Privacy Policy

Effective date: July 2, 2026

Marrow is an iOS app that turns a social video link you share (from TikTok, Instagram, or YouTube) into a structured "action card" — for example, a recipe, workout, or travel plan. This policy explains what we collect, why, where it is stored, and the choices you have. We have written it to describe what the app actually does, not a generic template.

Who we are

"Marrow", "we", "us", and "our" refer to the makers of the Marrow app. You can reach us at support@marrowapp.xyz.

Information we collect and process

• Account email. When you create an account we collect your email address through our authentication provider (Supabase Auth). You can also use the app with an anonymous session, in which case no email is collected but an anonymous account identifier is created.
• Profile details. If you set a display name or username, we store it with your account. If you upload a profile photo, the image is resized on your device and stored in our cloud storage; a link to it is saved with your profile.
• Links you share for processing. When you share or paste a video link, we send the link and its platform to our backend so it can produce your card (see "How link processing works" below).
• Usage counts. We keep a per-account count of how many extractions you have run in the current period, so we can apply free-tier limits.
• Processing telemetry. For each AI extraction we record technical metadata — the model used, token counts, an estimated cost, and a confidence value. This helps us monitor reliability and cost. It does not include the video itself.

Where your saved cards live

The action cards you save are stored locally on your device. Marrow does not upload or sync your saved cards to our servers. Because they live on your device, they remain there until you delete them in the app or remove the app.

How link processing works

When you share a link, our backend (Supabase Edge Functions) first fetches the public caption or title for the post using the platform's public oEmbed endpoint. When a caption alone is not enough, the link is passed to a self-hosted processing worker that transiently downloads the video and transcribes its audio to text so the content can be extracted. We do not store or redistribute the original video — it is processed and discarded. The caption and/or transcript are then sent to an AI model to extract the structured card. We retain the original source URL and the creator's handle so every card credits its source.

We do not sell your personal data, and we do not use your content to train our own AI models.

Third parties that process data for us

• Supabase — hosts our authentication, database, cloud storage (profile photos), and backend functions. Receives: your email/anonymous account id, profile details and photo, usage counts, and processing telemetry.
• NVIDIA (AI inference API, integrate.api.nvidia.com) — hosts the AI model that extracts the card. Receives: the caption and/or audio transcript derived from the link you shared. Used only to generate your card.
• Our self-hosted transcription worker — downloads the shared video transiently and transcribes its audio. Receives: the video URL you shared. The video is not retained after processing.
• TikTok, Instagram, and YouTube — we request the public caption/title for the link you share via their public oEmbed endpoints.
• Email delivery provider — transactional emails (such as sign-in or verification messages) are sent through the email service configured for our authentication provider. Receives: your email address and the message content.

Retention

Account data (email/anonymous id, profile, usage counts, and processing telemetry) is retained until you delete your account. Cards saved on your device remain on the device until you delete them, delete your account, or remove the app. Videos are never retained — they are processed transiently.

Your rights and choices

You can delete your account and its associated data directly in the app: open Settings → Delete Account. This permanently removes your profile, usage counts, and processing telemetry, and deletes your authentication account. It also clears the action cards and grocery list stored on that device. This cannot be undone.

For any other privacy request, contact us at support@marrowapp.xyz.

Children

Marrow is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the effective date above and, where appropriate, notify you in the app.

Contact

Questions about this policy? Email support@marrowapp.xyz.