Privacy Notice

Who we are

Marrin is a wellness app and website (marrin.app) that builds a daily plan of workouts, meals, water and rest. Marrin is provided by Streamline Studio, Cairo, Egypt, which decides how and why your personal data is used and is responsible for it (the "controller"). In this notice, "Marrin", "we" and "us" mean Streamline Studio. Marrin is offered in Saudi Arabia and Egypt. This notice explains what personal data we collect, why, who helps us process it, how long we keep it and the rights you have. It applies to the Marrin apps for iPhone, Apple Watch, Android and Wear OS, and to marrin.app. We have not appointed a data protection officer. For any privacy question or request, write to hello@marnai.app.

Information we collect

From you, when you create and use an account: • Account details: your name, email address, and your phone number if you sign in with it; your password (stored only as a one-way hash); or your Google or Apple account identifier if you sign in with one of them. If you set up a passkey or two-step verification, we store what is needed to check it. • Your profile: date of birth, gender, height, weight, goal, experience level, available equipment, work schedule, food preferences, allergies and dietary needs, and your answers to the health questions in onboarding (for example pregnancy, health conditions, medication or injuries, and any note you add). • What you log: workouts, meals, water, habits, sleep and other progress, and your daily coach check-ins and their notes. • What you write: feedback when you ask for a new plan, community and challenge names and descriptions, reports about content or members, and problem reports you send us, with any contact detail you add. • Your choices: your consents (with the version and date), notification and reminder settings, workout buddies you connect with, and members you have blocked. • Profile photo, if you add one. From your devices and connected services, only if you allow it: • Health and fitness readings from Apple Health, Health Connect, WHOOP, Google Health or Huawei Health, and heart rate read by the Marrin Apple Watch or Wear OS app during a workout — see the next section. Automatically, when you use Marrin: • Device and app information: device type, operating system and app version, language, a device identifier we create, and the push-notification token for your device. • Security records: sign-in sessions, IP address and browser or device details when you sign in, change security settings or delete your account. • App usage (analytics): which screens and features you use, linked to an internal Marrin ID — never your name, email, phone number, free text or health values. You can turn this off. • Crash reports and diagnostics from the app, and error reports from our servers when a request fails: the technical details of the error, which part of the service it affected, when it happened and your internal Marrin ID — not the contents of what you sent. When you buy a package on marrin.app: • Payment details: the package, period, price, currency and any coupon; the payment's status and dates; and Paymob's reference for the payment. You enter your card or wallet details on Paymob's secure payment page, not in Marrin: we never see or store your full card number or security code. • A saved card, only if you choose to save one for automatic renewal: a card token from Paymob that lets us charge that card (stored with our own encryption), with the card brand, the last four digits and the expiry month and year, so you can recognise it. From the website: the details you give in the waitlist or business enquiry forms (name, email, phone if given, country, goal or company details), with the date, IP address and browser of the submission, and campaign information about how you reached the site. What we do not collect: your precise location, contacts, browsing history, advertising identifier or audio — and never your full card number or card security code.

How we use it, and why

We use your data only for the purposes below. For each one we name the legal reason that allows it. • To provide Marrin to you — create and run your account, build and adjust your daily plan, workouts and meals, show your progress, run communities and challenges, and answer your support requests. Reason: to provide the service you asked for under our Terms (contract). • To use your health information — your health answers, body measurements, logged activity, connected health readings and coach check-ins, to tailor your plan and coaching. Reason: your explicit consent, which Marrin asks for before you start. • To keep Marrin and its members safe — protect accounts, detect misuse and fraud, check what members type for signs of crisis so we can show support resources, review reports about community content, and keep security records. Reason: our legitimate interest in a safe and secure service, and the safety of members. • To send messages — service messages you need (sign-in codes, email verification, password resets, security alerts) and the reminders and notifications you turn on. Reason: contract. News and offers only if you opt in. Reason: your consent, which you can withdraw at any time. • To take payments — set up the payment for a package you buy with Paymob, start or extend your plan, renew it by card if you turned on automatic renewal, refund payments, and check our records against Paymob's. Reason: to provide the service you asked for (contract). We keep payment records to meet tax and accounting rules. Reason: legal obligation. • To understand and improve Marrin — usage analytics, crash reports and server error reports. Reason: our legitimate interest in fixing problems and improving the app; you can turn analytics off. • To meet legal obligations — answer lawful requests from authorities, keep records the law requires, and handle your privacy requests. Reason: legal obligation. We do not sell your personal data, use it for advertising, or share it with data brokers.

Your health data

Much of what Marrin uses is health data: your health answers, body measurements, logged activity and sleep, connected health readings and coach check-ins. The law treats this as sensitive personal data, and we handle it with extra care. • Consent first: before you use Marrin, the app asks you to agree that Marrin and its AI service provider may process your health information to build and adjust your plan. Connecting each health source is a separate, optional permission that you give on your device or at the provider. • Withdrawing consent: you can disconnect any health source at any time (Profile → Health & wearables, or in your device or provider settings). Marrin cannot build a plan without the health information you enter, so to withdraw your consent to that processing completely, you delete your account. • No diagnosis: Marrin gives general wellness guidance. It does not diagnose, treat or prevent any condition and does not replace your doctor. • Limited use: we use health data only to provide Marrin's features to you. We never sell it, use it for advertising, share it with data brokers, or use it to decide creditworthiness, insurance or lending eligibility.

Health Connect, Apple Health, WHOOP, Google Health and Huawei Health

Connecting a health source is optional. If you choose to, Marrin reads health and fitness data from Health Connect (Android) or Apple Health (iPhone) on your device, and from WHOOP, Google Health or Huawei Health if you link those accounts. Data we read: steps, distance, active and total calories burned, exercise sessions, sleep (including sleep stages), weight, heart rate, resting heart rate, heart rate variability (HRV), blood oxygen and respiratory rate. From WHOOP we also read your recovery and strain scores, and WHOOP, Google Health and Huawei Health may also provide skin temperature measured during sleep. You decide which permissions to grant and can grant only some of them. What Marrin writes: Marrin never writes, changes or deletes data in Health Connect. The Marrin iPhone app only reads from Apple Health. If you record a workout with the Marrin app on Apple Watch, that workout is saved to Apple Health. The Marrin Apple Watch and Wear OS apps read your heart rate during a workout to show it live and in your workout summary, and the workout result is saved to your Marrin account. When we read it: Marrin reads Health Connect and Apple Health only while the app is open — when you open it, return to it or refresh — and never in the background. WHOOP, Google Health and Huawei Health are cloud services: once you link them, your data syncs to Marrin through the provider's API, including when the provider notifies us that new data is available. How we use it: only to provide Marrin's features to you — your health summary and Marrin score, updates to your daily plan, and AI coaching (see "AI processing"). Your control: you can disconnect at any time in the app (Profile → Health & wearables), in Health Connect settings or the iPhone Health app, or in your WHOOP, Google or Huawei account settings. Disconnecting stops Marrin reading new data; for WHOOP, Google Health and Huawei Health we also revoke Marrin's access and delete its tokens. Readings already synced stay in your account until you delete your account {C9}; when you do, all connected health data and tokens are deleted straight away. The use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements. Marrin's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Medical reports

Marrin has a medical-report feature that is not currently offered. If you uploaded lab reports while it was available, the files and the results read from them stay stored encrypted, and only you can see them, until you delete them (Profile → Privacy & security → Delete my medical reports) or delete your account. While the feature is not offered, no AI service provider reads reports, and your reports are not used for coaching. If we offer the feature again, we will update this notice and ask for your consent before any new upload.

AI processing

Marrin uses artificial intelligence to write your plans and coaching. Our AI service provider is Groq, Inc., which processes the data only on our behalf, under our instructions. What is sent: to generate your program, workouts and meal plans, the relevant parts of your profile and health answers (for example your goal, measurements, experience, equipment, food preferences, allergies and health notes), and any feedback you write when you ask for a new plan. For coaching, your daily coach check-in and recent activity, sleep and connected readings. We do not send your name, email address or phone number. Safety checks: before your text reaches the AI, Marrin checks it for signs of crisis, self-harm or disordered eating, and checks the AI's answers before you see them. The text you type is also screened by an AI safety model run by Groq, so that Marrin can route you to crisis support when needed. If a check finds a concern, Marrin shows you support resources instead of a plan. What it means for you: the AI produces suggestions for your plan. You decide whether to follow them, and you can change or regenerate them. Marrin does not use AI to make decisions that have legal or similarly significant effects on you. For members under 18, Marrin applies extra limits, such as no calorie deficit and no advanced exercises. Please do not enter sensitive information about other people.

Communities

In communities and challenges, other members see you under a pseudonymous label, not your name or photo, in member lists, leaderboards and badges. Workout buddies you connect with see your first name, whether you showed up today and your workout days in the last 7 days — the only place Marrin shows your name to other members. Buddies do not see your health answers or readings. Names and descriptions of communities and challenges you create are visible to their members and are checked against a list of blocked terms before they are saved. There is no chat, feed or media upload. You can report a community, a challenge or a member, and block a member (Profile → Privacy & security → Blocked members). The Marrin team reviews every report and may remove content, remove a member from a community or suspend an account.

Who we share data with

We share personal data only with service providers that run parts of Marrin for us. They act on our instructions, may use the data only to provide their service to us, and must protect it: • Cloudflare — website and app hosting, the API servers (in Western and Eastern Europe), and sending email (for example sign-in codes). • Neon — our main database (Frankfurt, Germany, EU). • Upstash — temporary data for background jobs and caching. • Google Firebase — sign-in (including phone sign-in by text message), email delivery, file storage (EU), push notifications, usage analytics (Google Analytics) and crash reports (Crashlytics). • Sentry — error monitoring for our servers (Frankfurt, Germany, EU): reports of server errors, linked only to an internal Marrin ID. • Groq — AI generation of plans and coaching, and safety checks (see "AI processing"). • Paymob — payment processing for packages bought on marrin.app in Egypt and Saudi Arabia (Egypt / Saudi Arabia, per Paymob). To set up a payment we send Paymob your name, email address, phone number (if you gave one) and the amount; you give your card or wallet details to Paymob directly on its payment page. If you save a card, Paymob keeps it and gives us only a token for it. • GitHub — encrypted copies of our database backups. When you link WHOOP, Google Health or Huawei Health, or sign in with Google or Apple, you also share data with that company under its own privacy policy; they are sources of data for Marrin, and we do not send them your Marrin data. Apple and Google also deliver push notifications to your device. We may disclose data if the law requires it, to protect members' safety, or as part of a sale or reorganisation of our business, in which case this notice will continue to apply to your data. We do not share your data with anyone else.

International transfers

Marrin is offered in Saudi Arabia and Egypt, but our service providers store and process data in other countries: our database, API servers and server error reports (Sentry) are in the European Union and Europe; Google (Firebase), Groq and GitHub process data in the United States and other countries where they operate; Paymob processes payments in Egypt and Saudi Arabia; and Cloudflare serves the website and app from locations worldwide. We transfer data abroad only where the law allows it and with safeguards such as contracts that require the provider to protect it. You can ask us for more information about these safeguards at hello@marnai.app.

How long we keep data

We keep personal data only as long as we need it: • Your account, profile, plans and logs: while your account is open. After you delete your account, they are permanently deleted 29 days later (see "Account deletion and restore"). • Connected health readings and tokens: until you delete your account, when they are deleted straight away. • Medical reports: until you delete them or your account. Uploaded files were set to be deleted 30 days after you confirmed their results, unless you chose to keep them. • Coach check-ins: 365 days, or until you delete them or your account. • Problem reports: while your account is open; the contact detail you add is removed 90 days after the report is closed, or when you delete your account. • Security records (sign-in events, IP address and device): 365 days, including after an account is deleted. Expired or ended sign-in sessions: 30 days. Expired one-time codes: 7 days. • Notification history: 180 days. Records of AI usage (counts and costs, not what you wrote): 400 days. • Website waitlist and enquiry details: until you ask us to delete them, or until you delete a Marrin account with the same email address. • Usage analytics in Google Analytics: kept for the retention period set in our Google Analytics account (no longer than 14 months). This data is linked only to an internal Marrin ID and is not deleted when you delete your account. • Crash reports in Firebase Crashlytics: about 90 days. • Server error reports in Sentry: about 30 days. • Saved cards (card token, brand, last four digits and expiry): until you remove the card, or until your account is permanently deleted. • Payment records (package, amount, currency, dates, status and Paymob's reference): kept as financial records, including after you delete your account; once your account is permanently deleted, they are kept without your name or contact details. • Backups: copies of deleted data can remain in our encrypted database backups for up to 30 days, after which the backups are overwritten. We may keep data longer where the law requires it or to establish or defend legal claims.

How we protect your data

• Encryption: data is encrypted in transit between the app, the website and our servers, and our database and file storage are encrypted at rest by our providers. We add our own encryption for the most sensitive items: medical-report files (encrypted before they are stored), the access tokens for connected health services, the card token of a saved card, the Live Activity data on iPhone, and the details we keep to let you restore a deleted account. • Access control: only authorised Marrin staff can reach member data, through an admin portal that requires a passkey or other second factor, with every sensitive action recorded in an audit log. Staff see only what their role needs. • Account protection: passwords are stored only as one-way hashes; sign-in attempts are rate-limited; you can add two-step verification or a passkey, and deleting your account signs you out everywhere. • Minimisation: analytics and crash reports never contain your name, email, phone number, free text or health values. Server error reports leave out the contents of your requests, cookies and sign-in tokens, we remove email addresses from them, and they are linked only to an internal Marrin ID. No system is completely secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

Your rights

Depending on where you live, you have the right to: • know how your data is used (this notice) and get access to it; • get a copy in a portable format — in the app, Profile → Privacy & security → Download my data gives you a file with your account data; • correct inaccurate or incomplete data — most of it you can edit in the app; • delete your data — Profile → Privacy & security → Delete account, or see "Account deletion and restore"; • withdraw consent at any time, without affecting processing before you withdrew it — turn off "Send me news and offers" or "Share usage analytics" in Privacy & security, disconnect health sources, or delete your account (see "Your health data"); • object to, or ask us to restrict, processing based on our legitimate interests; • complain to a data protection authority: in Saudi Arabia, the Saudi Data and Artificial Intelligence Authority (SDAIA); in Egypt, the Personal Data Protection Centre. For anything you cannot do in the app, email hello@marnai.app from the email address on your account. We may ask you to confirm your identity before acting on a request, and we answer within the time the law sets. We will not treat you differently for using your rights.

Children and teens

You must be 13 or older to use Marrin. We ask for your date of birth when you start, do not accept anyone younger than 13, and delete any account we learn belongs to a child under 13. If you are 13 to 17, a parent or legal guardian must agree before you can use Marrin. When your date of birth shows you are under 18, the app asks for your parent's or guardian's email address and we email them a link that works once and expires after 7 days. The page it opens explains what Marrin collects and how it is used, and lets them approve or decline. Until they approve, we do not collect your health information, do not create AI plans or coaching for you, and do not let you use communities, health records or meal photos — you can still sign in, change your settings, download your data or delete your account. When a parent or guardian answers, we record their email address (stored encrypted), the relationship they confirmed, the date and time, the IP address and browser details of their decision, and the version of the notice they saw. They can withdraw their consent at any time with the link in the confirmation email; your account is then limited again to signing in, downloading and deleting your data until a parent or guardian approves again. These records are included when you download your data and deleted when you delete your account. Once you turn 18, you no longer need a guardian's consent. For members under 18, Marrin plans to maintain weight rather than lose it (no calorie deficit), does not suggest advanced exercises, adds teen-specific guidance to AI plans, and encourages you to talk to a parent, guardian or doctor about your goals. Parents or guardians who have a question or want a teen's account deleted can write to hello@marnai.app.

Account deletion and restore

You can delete your account at any time in the app (Profile → Privacy & security → Delete account), or without the app by emailing hello@marnai.app from your account's email address with the subject "Delete my account". What happens straight away: you are signed out on every device; your name, email address and phone number are removed from your account; your consents end; your connected health data and tokens, medical reports and community memberships are deleted; and if you signed in with Apple, we revoke Marrin's access to your Apple account. 29 days to change your mind: the rest of your data (profile, plans and logs) is permanently deleted 29 days after you delete your account. Until then, you can restore it by signing in again the same way: Marrin offers to restore your plans and progress. To make that possible, we keep your email address, phone number and name encrypted until the permanent deletion. Health data, connected apps, medical reports and community memberships cannot be restored, and you will be asked to agree to the Terms and this notice again. Records we keep after deletion are described in "How long we keep data". Our account deletion page has the details.

• How to delete your account

This website and cookies

marrin.app uses Cloudflare Web Analytics to count visits. It does not use cookies or track you across other sites. The site stores two small preferences on your device, only to make the site work as you chose: a cookie that remembers your language (kept for one year) and, in your browser's storage, your light or dark theme. If you fill in the waitlist or business enquiry form, we use the details as described in "Information we collect".

Changes to this notice

We will update this notice when our data practices change, and show the date of the latest version at the top. When we make an important change, or one that needs your agreement, the app asks you to review and accept the new version before you continue.

Contact

Privacy questions or requests: hello@marnai.app. Streamline Studio, Cairo, Egypt.