MASTER PRIVACY POLICY

Effective Date: July 20, 2026
Last Updated: July 20, 2026

Mahj & Mischief LLC (“Mahj & Mischief,” “Company,” “we,” “us,” or “our”) provides this Master Privacy Policy to explain how we collect, use, disclose, retain, and protect personal information through:

collectively, the “Services.”

This Policy applies only to use of the Services within the United States.

1. IMPORTANT SUMMARY

Our Services use a combination of:

Information stored locally on your device may not be accessible to Mahj & Mischief. Information transmitted through a cloud, AI, communications, support, or network-connected feature leaves your device and is processed by us or a service provider.

We do not sell personal information for money.

We do not use personal information for cross-context behavioral advertising or targeted advertising.

We do not operate third-party advertising networks within the Services.

We do not currently use a dedicated third-party behavioral analytics provider. Netlify, Supabase, GoDaddy, Lovable, and other infrastructure providers may generate ordinary operational, security, access, or diagnostic logs as part of providing their services.

If any of these practices change, we will update this Policy and provide any notice or choices required by law before beginning the new practice.

2. NOTICE AT COLLECTION

The following summarizes categories of personal information we may collect and the purposes for which they may be used.

Category Examples Main purposes
Identifiers Name, username, email address, telephone number, account identifier, IP address Accounts, invitations, communication, security, and support
Account information Login information, authentication tokens, group membership, and settings Provide accounts, syncing, and access controls
User Content Recipes, photographs, tasks, notes, vision boards, routines, schedules, RSVPs, and messages Provide the features requested by the user
Device and network data Browser, device type, operating system, IP address, timestamps, and logs Operation, security, diagnostics, and fraud prevention
Usage data Pages or features requested, session activity, error events, and general interaction data Improve reliability and understand feature use
AI inputs and outputs Recipe-card images, recipe text, prompts, extracted text, corrections, and generated responses Provide image-to-text and other user-requested AI features
Communications data Recipient contact information, invitation details, delivery information, and support correspondence Deliver user-requested communications and provide support
Sports preferences Teams, leagues, filters, favorites, selections, and dashboard settings Personalize Red’s Radar and display relevant information
Approximate location General location inferred from an IP address Security, fraud prevention, localization, and legal compliance

We use these categories for the purposes explained in Section 7 and retain them according to Section 14.

We do not intentionally collect payment-card information, Social Security numbers, government identification numbers, precise geolocation, or biometric identifiers through the Services.

3. LOCAL AND OFF-DEVICE PROCESSING

3.1 Local-First Processing

Certain features store information in browser storage, an on-device database, cache, or installed web-app storage.

Depending on the feature, locally stored information may include:

When information remains entirely local:

Even when substantive User Content remains local, our hosting provider may receive ordinary network information when an App loads, such as IP address, requested page, date, time, browser, and security-log data.

3.2 Off-Device Processing

Information leaves your device when you use a feature involving:

Only use those features with information you are authorized to transmit.

4. PERSONAL INFORMATION WE COLLECT

4.1 Information You Provide

We may collect information you provide when you:

This may include your name, email address, telephone number, account credentials, User Content, and communications.

4.2 Information Provided About Other People

Some features allow a host, administrator, or user to enter another person’s name, email address, telephone number, RSVP information, or group membership.

The person entering that information is responsible for having permission and providing any notice required by law.

We use recipient information to provide the requested invitation, reminder, schedule, or communication and to maintain applicable group functions.

4.3 Information Collected Automatically

When you access a network-connected Service, we or our service providers may automatically collect:

We do not use this information to read the substantive contents of locally stored recipes, tasks, vision boards, or routines unless you transmit that content through an off-device feature.

4.4 Information from Service Providers and Other Sources

We may receive information from:

The information received depends on the feature, configuration, and provider.

5. APP-SPECIFIC INFORMATION

5.1 Gather Recipe Collector

Gather may process:

When you choose an AI-reading or AI-assistance feature, the selected image, text, or prompt may be transmitted to one or more of the following providers, depending on the feature and current configuration:

We do not intentionally opt in to using User Content to train a provider’s general-purpose models. Provider retention, abuse-monitoring, and model-improvement practices vary by service, account type, feature, and configuration and may change over time. Business and API services may provide different protections from consumer chat accounts.

Do not submit medical dietary records, confidential family information, information about a child, or material you are not authorized to process.

5.2 Thrive Vision Board & Task Manager

Thrive may process:

Do not use Thrive to store medical records, psychotherapy notes, diagnoses, medication information, bank information, government identifiers, or other high-risk data.

If you enter health-related goals or other sensitive information into a local field, that information remains local unless you enable cloud synchronization, sharing, support, or another off-device feature.

5.3 Bedtime Dash

Bedtime Dash may process locally:

Bedtime Dash is intended to be configured and controlled by a parent or legal guardian. Children are not permitted to create an independent account.

Where technically feasible, child-related routine information is stored locally and is not transmitted to Mahj & Mischief.

Do not enter a child’s:

Mahj & Mischief does not intentionally use Google Gemini, OpenAI, Anthropic Claude, Codex, or Lovable to process a child’s personal information through the live Bedtime Dash App.

Additional children’s-privacy provisions appear in Section 13.

5.4 Mahj Mischief Manager

Mahj Mischief Manager may process:

A host or administrator must have permission to add another person’s contact information.

Group information may be visible to other authorized members of the same group. Users should not add information they do not want shared with those members.

5.5 Red’s Radar

Red’s Radar may process:

Mahj & Mischief does not currently maintain a dedicated contracted sports-data provider and does not disclose user personal information to such a provider.

Sports information may be entered by a user, manually curated by Mahj & Mischief, or obtained from publicly available sources. A website or public source contacted by the App may receive ordinary technical request information, such as an IP address and requested page or resource.

Red’s Radar does not need your sportsbook password, bank information, or payment-card information. Do not enter such information.

We do not use Red’s Radar information to place wagers, withdraw funds, or access sportsbook accounts.

6. SOURCES OF PERSONAL INFORMATION

We collect personal information from:

7. HOW WE USE PERSONAL INFORMATION

We may use personal information to:

We will not use personal information for a materially different purpose without providing any notice or consent required by law.

8. HOW WE DISCLOSE PERSONAL INFORMATION

We may disclose personal information to the following categories of recipients.

8.1 Netlify

Netlify may provide hosting, deployment, content delivery, domain-related functions, security, and operational logging. Netlify may receive IP addresses, request details, timestamps, device or browser information, and other information necessary to deliver the Services.

8.2 Supabase

Supabase may provide database, authentication, storage, synchronization, and related cloud functionality. Depending on the App and feature, Supabase may process account information, cloud User Content, group information, schedules, settings, authentication data, and operational logs.

8.3 Google Gemini

Google Gemini may process images, text, prompts, and generated responses when you request an AI feature that uses Gemini. Data handling depends on the Gemini service, account type, and configuration used at the time of processing.

8.4 OpenAI

OpenAI services may include ChatGPT, the OpenAI API, and Codex.

ChatGPT or the OpenAI API may process images, text, prompts, and generated responses when you request an AI feature that uses OpenAI.

Codex is principally a development and coding tool. It is not intended to receive routine live end-user content. Mahj & Mischief personnel may use Codex to maintain, test, troubleshoot, or improve software. When support materials, logs, screenshots, or sample records are submitted for development purposes, we will seek to minimize or redact personal information before submission.

8.5 Anthropic Claude

Anthropic Claude may process images, text, prompts, and generated responses when you request an AI feature that uses Claude. Claude may also be used during support, maintenance, or development. We seek to minimize or redact personal information submitted for those purposes.

8.6 Lovable

Lovable is an AI-assisted application development platform and may also provide hosting, cloud, database, authentication, storage, deployment, or development functions depending on how a particular App is configured.

Lovable is not intended to receive routine end-user content unless the App is hosted on or connected to a Lovable service that processes that content, or Mahj & Mischief personnel submit support, debugging, project, log, screenshot, or sample information to Lovable. We seek to minimize or redact personal information before submitting development or support materials.

8.7 GoDaddy

GoDaddy provides business email services used by Mahj & Mischief. GoDaddy may process sender and recipient email addresses, message content, attachments, delivery information, IP addresses, timestamps, and related email-service data.

8.8 User-Selected Communication Services

When you choose a device sharing feature, email client, text-message application, or carrier service, the selected provider receives the information you direct the App to share.

8.9 Professional Advisers

We may disclose information to attorneys, accountants, insurers, auditors, and consultants subject to appropriate confidentiality obligations.

8.10 Legal and Safety Disclosures

We may disclose information when we reasonably believe disclosure is necessary to:

8.11 Business Transactions

Information may be disclosed or transferred in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or transfer of a Service.

Where required, we will provide notice before a successor uses personal information in a materially different manner.

8.12 At Your Direction

We disclose information when you direct us to share, invite, export, message, process, or synchronize it.

9. SERVICE-PROVIDER PRACTICES

Third-party providers maintain their own terms, privacy policies, retention periods, security controls, and subprocessors. Those practices may change independently of Mahj & Mischief.

Where appropriate and available for the service used, we seek to use business, commercial, workspace, or API configurations that:

We do not promise that a third party will never retain, review, disclose, or otherwise process information when the provider’s terms, safety systems, legal obligations, or technical functions permit that processing.

10. AI PROCESSING

When you request AI processing:

  1. the selected image, text, or prompt is transmitted off your device;
  2. one or more selected providers process it to produce an output;
  3. the output is returned to the App; and
  4. you may review, edit, save, or discard it.

AI output may be inaccurate.

We do not intentionally submit AI inputs for advertising or opt User Content into general-purpose model training.

Provider retention and abuse-monitoring periods vary. For example, some business or API offerings may retain input and output temporarily for safety or abuse monitoring, while consumer accounts or optional data-sharing settings may have different practices. We therefore do not promise a single provider retention period across all AI features.

Do not submit sensitive information or information about a child through an AI feature.

11. ANALYTICS, COOKIES, AND SIMILAR TECHNOLOGIES

The Services may use:

Essential storage supports features such as login, preferences, saved content, synchronization, and App installation.

Mahj & Mischief does not currently use a dedicated third-party behavioral analytics or advertising analytics provider within the Services. Infrastructure providers such as Netlify, Supabase, Lovable, and GoDaddy may generate operational or security logs as part of providing their services.

A device or browser may permit you to clear local data or restrict cookies. Doing so may remove content, sign you out, or disable features.

Where applicable law requires recognition of a browser-based opt-out preference signal, we will process supported signals as required.

12. SALE, SHARING, AND TARGETED ADVERTISING

We do not sell personal information for monetary or other valuable consideration.

We do not share personal information for cross-context behavioral advertising.

We do not use personal information for targeted advertising based on activity across unrelated businesses, websites, or applications.

We do not knowingly sell or share the personal information of consumers under 16.

If these practices change, we will update this Policy, provide legally required notice, and offer legally required opt-out choices before beginning the new practice.

13. CHILDREN’S PRIVACY AND BEDTIME DASH

Parent-Operated Service

Bedtime Dash is designed to be selected, configured, and controlled by a parent or legal guardian. It is not intended to permit a child under 13 to create an account, communicate independently with Mahj & Mischief, or publicly share personal information.

Information About Children

A parent may choose to enter a first name, nickname, routine step, or reward label. Where the feature is local-only, that information remains on the parent-controlled device.

We do not knowingly collect personal information online directly from a child under 13 without first taking the steps required by the Children’s Online Privacy Protection Act and other applicable law.

Mahj & Mischief does not intentionally transmit child-related routine information from Bedtime Dash to Google Gemini, OpenAI, Anthropic Claude, Codex, or Lovable for AI processing.

If a future Bedtime Dash feature requires online collection of personal information from a child under 13, we will not enable that feature until we have, as applicable:

Parent Requests

A parent or guardian who believes we received personal information from a child may contact us at LetsPlay@MahjMischief.com with the subject line “Child Privacy Request.”

We may request information needed to verify parental identity and authority.

After verification, a parent may request:

No Behavioral Advertising to Children

We do not use child-related information for behavioral advertising, targeted advertising, or advertising profiling.

No Condition of Participation

We will not require a child to provide more personal information than reasonably necessary to participate in an activity.

14. RETENTION

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including security, dispute resolution, legal compliance, support, and enforcement.

Our retention decisions consider:

General retention approach:

Information Retention approach
Local-only content Until the user deletes it, clears storage, uninstalls the App, resets the device, or otherwise loses access
Account information While the account remains active and afterward for as long as reasonably necessary for deletion processing, security, disputes, and legal obligations
Cloud User Content Until deleted by the user, an authorized administrator, or Mahj & Mischief, subject to backup, security, and legal exceptions
Backups Until overwritten or deleted through the applicable provider’s ordinary backup cycle, unless preservation is legally required
Operational and security logs For as long as reasonably necessary to maintain security, diagnose errors, prevent abuse, and comply with law
Support communications For as long as reasonably necessary to resolve the request, maintain business records, and address disputes
Privacy-request records For as long as reasonably necessary to document compliance and prevent fraud
AI inputs and outputs According to the selected provider, service, account configuration, safety requirements, and any copy saved by the user or the App
Invitation and message records As needed to deliver the communication, administer the group, maintain opt-out records, and resolve disputes

We may retain de-identified or aggregated information that cannot reasonably be linked to an individual.

15. SECURITY

We use reasonable administrative, technical, and organizational safeguards appropriate to the nature of the information we process.

Measures may include:

No internet transmission, cloud service, browser, AI provider, email system, or storage system can be guaranteed to be completely secure.

You are responsible for:

If a legally reportable breach occurs, we will provide notice as required by applicable law.

16. YOUR CHOICES

Depending on the Service, you may be able to:

Disabling or deleting information may prevent some features from operating.

Transactional, security, or legally required communications may continue after you opt out of promotional communications.

17. UNITED STATES PRIVACY RIGHTS

Residents of certain states may have rights regarding personal information, subject to legal thresholds, definitions, exceptions, and verification requirements.

Where applicable, these rights may include:

To submit a request, email LetsPlay@MahjMischief.com with the subject line “Privacy Request.”

Please identify:

We will not request more information than reasonably necessary to verify and process the request.

We may deny or limit a request when permitted by law, including when we cannot verify identity, the information is exempt, retention is legally required, or fulfillment would adversely affect another person’s rights.

We will respond within the period required by applicable law.

Authorized Agents

Where permitted, an authorized agent may submit a request for you. We may require evidence of authorization and may ask you to verify your identity directly.

Appeals

Where applicable, you may appeal a denied request by replying to our decision or emailing LetsPlay@MahjMischief.com with the subject line “Privacy Appeal.”

We will explain the result of the appeal and any available method for contacting the applicable regulator.

Non-Discrimination

We will not unlawfully discriminate against you for exercising a privacy right.

18. CALIFORNIA SUPPLEMENTAL NOTICE

This section applies only when the California Consumer Privacy Act applies to Mahj & Mischief or a particular processing activity.

California residents may have rights to know, access, correct, and delete personal information; opt out of sale or sharing; limit certain uses of sensitive personal information; and receive equal treatment.

During the preceding 12 months, we may have collected the following California categories:

We collect these categories from the sources described in Section 6 and use them for the purposes described in Section 7.

We may disclose these categories for business purposes to the provider categories described in Section 8.

We do not sell or share personal information for cross-context behavioral advertising.

We do not knowingly sell or share personal information of consumers under 16.

California residents may submit requests using Section 17.

19. TEXAS SUPPLEMENTAL NOTICE

This section applies when the Texas Data Privacy and Security Act applies to Mahj & Mischief or a particular processing activity.

Texas residents may have rights to:

We do not sell personal data or use it for targeted advertising.

Texas residents may exercise applicable rights and appeals through Section 17.

20. SENSITIVE PERSONAL INFORMATION

The Services are not designed to collect:

Do not enter such information into the Services.

A free-text field may technically permit a user to enter information we did not request. If you voluntarily transmit sensitive information through a cloud, AI, support, or sharing feature, we process it only as reasonably necessary to provide the requested feature, protect the Service, and comply with law.

We do not sell sensitive personal information.

21. EMAIL, MESSAGES, AND NOTIFICATIONS

Mahj & Mischief uses GoDaddy for business email. GoDaddy may process sender and recipient addresses, message content, attachments, delivery information, timestamps, and technical data necessary to provide email service.

We may use contact information to send:

Marketing email, if used, will include an unsubscribe method.

Consent to receive marketing text messages will be requested separately when legally required. Marketing consent will not be a condition of purchase unless permitted by law.

You can disable push or device notifications in your device settings.

Message and data rates may apply.

We may retain suppression or opt-out records to ensure that we continue honoring a request not to receive optional communications.

22. THIRD-PARTY WEBSITES, AI PROVIDERS, AND APP STORES

A Service may link to or interact with a third-party website, AI provider, app store, sharing platform, publicly available sports source, or other service.

This Policy does not govern that third party’s independent collection or use of information.

Apple, Google, OpenAI, Anthropic, Lovable, Netlify, Supabase, GoDaddy, device manufacturers, browsers, carriers, and other platforms maintain their own privacy policies and terms.

Review third-party policies before providing information.

23. DO NOT TRACK AND PREFERENCE SIGNALS

Some browsers transmit “Do Not Track” signals. Because there is no universally accepted response standard, the Services may not respond to traditional Do Not Track signals.

Where applicable law requires recognition of an approved opt-out preference signal, such as a legally recognized browser-based signal, we will honor supported signals for the browser or device from which the signal is sent.

Because we do not sell personal information or use it for targeted advertising, such a signal ordinarily will not alter our stated practices.

24. CHANGES TO THIS POLICY

We may update this Policy to reflect changes in:

The “Last Updated” date will identify the most recent revision.

For material changes, we will provide reasonable notice through the App, email, our website, or another appropriate method before the change becomes effective when required.

If consent is legally required for a new use, we will request it rather than relying solely on continued use.

25. CONTACT US

Mahj & Mischief LLC
Austin, Texas 78732
United States
Email: LetsPlay@MahjMischief.com

For privacy requests, use the subject line “Privacy Request.”
For child-privacy questions, use “Child Privacy Request.”
For security concerns, use “Security Concern.”

APPENDIX A — SHORT-FORM NOTICES

General Account Notice

Mahj & Mischief LLC collects identifiers, account information, User Content, device information, and operational data to provide accounts, synchronization, communications, security, support, and App functionality. Information may be processed by Netlify, Supabase, GoDaddy, and other providers described in the Master Privacy Policy. We do not sell personal information or use it for targeted advertising.

AI Recipe-Scanning Notice

When you use AI recipe scanning, the selected image, text, and related prompt leave your device and may be sent to Google Gemini, OpenAI, or Anthropic Claude for processing. AI results may be inaccurate. Do not submit confidential information, medical information, information about a child, or material you are not authorized to process. Provider retention and use depend on the selected service and account configuration.

Cloud-Sync Notice

When you enable cloud synchronization, selected App content is transmitted to and stored by our cloud service providers, which may include Supabase, Netlify, or Lovable depending on the App’s configuration. Cloud storage can experience errors or outages and is not a substitute for maintaining your own backup.

Invitation and Messaging Notice

When you send an invitation or reminder, the recipient’s contact information and message details leave your device and are processed by the selected email, carrier, or messaging service. Mahj & Mischief uses GoDaddy for its business email. Confirm that you have permission to contact the recipient. Delivery is not guaranteed and message or data rates may apply.

Bedtime Dash Parent Notice

Bedtime Dash is a parent-operated routine tool. Do not permit a child to create an account or independently enter personal information. Use a nickname or first name rather than a child’s full name, and do not enter medical, location, school, photograph, voice, or other sensitive information. A responsible adult must supervise the child at all times.

View the Master Terms of Use