MRVL Technologies ("we", "us", or "our") operates mobile applications and websites. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services.
The short version — what actually matters
✓
We don't sell your data. Never have, never will. Your information is used only to run our apps.
✓
Most apps work without an account. You only need to sign in if you want cloud sync or cross-device features.
✓
We don't store your payment details. All purchases go through Apple App Store or Google Play — we never see your card number.
✓
You can delete everything. Account and data deletion is available in-app, and we'll action any request within 48 hours.
✓
Location is opt-in only. We only use location data in apps that genuinely need it (e.g. finding nearby EV chargers), and only with your explicit permission.
1 Information We Collect
We only collect what we actually need. Depending on which app you use, this may include:
Account information: Name, email address, and password when you choose to create an account.
Usage data: How you interact with our apps — features used, session duration, and crash reports. This helps us fix bugs and improve the experience.
Device information: Device type, operating system version, and unique device identifiers. Used to diagnose technical issues and understand which platforms to support.
Content you create: Any content you upload, generate, or store within our apps (e.g. recordings, notes, invoices, photos). This data belongs to you.
Payment information: Subscription purchases are processed entirely by Apple App Store or Google Play. We do not receive, store, or have access to your card details.
Location data: Only where expressly required by app functionality (e.g. EV charger finder), and only with your explicit permission. You can revoke access at any time in your device settings.
Install attribution: Install source and launch counts, used to understand which marketing channels are working. This uses a hashed device identifier rather than your name or email. In apps where you sign in, it can be linked to your account; where that applies, the app-specific notice below says so (see section 13 for Imago).
Project enquiries: If you contact us to start a project — for example through our "Start a project" form — we collect your name, organisation, email address, and what you tell us about the project (what you'd like help with, where you're currently at, and your own description in your words). This is used only to review and respond to your enquiry; it does not add you to a marketing list, and we do not use it for any purpose beyond that engagement unless you separately agree otherwise. It is stored in Cobbl, MRVL's internal client-engagement system.
2 How We Use Your Information
We use the information we collect to:
Provide, operate, and maintain our apps and services
Improve, personalise, and expand our services
Understand and analyse how you use our apps so we can build better features
Send you service-related communications — account confirmations, security alerts, and important updates
Detect and prevent fraud, abuse, and security issues
Comply with legal obligations
We do not use your data for advertising, profiling, or to make automated decisions that significantly affect you.
3 Data Storage & Security
Your data is stored securely using industry-standard encryption. We use Supabase (PostgreSQL) for database infrastructure, with row-level security policies that ensure users can only access their own data. All data in transit is protected by TLS/HTTPS.
We take reasonable and proportionate steps to protect your personal information from unauthorised access, disclosure, alteration, or destruction. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by UK GDPR.
4 Third-Party Services
Our apps use the following third-party services to operate. Each has its own privacy policy and data practices:
Supabase: Database, authentication, and file storage infrastructure. Data is stored in the EU/UK region.
Apple App Store / Google Play: All in-app purchase and subscription billing. We never receive your payment details.
Stripe: Payment processing for web-based purchases where applicable. Stripe is PCI-DSS compliant.
OpenAI and other AI providers: AI-powered features such as writing assistance, transcription, and content generation. Content sent to these services is processed to generate a response and is not used to train their models under our enterprise agreements.
Attribr by MRVL: Our own install attribution and analytics SDK, operated by MRVL (not a third party). It collects install and launch events using a hashed device identifier, and in apps where you sign in it can link that identifier to your account. It does not collect your name or email address. See the app-specific notices (sections 12 and 13) for what each app does.
CrashrKit by MRVL: Our own crash-reporting SDK, operated by MRVL.
Shpd by MRVL (getshpd.app): Powers the Community tab in our apps, as described in the app-specific notices.
Fly.io and LiveKit: Used by Imago to host its recording service and to carry live audio and video between participants. See section 13.
Sign in with Apple: Offered by Imago as a way to create an account. See section 13.
5 Data Sharing
We do not sell, trade, or rent your personal information to third parties. We may share information only in the following limited circumstances:
Service providers: Companies that help us operate our services (e.g. hosting, analytics), under strict data processing agreements that prohibit them from using your data for any other purpose.
Legal requirements: Law enforcement or regulatory authorities when required by law, court order, or to protect the safety of our users or the public.
Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you with at least 30 days' notice before any such transfer takes effect, and you will have the option to delete your account.
6 Your Rights (UK GDPR)
Under UK GDPR, you have the following rights regarding your personal data. We will respond to all requests within 30 days.
Right of access: Request a copy of the personal data we hold about you.
Right to rectification: Request correction of any inaccurate or incomplete data.
Right to erasure: Request deletion of your data — the "right to be forgotten." For most apps, you can do this directly in-app under Settings → Account → Delete Account.
Right to restriction: Request that we limit how we process your data in certain circumstances.
Right to portability: Receive a copy of your data in a structured, machine-readable format.
Right to object: Object to our processing of your data where we rely on legitimate interests as the legal basis.
We retain your personal data for as long as your account is active or as needed to provide our services. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it by law (for example, financial records for HMRC compliance).
Crash reports and anonymous usage analytics are retained for up to 12 months, after which they are automatically deleted.
Imago works differently in some respects (immediate in-app deletion, and some records we keep for legal or third-party reasons). See section 13.
8 Children's Privacy
Our apps are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us immediately and we will delete that information promptly.
For apps specifically designed for younger audiences or educational use, we provide additional protections and parental controls as described within those apps.
Guard by MRVL includes an optional Family Protection feature that a parent or guardian uses to manage a child's device. It is set up and paid for by the parent or guardian, and its data is handled as described in section 12. Imago by MRVL is not directed to children either; see section 13.
9 Cookies & Tracking
Our mobile apps do not use cookies.
Our websites may use essential cookies required for the site to function (e.g. remembering your preferences). We do not use third-party advertising cookies or cross-site tracking. You can control cookie settings through your browser preferences at any time.
10 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by updating the "Last updated" date at the top of this page.
For material changes — those that meaningfully affect your rights or how we use your data — we will provide at least 14 days' notice via in-app notification or email before the changes take effect. Continued use of our services after that period constitutes acceptance of the updated policy.
11 Contact Us
If you have any questions about this Privacy Policy or how we handle your data, please get in touch:
This section applies to Guard by MRVL (bundle ID com.mrvltechnologies.guard) and adds to, and where different takes priority over, the general sections above for that app.
Your App Privacy Report
Guard analyses the App Privacy Report you import entirely on your device. Your report, the apps, domains and sensor events in it, and Guard's findings about them are stored on your device and are never uploaded to MRVL or to any third party.
What Guard sends to MRVL
Guard has no account system. After you give analytics consent in onboarding (you can withdraw it at any time in Settings → Privacy & Analytics), Guard sends the following to our own analytics and crash-reporting services:
Device and install identifiers: a hashed device identifier and a hashed app-install identifier (pseudonymous, not your name or Apple Account), used to count installs and launches.
App and device details: app version, iOS version and the country from your device's region setting.
In-app events: which screens or flows were used (for example "import completed"), never the contents of your report or the names of the apps in it.
Subscription events: the plan purchased, amount and Apple's transaction identifier, so we can measure revenue. We never receive your payment details.
Crash and diagnostic reports: technical data about a crash, sent together with the same hashed app-install identifier and used to fix bugs. Guard blocks report evidence and email addresses from being included.
Email address (optional): only if you choose to enter it in Settings to receive MRVL updates, and only for the purposes you tick. You can unsubscribe at any time.
We do not use this data for advertising or tracking, and we do not share it with data brokers. Analytics and crash data are kept for up to 12 months. You can ask us to delete the analytics data associated with your device from Settings → Privacy & Analytics, or by contacting us. Analytics stay off on a device until consent has been given on that device.
Community
The Community tab uses our Shpd service. Voting, following the roadmap and reading help articles use a random identifier generated on your device, and Shpd records basic usage events against it (for example which Community screens you open). No account is required, and these events are kept separate from the analytics identifiers described above.
Family Protection
Family Protection is an optional feature, available with the paid Family plan, that helps a parent or guardian manage screen time on a child's iPhone. It uses Apple's Screen Time frameworks (Family Controls, Managed Settings and Device Activity).
App and category choices are made with Apple's own picker. Apple represents your choices as opaque tokens that stay on the device; Guard and MRVL cannot see which apps were chosen and they are never sent to us.
Family details — the family and child names or labels you enter, routines, chores and their status, rewards, and the pairing details needed to link the two devices — are stored in your family's own iCloud (Apple CloudKit), in a private container shared only with the Apple Account the parent invites. MRVL does not run a server for this data and cannot read it. Apple processes it under Apple's terms and privacy policy.
The child's Apple Account (email address or phone number) is entered by the parent solely so Apple can send the iCloud invitation. It is resolved by Apple on the device and is not sent to MRVL.
The child's device does not need its own purchase. Family data is kept out of Guard's analytics and crash reporting.
Children: Family Protection is designed to be set up and controlled by a parent or guardian, who is responsible for using it in line with the law where they live and for any consent needed for their child. We do not knowingly collect personal information from children on our own servers. A parent can remove a child from Guard at any time, and can revoke Guard's Screen Time access in iOS Settings or delete the shared data through their iCloud settings; deleting Guard from a device removes its local data.
Your choices
Withdraw analytics consent or request deletion of analytics data: Settings → Privacy & Analytics.
Cancel or manage your subscription in your Apple Account settings.
Remove a child at any time from within Guard, or revoke Guard's Screen Time access in iOS Settings.
Your UK GDPR rights (section 6) apply to the data MRVL holds about you. Contact us at support@mrvltechnologies.com.
13 Imago by MRVL — App-Specific Notice
This section applies to Imago by MRVL, our app for recording podcasts and interviews with remote guests, and to the web page guests use to join a session. It adds to, and where different takes priority over, the general sections above for that app.
What Imago collects
Account details: your email address and name, if you sign up with email and password or with Sign in with Apple (Apple may let you hide your real email address behind a relay address). You can also set a display name.
Your recordings and content: your microphone audio, which is recorded during a session and uploaded to your Imago account; photos or videos you or your contributors add to a shared media pool; and the projects, episode titles, transcripts, invitations and Community ideas or stories you create.
Live camera video: if you turn your camera on in a session, the video is transmitted live to the other participants. Imago does not record or store that live camera video.
Identifiers: your account's user ID, a hashed device identifier (derived from Apple's vendor identifier for MRVL apps, the app and a salt, so the raw identifier does not leave your device), and a hashed per-installation identifier. We do not use the advertising identifier (IDFA).
Network fingerprint: when an app is first installed, Attribr combines your IP address and device/browser type into a one-way hash used for install attribution; the hash is stored, the raw IP address is not. The country is taken from your device's region setting. Only if a device does not supply a region does the server fall back to looking up the country from the IP address with a third-party geolocation service (ipapi.co).
Purchase history: the product, amount, currency and Apple transaction identifier for subscriptions you buy. Purchases are processed by Apple, and we never see your card details.
Usage and diagnostic data: app launches (including how long since your last launch), the app and iOS version, device model, the country from your device's region setting (not GPS location), an attribution code if you came from an MRVL web page, and Community usage events.
Crash reports: technical data about a crash, such as app and OS version and device model. Imago does not attach a device or user identifier to crash reports.
Push notification token: your device's Apple push token, sent to Attribr. We use it to send silent technical notifications that help us tell when the app has been uninstalled. It is not used for advertising.
Email updates (optional): only if you choose to enter your email in Settings to receive MRVL updates. This is separate from your account and you can unsubscribe at any time.
Guests who join from a web browser
Guests do not need an Imago account. When you join a session from a link, we handle the display name you enter, your microphone audio during the session (and your camera video if you switch it on, which is transmitted live and not recorded), and the invitation or join token in your link. If the join page hits a technical problem it can send a short diagnostic report (error details and your microphone permission state) to our recording service, where it is written to a technical log; it is not saved to a database. A guest's recording is stored in the host's project, and the host controls that project. Where a guest contributes to a shared media pool, we keep a record of the consent given. To ask about or request deletion of a guest contribution, contact the host or support@mrvltechnologies.com.
Why we use it
App functionality: signing you in, recording, uploading and storing your sessions, connecting participants, processing purchases, and running Community.
Analytics and attribution: counting installs and launches, measuring which MRVL web pages lead to installs, and measuring subscription revenue. In Imago, once you are signed in, Attribr links the hashed device identifier to your account, so this data is pseudonymous but linked to you. Imago currently sends this analytics from first launch and does not show a separate analytics consent step.
Crash diagnostics: finding and fixing bugs.
We do not use Imago data for advertising, we do not track you across other companies' apps or websites, we do not use the advertising identifier or ask for App Tracking Transparency permission, and we do not share Imago data with ad networks or data brokers. Attribr and CrashrKit are operated by MRVL.
Who processes it
Supabase: accounts, database and file storage for Imago. The Imago project is hosted in the eu-west-2 (London) region.
Fly.io: hosts the Imago recording service (app imago-recording-prod, London region), which receives and processes uploaded audio.
LiveKit: live audio and video transport between participants during a session.
Shpd (getshpd.app): the Community tab. It uses a random identifier generated on your device, records basic usage events against it, and receives the ideas, stories and reports you choose to submit.
Attribr and CrashrKit (MRVL): analytics, attribution and crash reporting, as above.
Apple: Sign in with Apple, in-app purchases (StoreKit), push notifications and the App Store.
Some of these providers operate internationally, so some data may be processed outside the UK.
Keeping and deleting your data
We keep your recordings and other content until you delete them or delete your account. You can delete your account in the app at Settings → Account → Delete account: you type the word DELETE to confirm, and deletion happens immediately and cannot be undone. There is no grace period. Crash and analytics data follow the retention period in section 7.
What deletion removes:
Your profile details (email, name, avatar and bio are cleared) and your preferences.
Everything in your own workspace: projects, sessions, recordings and their stored files, assets, transcripts, edits, clips, media and brand kits, audience data, publishing connections and stored credentials, shared media pool contributions, and invitations. Your membership of other people's workspaces is removed.
Your sign-in account itself.
What we keep, and why:
Billing, subscription and transaction records, with your email, company, address and tax details removed, because they are financial and audit records, including your Apple transaction history.
Records of consent given by third-party contributors to a shared media pool (the pool title is anonymised and the contributions are deleted), because they are evidence for those contributors.
An internal audit log containing only an account ID and counts, and an entitlement record marked revoked. Neither contains personal details.
Content you created inside someone else's workspace stays there, attributed to an anonymised profile, because the other owner still needs their project.
Backups are not purged on demand and age out under our ordinary backup cycle.
Deleting your account does not cancel an Apple subscription; cancel it in your Apple Account settings (the app links to Apple's Manage Subscriptions). If you have an active web subscription, or you own an organisation workspace that still has other members, the app will ask you to cancel it or transfer ownership first, and nothing is deleted until you do. Connections you made to other platforms (for example YouTube or Instagram) are deleted from our systems but we do not revoke them at that platform, so you may also want to remove them in that platform's own settings. If you cannot use the in-app option, contact support@mrvltechnologies.com.
Children
Imago is not directed to children under 13, and we do not knowingly collect personal information from children under 13 (see section 8).