Privacy policy

Who is responsible

Mural is operated by Hackmamba Inc., a company incorporated in the United States. We are responsible for the personal information we collect to operate the Mural website and hosted conversations, provide guest access and optional accounts, manage usage and any purchases, handle access requests, and respond to support enquiries. Contact us at hi@hackmamba.io about this policy or your information.

This policy covers mural.chat and the current Mural app provided by us. If you run a modified or independently hosted copy of the open-source software, that operator is responsible for its own practices.

Your conversations and learning history

Conversation transcripts, vocabulary, recall estimates, learning progress, and preferences are saved on your device. Mural does not store your learning archive or raw conversation audio on its servers. It also does not save raw audio in the local learning archive. Text you deliberately submit in a report or support message is an exception described below.

Supported builds offer Mural-provided conversation time or the option to use your own OpenAI API key. With your own key, voice and teaching requests go directly to OpenAI through your provider account. Your key is stored in Keychain on iOS or encrypted using Android Keystore on Android. It is not sent to Mural's servers or included in a learning-data export.

With Mural-provided time, Mural authorises and manages the live session. Your microphone audio travels between the app and OpenAI. Conversation instructions and relevant recent text pass through Mural's server when needed to start the session. Text needed for meanings, word explanations, typed replies, topic research, and learning feedback is also processed temporarily by Mural's server and sent to OpenAI. We do not save those ordinary request or response texts in our database or application logs.

Finishing a conversation can trigger a final review of its transcript to update your local learning record. If you ask for a current topic, the relevant request may use OpenAI's web-search service. These features require sharing the text needed for that request even though the learning archive stays on your device.

OpenAI processes requests under the account providing the AI service: yours when you use your key, or Mural's when you use hosted time. Its API data controls say content is not used for model training by default unless the account opts in. Default abuse-monitoring records can retain content for up to 30 days, with exceptions for legal requirements. Mural disables optional application storage where supported; this does not remove all provider retention. See OpenAI's data controls and privacy policy.

Share only what you want processed by the AI provider. Avoid including another person's private information without permission. Local storage also depends on your device security and any device backups or exported files you choose to keep.

Optional Mural accounts

Supported preview builds offer optional sign-in with Google or, when available, Apple. The options shown in your build determine which provider you can use. You can use a supported guest trial or practise with your own OpenAI API key without signing in. Signing in can preserve the remaining eligible guest allowance with your account. It does not upload your learning history, create another trial for an account that has already claimed one, or authorise a purchase.

If you sign in, we create a random Mural account identifier and store its creation date, your provider's account identifier, which provider you used, and a verified email address when the provider supplies one. That email may be an Apple relay address. The app retrieves your own account details to show your email and sign-in provider. We do not save your name or avatar. Mural does not receive your Google or Apple password.

To buy minutes on the website, enter the email shown in Mural’s Account screen. We send a verification code only when it matches one active account with a verified sign-in identity. Resend processes that email delivery. Website verification gives temporary access to checkout and the status of that account’s purchases; it does not sign you into the app or join accounts. Your browser keeps this checkout access in session storage for that tab. After opening Stripe, it briefly keeps an order reference so we can check your payment when you return. Cancelling or returning to the purchase page clears that reference and lets you choose a new pack. Codes and purchase access never appear in checkout URLs.

Google or Apple processes the authentication request and related account, device, and network information under its own policies. The provider sends proof of your identity so Mural can verify the sign-in. We process that proof to authenticate you, without retaining the provider's tokens or codes. See Google's privacy policy and Sign in with Apple & Privacy. These sign-in permissions do not give Mural access to your learning history through those providers.

Mural then issues its own sign-in session. The app stores that credential separately from your OpenAI key, using Keychain on iOS or encryption backed by Android Keystore on Android. Sign-in credentials are excluded from learning exports and do not sync to other devices. Our server stores a hash of the session token and its dates, rather than the usable token. Temporary hashed sign-in challenges help verify that a response belongs to the sign-in you started.

Guest access, conversation time and purchases

For a guest trial, the app creates a random installation token and stores it privately on your device. Our server stores a hash of that token, a random guest identifier, the allowance granted, its remaining balance and trial-eligibility records. No name or email is needed for guest access. This token identifies an app installation; it is not a device fingerprint or a claim that reinstalling always preserves the same identity.

If you sign in after using a guest trial, we record the guest-to-account link and the amount transferred so a retry cannot duplicate the allowance. We also retain grant records needed to honour issued time and prevent repeated free claims.

For Mural-provided conversations, we store session and request identifiers, the learning language, start and end times, connection duration, usage totals, cost and rate snapshots, reserved and settled balances, and completion or error status. Teaching-request records include their purpose and token or search totals. These records let us enforce limits, prevent duplicate charges and resolve interrupted requests. They do not contain ordinary transcripts, audio, prompts or teaching responses.

Purchases are offered only in enabled builds and supported locations. For a checkout marked “Sold through Link”, Stripe provides Managed Payments and Link acts as the merchant of record. Stripe and Link process checkout, billing and transaction data for payment, applicable taxes, fraud checks, receipts, refunds and transaction support under their privacy policy. Mural keeps the order, quoted value and fees, currency, transaction references, receipt-verification information, and payment or refund status needed to fulfil and reconcile it. Sensitive provider receipt references are encrypted at rest. We do not receive your full payment-card number or security code. Hackmamba Inc. remains responsible for the Mural account and service records described in this policy. A Mural account-deletion request does not automatically delete a separate Link account or independently held payment records; you can contact Link about those records.

For Google Play purchases in enabled Android builds, Google Play processes checkout and payment information under Google’s privacy policy. Mural sends Play keyed, obfuscated account and order identifiers to connect the purchase to your Mural account. The app sends the purchase token to Mural, which checks the order and any refunds with Google before adding or reversing purchased value. Mural retains the account-linked product, quantity, currency, quoted price and value, binding hashes, verified transaction and refund status, and reconciliation records. Sensitive purchase-token references are encrypted at rest. Mural does not receive your full payment-card details from Google. An interrupted purchase can be checked again from the app; a verified later payment remains tied to the original account. Deleting your Mural account does not remove payment records Google holds independently.

For Apple in-app purchases in enabled iOS builds, Apple handles checkout and payment information under Apple’s privacy policy. Mural shares an opaque order identifier with Apple to connect the purchase to the correct Mural account. Mural records the product, quantity, storefront, currency, quoted price, verified transaction references, fulfillment and refund status. These account-linked records support delivery, recovery, fraud prevention and refunds. Sensitive receipt references are encrypted at rest. Mural does not receive your full payment-card details from Apple. The app also keeps a local account-bound purchase recovery record so an interrupted purchase can be checked again.

If you connect another sign-in provider, Mural verifies both sign-ins and records the provider’s subject identifier against your existing account. It does not merge accounts based only on an email match. Remaining minutes sync through that account; local learning history does not. Test and production payment records are kept in separate service environments.

Reports you choose to send

When in-app AI reporting is available, you can review an excerpt of a Mural reply, select a reason and explicitly agree to send it. Only that selected text, its learning language, the reason, a random report identifier, the consent version and submission date are stored for review and service safety. The report does not automatically include your full conversation, audio, vocabulary or account sign-in token.

Reporting is optional. Ordinary conversations are not automatically submitted as reports. If reporting is unavailable, the app explains that and offers support instead. An email you choose to send is handled as support correspondence.

When you request access

The website asks for your email address so we can contact you about access to Mural. We store that address, the time of your latest request, the version of the consent wording you accepted, and the fact that the request came from the website. Repeating a request refreshes its date. The form gives the same success message for a new address and one already on the list, so it does not reveal who has requested access.

Submitting the form does not create an app account. There is no automatic email sequence. We may send an access invitation and messages needed to help you set it up. Your request does not subscribe you to a newsletter, advertising, or unrelated product updates.

Providing your email is optional. Without it, we cannot send you an invitation, but you can still browse the website and use the publicly available source code. You can withdraw your request at any time by emailing hi@hackmamba.io from the address you submitted.

Website, security, and support information

Cloudflare delivers and protects the website. It processes network and request information, such as IP addresses and technical details needed to deliver pages, detect threats, and maintain the service. Mural does not run advertising trackers or marketing analytics scripts.

To limit abuse of guest access, access requests, sign-in and reports, our backend keeps counters using protected identifiers derived from a network address or IPv6 network prefix. These database counters do not contain the raw IP address, and their network identifiers change each day. A separate short-window throttle uses network-derived counters in service memory. Account and session limits also use their random identifiers. We do not use these records to build a browsing profile. Infrastructure providers may process network information for their own delivery and security functions.

If you contact support, we receive your email address, your message, and any attachments or information you choose to send. Please do not send API keys, payment credentials, or a full conversation export when a short description will explain the problem.

Why we use this information

We use the information described above to provide the features you request, manage conversation allowances and any purchases, reconcile usage, review reports, manage access invitations, answer questions, protect the service, and meet applicable legal obligations. Where European or UK data-protection law applies, our bases for processing are:

• Your consent for retaining an access request and contacting you about that request. You may withdraw it without affecting earlier lawful processing.
• Providing the service you request for processing necessary to create and authenticate an optional account, show your account details, deliver a feature, or respond to a service request.
• Our legitimate interests in keeping the website available, preventing abuse, and resolving general support enquiries, subject to your rights and interests.
• Legal obligations when a law requires us to retain or disclose particular information.

Mural uses AI to suggest conversation difficulty and estimate word recall. Those are practice aids. We do not use them to make decisions about employment, admission, credit, or other matters with legal or similarly significant effects on you.

Who receives information and where

Account, guest, usage, billing, security, access-request and submitted-report records are stored in a PostgreSQL database on our Hetzner-hosted server in Germany. Cloudflare provides website delivery and security. Our email service providers process messages sent to and from support. OpenAI processes AI requests, your chosen sign-in provider handles authentication, and any payment provider shown at checkout processes the purchase, as described above. These providers receive information needed for their respective roles. Their relevant policies include Cloudflare's privacy policy and Hetzner's privacy policy.

We do not sell your personal information or share it for cross-context behavioural advertising. We may disclose limited information when required by law, to respond to a valid legal request, or when reasonably necessary to protect people, rights, or the service. A corporate transaction could involve transferring information to a successor, subject to applicable law and continued privacy obligations.

Mural is operated by a US-incorporated company, and our providers operate internationally. Information may be accessed or processed outside your country, including in the United States. Hosting the access-request database in Germany does not mean every service involved processes information only in Europe. Provider policies explain their processing locations and transfer arrangements. Contact us for information about transfers and safeguards relevant to information we hold about you.

How long information is kept

• Learning data: stays in the app until you delete it or replace it through an import. You control any separate exports or device backups.
• Accounts: the identifying profile and provider link are kept while your account is open. Completed account deletion removes the email, sign-in identities and sessions from the active database. A limited opaque account reference may remain with records that must be retained.
• Guest, trial, usage and billing records: are retained while needed to honour balances, prevent duplicate free grants or charges, reconcile interrupted requests and payments, and meet financial, fraud-prevention or dispute obligations. The current service does not apply an automatic deletion date to these journals. Deletion requests are reviewed against those purposes; ordinary conversation content is not part of these records.
• Mural sign-in sessions: expire after 24 hours. Expired or revoked records are removed during routine cleanup, normally every 15 minutes while the service is operating. Guest access also uses expiring sessions.
• Website purchase verification: codes expire after 10 minutes and work once. Pending email delivery is encrypted and cleared after delivery, use or expiry. Hashed challenge records are deleted 24 hours after expiry, and purchase-only sessions expire after 30 minutes. Cleanup normally runs every 15 minutes. Resend keeps email delivery records under its privacy policy. Completed purchase records follow the billing retention described above.
• Sign-in challenges: expire after five minutes. Their hashed records are removed during routine cleanup after expiry.
• Access requests: expire 12 months after your latest request, unless you withdraw sooner. Cleanup removes expired requests while the service is operating. We also remove requests when they are no longer needed to arrange access.
• Abuse-prevention counters: expire according to their purpose, generally within two hours for sign-in and short request windows, or within 48 hours for daily reporting and admission limits. Cleanup removes expired records while the service is operating. In-memory throttle counters are cleared as service memory is pruned or restarted. Persistent trial-eligibility records are separate, as described above.
• Submitted AI reports: expire 30 days after submission and are then deleted by cleanup, which runs at startup and normally every 15 minutes. An outage can delay physical deletion; expired reports are excluded from review.
• Support correspondence: is kept while needed to answer the enquiry and deal with related issues. We may retain relevant parts longer where needed for a legal obligation or a dispute.
• Backups: encrypted database backups on our server are retained for 14 days. Hosting-provider backups follow the provider's backup rotation. A deleted record may remain in a protected backup until that backup expires. If a backup is restored, subsequent deletions and expiry rules must be reapplied before restored records are used.

OpenAI and other providers have their own retention rules. Deleting data in Mural does not automatically remove information independently held by a provider or copies you saved elsewhere. We review requests involving our service providers and seek deletion where applicable, subject to required retention.

Your choices and rights

In the app, you can export your learning archive, import it on another device, delete local learning data, or remove your API key. You can stop an AI conversation and control microphone permission in your device settings. Removing a key prevents new authorised requests from the app; it does not revoke the key at OpenAI. Revoke a compromised key in your provider account.

You can request account deletion in the Account screen or through our account-deletion support page, including after uninstalling the app. Automatic deletion is available when it can safely complete; a remaining balance, active session or payment awaiting confirmation may require support review. We verify ownership and explain any steps needed. Requesting deletion does not itself cancel a payment or forfeit paid value. Deleting your account leaves local learning data on your device until you remove it separately. It does not delete your Google or Apple account.

Depending on where you live and the law that applies, you may have rights to access, correct, delete, or receive a portable copy of personal information we hold; restrict or object to its use; withdraw consent; or appeal a decision about a rights request. You may also complain to the relevant data-protection authority. We do not penalise you for exercising rights protected by law.

Send requests to hi@hackmamba.io. We may ask for information reasonably needed to verify that a request is yours, and will respond within the period required by applicable law. We cannot retrieve your on-device learning archive for you because we do not hold a server copy. Requests concerning information held independently by OpenAI, Google, or Apple may also need to be made to that provider.

Security and younger users

We use measures appropriate to the information we handle, including encrypted connections, restricted backend access, and encrypted database backups. Local learning files are kept in the app's private storage. Credentials use Keychain on iOS or encryption backed by Android Keystore on Android. The Android app excludes its private files and preferences from automatic cloud backup and device transfer; use a learning export to move your history. No service or device can promise complete security.

Mural is for adults aged 18 or over. We do not offer child accounts or a parental-consent system. If you believe someone under 18 has submitted personal information to us, contact hi@hackmamba.io so we can investigate and remove it as required. Users must also meet the eligibility requirements in our terms and those of services they use with Mural.

Future features and policy changes

Hosted guest trials and conversations are available in supported builds. Purchases appear only when checkout is enabled for your build and location; a direct-download Android build may use a separate payment channel. This policy describes purchase and reporting records so you can understand them before choosing those features. An access request or account does not authorise a payment, a content report or marketing.

We will update the date above when this policy changes. If a change materially affects how we use your information, we will provide a notice in the app or on the website before it takes effect where required. We will ask for a new choice where a change requires your consent.