Privacy policy

What Maru keeps

If you sign in with Google: your email address, which Google shares when you sign in (Maru doesn't ask for your name, photo or anything else on your profile). If you sign up with email: your email address and a scrambled (hashed) copy of your password. Then the plan you make in Maru: projects, milestones, tasks, daily logs and settings. Maru asks Google for nothing else, and never reads your Gmail, contacts or files.

Only if you connect a calendar (☰ → Calendars): Maru keeps a key that lets it read and write that calendar's events, encrypted like your plan, and copies the events of the calendars you tick (time, title, place and notes) into your plan. Disconnect deletes the key and takes those events out of your plan.

How it's kept

Your plan is stored on Cloudflare's servers, which encrypt it at rest, and kept separate from every other user's. Passwords, sign-in cookies, recovery codes and your chatbot link are stored only as one-way hashes, so nobody can read them back. Maru has no page where the person who runs it can browse users' plans.

If you add a passphrase, your plan is also locked with a key made from it, so a copy of the database alone can't be read. While you're signed in (and when your connected chatbot uses Maru), Maru's server uses that key to read your plan for you, so this is not end-to-end encryption. Changing your password signs out your other devices and every connected chatbot.

Who sees it

Only you, and the chatbot you connect with your private chatbot link. When you use Maru through a chatbot such as Claude or ChatGPT, that company sees what the chatbot reads, under its own privacy policy. Maru doesn't sell your data, show ads, or share it with anyone else.

Accountability groups

Groups are optional. If you join one, the people in that group see your nickname and bio, whether your timer is running on an activity type you chose to count for that group, the names your detail level for that group allows (never for a project marked "hide name"), your hours per day in those activity types (including days from before you joined), your first start and last stop each day, and milestones you've reached (only to groups that may see milestone names). For this, Maru keeps a small copy of just those things outside your encrypted plan. Nobody outside the group sees any of it, and it's deleted when you leave your last group or delete your account.

Your choices

Download everything at any time from the menu (Download my data). To delete your account and all its data, use Account → Delete my account in the menu; it's removed right away. Deleted tasks are kept in a 30-day trash, then removed for good.