia, this is AZOP. These rights can have legal exceptions.
Camera, photo selection and notification permissions are under your control. The system photo picker shares only selected photos. Optional device authentication does not give Mayday your Face ID, Touch ID or passcode. Exports are shared only with destinations you select.
Website and email
This website does not include advertising trackers, analytics scripts, or a mailing-list form. The launch-update button opens your email app; nothing is submitted until you send the message. If you email us, we receive your email address and what you include, and use them to respond or provide the updates you requested.
The hosting provider processes technical requests to serve and secure the site. Our own page code does not set cookies or browser storage. External websites you choose to visit have their own privacy practices.
Children and policy changes
Mayday is designed for adults and is not directed to children. Contact us if you believe a child has provided personal information so we can investigate and take appropriate action.
We update this policy when our practices or legal requirements change. The date above identifies the current version. We will provide additional notice or request fresh consent where required for a material change.