MerviloWhat stays on your device
Mervilo stores your display name, learning plans, notes, imported files, completion history, self-assessment scores and reflections in the app’s storage. Mervilo accounts manage sign-in and AI access; learning does not sync to the cloud. Learning on this device remains accessible when you switch accounts. Apple device backups may include this data, depending on your settings. Authentication sessions are kept in device-only Keychain storage.
Your permission for AI sharing
Before your first AI course or resource request, the app shows a short sharing notice with a link to this policy. From version 1.0 (5), the notice covers course generation and optional lesson resources. If you agreed to an earlier notice, we ask once for your agreement to this expanded sharing. The app remembers your agreement for your account and service on that device and checks it before each AI request. Future requests, retries and replacement drafts use that permission until you withdraw it in Privacy & help. We ask again if the information shared or its recipients materially change.
Creating a course sends your learning goal, experience level, weekly hours and preferred lesson order over HTTPS to Mervilo’s service, hosted on Google Cloud in the United States, and then to OpenAI to generate lessons.
The same learning details and AI-generated course and resource suggestions may also be sent to OpenAI for content-safety checks before generating/searching or returning results. These checks do not add your account identifier, local display name, notes, attachments, grades or reflections to the AI request. Safety decisions are processed in memory, without saving the decision text or adding it to application logs. Checks reduce risk but do not guarantee accuracy or that external websites remain suitable. Mervilo is intended for teens aged 13 and older and adults; it is not directed to children under 13.
The app also sends a random request identifier and your signed-in session token to Mervilo’s service. Your local display name, notes, files, grades and reflections are not included. Please avoid putting sensitive personal information in a learning goal.
OpenAI API content is not used for model training by default. Mervilo disables response storage for course, resource and content-safety requests. OpenAI may still retain customer content in abuse-monitoring logs for up to 30 days by default, with exceptions for legal obligations or safety needs. See OpenAI’s API data controls and privacy policy.
Optional lesson resources
From version 1.0 (5), opening a saved lesson can start a separate resource search after you agree to the updated AI sharing notice. This sends your goal, experience level, lesson title and overview, including edits, to Mervilo and OpenAI. OpenAI may share search queries with search providers to retrieve relevant websites. Notes, attachments, grades and reflections are not included. Avoid sensitive personal information in lesson titles and overviews. Results are saved on your device; the service retains search results for the same 10-minute retry period and usage records for up to 30 days. You can cancel a search, remove links, add your own, or withdraw future AI sharing in Privacy & help. Resources are optional; search matches do not guarantee a website’s accuracy or continued availability.
Optional Notion export
When Notion export is available, connecting Notion lets you choose the pages Mervilo can access. Tapping Send to Notion sends the course preview, destination page ID and a random request ID over HTTPS through Mervilo’s service to Notion. Notes, reflections, self-assessments and completion are included only when you select those options. Attachments are excluded. Export does not use AI and is separate from your AI sharing permission.
The course becomes an editable copy in Notion. It inherits the destination’s access rules and does not sync back to Mervilo. See Notion’s privacy policy for its handling of the copy.
Mervilo encrypts your Notion access token before storing it in Supabase. The token and workspace name remain until you disconnect or delete your Mervilo account. Course export text is processed in server memory and is not stored in the export database. Export status and page links are kept for up to 30 days; minimal request identifiers and hashes remain until account deletion to prevent duplicate retries. OAuth state expires after 10 minutes. Searching for a destination sends your search text to Mervilo and Notion. Search text is included in the request URL and may be retained in hosting logs for 30 days. The authorization callback includes a short-lived code in its URL, which hosting request logs may retain under the operational retention described below.
Disconnecting removes Mervilo’s saved access and stops future exports. It does not delete Notion pages or cancel a request already sent. You can revoke the connection and manage exported copies in Notion separately. Deleting your Mervilo account removes its saved Notion credentials and export records.
Service records and retention
Supabase stores your account email and authentication records, beta access, hashed invitation redemption, daily usage, request identifiers and request hashes. Generated results are available for retry for 10 minutes; scheduled cleanup removes expired content every minute under normal operation. Course generation and resource search request and daily usage records expire after approximately 30 days. Free-course totals and subscription allowance usage, when enabled, remain until account deletion. Notion export records have the retention described above. Unredeemed invitations expire on their stated date; redeemed invitation hashes remain to prevent reuse. Provider backups and operational logs follow their configured retention.
If you use password sign-in for an existing account, your email and password are sent directly to Supabase over HTTPS for authentication. Mervilo does not embed or retain the password in the app; the sign-in session uses device-only Keychain storage. Supabase sends sign-in emails through Cloudflare Email Sending. Cloudflare processes the recipient email address, sign-in message and delivery records to deliver these codes. Sign-in codes expire after 10 minutes. We do not use these emails for marketing.
Application logs record random request identifiers and response status codes, not goals, lesson text or credentials. Google Cloud’s request logs can include your IP address, request URL, browser or app information, response status and timing. The service does not configure request-body or authorization-header logging. Our operational request and application logs are retained for 30 days in Google Cloud Logging, with access restricted through our cloud account permissions.
We use these records to operate the service, investigate errors and protect it from abuse. Supabase, Cloudflare, Google and OpenAI process information under their applicable service terms and may process it in countries other than your own. See Google Cloud’s privacy notice.
Subscriptions, when available
Apple processes App Store purchases and payment details. Mervilo does not receive your card information. The app sends signed App Store transaction information over HTTPS to Mervilo’s service, which verifies it and queries Apple for current subscription status. The transaction uses your Mervilo account identifier to associate the purchase with the account you signed in with.
Supabase stores original and latest purchase identifiers, product identifier, subscription environment, status and expiration, verification timestamps and course allowance usage until you delete your account. Raw signed transactions are verified in memory and are not saved in our subscription table or application logs. These records support access checks and purchase restoration; they are not used for advertising or tracking. Apple retains its own purchase records under its privacy policy.
Restore purchases and manage subscriptions from Account. Restoration requires the Mervilo account used for the purchase. Deleting that account removes Mervilo’s purchase records, but does not cancel an Apple subscription. Cancel through the App Store before deleting the account. Existing courses on your device and copies exported to Notion remain available after cancellation.
Sharing, websites and support
When you share a portfolio, Mervilo sends the displayed name, goals, notes, progress, self-assessments and reflections to the destination you choose through Apple’s share sheet. Imported attachment files are not embedded in the portfolio text. Resource links open external services with their own privacy practices.
Mervilo includes no advertising or cross-app tracking SDKs. This website is hosted through Cloudflare. Visiting its support and privacy pages creates hosting request logs that may include your IP address and browser information. We do not add advertising trackers or marketing analytics. Beta signup information is covered separately in our signup privacy notice. Apple handles TestFlight installation, diagnostics and feedback under its own TestFlight privacy information.
If you email support, we receive your email address and the information you include. We use it to answer your request and keep the correspondence as needed to resolve it and meet applicable legal obligations. Please do not send access codes, API keys or private learning content.
Your choices and deletion
You can decline AI sharing and still use the offline starter lesson and saved lessons. In the app’s Privacy & help screen, export your portfolio before choosing Erase local learning data. Erasure removes your local display name, plans, notes, imported work, progress and recovery copies. Deleting a lesson or plan removes imported files when their last saved reference is removed.
If saved data becomes unreadable, a recovery copy and its imported files remain available until you explicitly erase local learning data. The app reports removal failures so you can retry. Open Account to sign out or delete your account. Deletion removes the account and its course and resource request records, but does not erase learning on this device. Redeemed invitation hashes and aggregate daily service usage remain without your account identifier.
Local erasure does not remove shared exports, Apple backups or records already processed by service providers. Depending on where you live, you may have rights to access, correct or delete personal information, restrict or object to processing, or make a complaint to your privacy regulator. Contact us to make a request. We may need information to verify and locate it; legal or provider retention requirements may limit immediate deletion.
Questions about privacy?
Mervilo is operated by Kenneth Perry. Contact ken.perry.dev@gmail.com for privacy questions or requests.
We will update this page when our practices change. Material changes to the information sent for AI requests will also be reflected in the app’s permission screen before that sharing occurs.