Merji Privacy Policy

Version 1.6 · Effective 2026-09-23

1. Who we are

Merji / ميرجي is a private capture-and-recall app operated by its independent owner-developer in Saudi Arabia, the controller of your personal data. Contact [email protected] for privacy, support, or data-rights requests. We aim to acknowledge requests within 7 days and respond within 30 days.

2. What we collect and why

We process your account and sign-in details; content you choose to save and the information extracted from it; your library organization and edits; and purchase, credit, consent, device, usage, and security records. Saved content may include photos, public links, notes, and text or audio obtained from those links.

We use this information to provide your account, save and organize content, help you find it, manage purchases, and provide support under our agreement with you. We also protect the service and prevent fraud based on legitimate interests, and retain information where required for legal or financial duties. Where we rely on your consent, you may withdraw it.

Merji has no ads, does not track you across apps or websites, and does not sell your personal data. You choose what to save; you can browse, export, or delete your existing library without submitting new content for processing.

3. Service providers

Merji sends the content and optional notes you choose to save to OpenAI for automated extraction. Other third-party service providers may process video audio for transcription, retrieve content from public links, and support hosting, storage, service emails, security, payments, and place-name lookup.

These providers receive information needed for their services and may process it outside Saudi Arabia. Content you submit may itself contain personal information.

We do not attach your email or Merji account identifier to extraction, transcription, or link-retrieval requests.

If you choose third-party sign-in, we receive the name, email, and sign-in identifier supplied by that service; we do not send your library to sign-in services. Apple handles App Store purchases.

Copies retained by service providers are subject to their own retention arrangements. Merji deletes its temporary video, audio, and video-frame files after processing.

Contact [email protected] for current provider and international-transfer details.

When you save or correct a Place, MERJI uses Google Maps Platform to find its location. We share the place search text and relevant location context with Google; we do not include your MERJI account identifier. When you view a Google map, Google's map service also receives the requests needed to display it. Google processes information under its own Privacy Policy, and use of Google Maps is subject to Google Maps terms.

We keep Google's place identifier to recognize the location. Google coordinates are temporary and expire; Google business names and addresses are used only while checking a match or showing live correction suggestions. Your saved Source name and details remain MERJI content.

4. Retention and protection

Account and library data remain while your account is active. Deleting an item removes it from your live library; deleting your account removes your account and library from live systems. Encrypted backup copies expire within 35 days.

Security, audit, and inactive-session records may remain for up to 180 days. Limited purchase, refund, and financial records may remain longer where needed for fraud prevention, Apple obligations, accounting, or legal claims; they do not preserve your deleted library. We use encryption and access controls to protect information, but no online service can guarantee absolute security. We notify affected people and authorities when the law requires it.

To prevent repeated claims of introductory credits, we retain a keyed fingerprint of a mailbox that has received those credits, including after account deletion. We use it only to recognize a previous claim. The record contains no plaintext email, account identifier, saved content, or claim timestamp. It remains for as long as we enforce the one-welcome-per-mailbox policy. A keyed fingerprint is pseudonymous information, not irreversible anonymization.

5. Your choices and rights

You can export your data or delete your account in the app, including before email verification. Under applicable Saudi data-protection law, you may request information, access, a copy, correction, or deletion, and withdraw consent. Contact [email protected] to exercise these rights. You may also raise a complaint through SDAIA's official personal-data-protection channels.

You can withdraw permission for content processing to stop new saves and processing that require it, while keeping access to browse, export, and delete your existing library. Withdrawal does not cancel processing requests already submitted.

Merji is not directed to children under 13; users below the age of majority need guardian approval. Material policy changes receive a new version and effective date and are presented before new consent-dependent processing.