Privacy Policy

Our Privacy Principles

What Data the App Uses

Important: Mortui (the company) operates no servers and receives none of your data. Your behavioral data, configuration and vault contents are processed and stored only on your device, and are never transmitted anywhere. There are two exceptions, and both are the purpose of the app. When the switch fires — or when you send a test — the messages you wrote and the files you attached are sent from your device, through the email account you connected, to the recipients you named. And if you add emergency contacts, your phone sends them a short text message during the countdown, asking them to check on you. We never see either kind of message and hold no copy of it.

Behavioral Metrics

The Mortui app processes behavioral data locally on your device for the purpose of establishing your baseline patterns and detecting anomalies. This data never leaves your device. This includes:

• App usage patterns: Aggregate counts of app opens, screen time duration, and interaction frequency. The names of your most-used apps are recorded so the app can describe your own patterns back to you; they stay in the encrypted database on your device and are never transmitted
• Device interaction: Screen unlock frequency, screen-on duration, and typing activity
• Physical activity: Daily step count from your device’s low-power step counter. Mortui does not read the accelerometer, gyroscope, or any motion sensor
• Circadian data: Typical active hours and sleep patterns based on device usage timing

Configuration Data

Your configured preferences are stored locally on your device only:

• Action settings: Files to delete, recipients for messages, vault file settings
• Emergency contacts (optional): If you add any, the name and mobile number of up to three people you type in by hand, plus the name you want them to know you by and the wording of the text they would receive. Details in Emergency Contacts and Text Messages below
• Encrypted vault files: Files stored in the secure vault are encrypted on-device using AES-256-GCM. Only metadata (filename, type, size, date, and any description you add) is stored in the database; file contents remain encrypted on disk and are never transmitted to Mortui servers
• Authentication data: Hashed PIN, encrypted security questions, biometric enrollment status
• Email credentials: OAuth tokens or encrypted SMTP passwords for message delivery

Emergency Contacts and Text Messages

Emergency contacts are optional. If you add them, Mortui can ask a person you trust to check on you before it deletes or delivers anything. Doing that requires storing a phone number and sending a text message from your phone, so this section sets out exactly what is stored, what is sent, when, and to whom.

What Is Stored, and Where

For each emergency contact, the app stores the name and mobile number you typed in and the date the contact was verified, in the same encrypted database as the rest of your configuration. The name you chose to be known by in those messages and the wording you picked or wrote are kept in the app’s private settings. All of it is on your device only. In particular:

• Numbers are entered by hand. Mortui does not read your address book and does not request permission to.
• Nothing is sent to Mortui (the company) or to any server. There is no server.
• Phone numbers are excluded from the in-app data export, which lists recipients by name only.
• You can add at most three contacts, and the app enforces that limit at the point of sending as well as in the settings screen.

What Is Sent, and When

Every text is sent from your own phone, by your own carrier, in the same way as a text you send yourself. Mortui uses no SMS gateway or third-party messaging service, and standard carrier messaging rates may apply. There are four messages, and each is sent only in the situation described:

• Verification — sent once, when you tap Verify on a contact you just added. It tells the contact that you listed them, that they may one day receive a single message asking them to call this number, and that nothing is needed now. A contact who has not been verified is never contacted again.
• Check-on request — sent once per countdown, partway through the grace period (four hours in, on a normal countdown), if you have not checked in by then. It says that you have not responded to a check-in on your phone and asks the contact to call this number or check on you. It never names Mortui, never suggests you have died, and never includes your location, your files, or your messages.
• All-clear — sent to everyone who received a check-on request, as soon as you check in. It says that you have checked in and no action is needed.
• Rehearsal — sent only when you choose to run one from Test Mode. It is labelled as a test in its first words and shows the contact the real wording underneath.

You choose the wording of the check-on request from three presets or write your own, and the app shows you a preview before anything is sent. Emergency contacts never receive your final messages, your vault files, or any other estate content. Those go by email, to the recipients you configured for them, and only after the grace period has fully run out.

The SMS Permission

Sending a text requires Android’s SEND_SMS permission. Mortui asks for it only at the moment you verify an emergency contact, after explaining in its own words what it will use it for, and never on launch. It requests no permission to read, receive, or intercept SMS, no access to your call log, and no access to your contacts. If you decline, or revoke the permission later in Android Settings, emergency contacts cannot be verified or contacted and the rest of the app is unaffected — file deletion, email delivery, and the switch itself do not use SMS.

Removing a Contact

Removing a contact in Configuration deletes their name and number from your device immediately; there is nowhere else it was kept. The in-app “Delete All Data” control and uninstalling the app remove every emergency contact along with everything else. If you are listed as somebody else’s emergency contact and would rather not be, that is between you and them — the number is stored only on their phone, and we have no way to see or remove it.

How Mortui Uses Google User Data

Mortui offers optional email delivery through your own Gmail account. If — and only if — you choose to connect a Google Account, Mortui interacts with Google user data as described below. Connecting Gmail is entirely optional; the app functions without it. This section specifically governs Google user data obtained through Google APIs.

Data We Access

When you connect a Google Gmail Account, Mortui requests the following via Google OAuth:

• Send-only Gmail access (the https://www.googleapis.com/auth/gmail.send scope): permission to send email on your behalf. This scope grants no ability to read, search, download, modify, or delete any of your existing messages, drafts, contacts, or other mailbox content.
• Your Google Account email address: obtained through Google Sign-In so the app can show you which account is connected and set it as the sender ("From") address.

How We Use It

The gmail.send authorization is used solely to send the messages you have pre-composed to the recipients you designate — either when you send a test message, or when Mortui's deadman's switch detects prolonged inactivity and executes your configured actions. Your account email address is used only to label the connected account in the app and as the sender address on those messages. Google user data is never used for advertising, profiling, training AI/ML models, or any purpose other than delivering the email you configured.

How We Share It

Mortui operates no servers or backend. Google user data is not sold, rented, or shared with any third party, advertiser, data broker, or analytics provider. The only transmission of this data is directly from your device to Google's Gmail API in order to send the message you composed. The recipients you designate naturally receive the email you chose to send them; no other data is disclosed.

Mortui's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How We Store & Protect It

The OAuth tokens Google issues are stored exclusively on your device and never transmitted to Mortui. They are encrypted at rest inside a SQLCipher (AES-256) database whose key is held in the Android Keystore — hardware-backed on devices that support it. Mortui does not retain a copy of your Google credentials; Google manages your actual account authentication.

How Long We Keep It & How to Delete It

The OAuth token is retained only for as long as your Google Account remains connected. You can revoke Mortui's access to your Google user data at any time by:

• Disconnecting the account in the app (Email setup → remove the connected account), which deletes the stored token from your device;
• Using the in-app "Delete All Data" control or uninstalling Mortui, which removes all stored tokens and data; and/or
• Revoking access from your Google Account at myaccount.google.com/permissions, which invalidates the token independently of the app.

Because Google user data is stored only on your device and never on any Mortui server, deleting it locally removes it completely. For deletion questions you can also contact privacy@mortui.com.

Data Storage & Security

Your data is yours. Mortui (the company) cannot access it, cannot see it, and cannot share it. Everything stays on your device.

On-Device Only

All data processed by the Mortui app is stored exclusively on your device. Mortui (the company) does not operate cloud servers and cannot access your data. Your behavioral patterns, configuration, and all sensitive information never leave your device except when Mortui delivers your messages — either a test you send yourself, or an automatic delivery when the switch fires. In that case the message you wrote and any files you attached to it are sent through your own email account. If you added emergency contacts, a short text message asking them to check on you is sent from your phone during the countdown. Your behavioral data is never transmitted.

Encryption

All stored data is encrypted using industry-standard encryption:

• SQLCipher database encryption (AES-256)
• Android Keystore for key management
• Hardware-backed encryption where available

Data Retention

Behavioral metrics and daily analysis records are retained on your device for 365 days, so the app can account for seasonal changes in your routine. Records of executed actions are kept for 90 days, and queued or failed delivery records for 7 days. Anything older is deleted automatically. Configuration, including recipients and any emergency contacts, is kept until you change or remove it. You can delete all data at any time by uninstalling the application or using the in-app data deletion feature.

Third-Party Services

Email Delivery (full version)

When you configure email delivery, Mortui may interact with:

• Gmail API: If you connect your Gmail account via OAuth. Your Gmail credentials are managed by Google; we only store the OAuth token.
• Microsoft 365: If you connect your Outlook account via OAuth. Same OAuth token storage applies.
• Custom SMTP: If you configure a custom SMTP server. Your password is encrypted locally.

These services are contacted when you send a test message, when actions are executed, and once a day by a background check that confirms your connected account still works and refreshes its access token. That daily check exchanges authentication tokens only — no message content, no recipient details, no behavioral data.

Text Messages (SMS)

Texts to any emergency contacts you add go out through your mobile carrier, exactly like a text you send from your messaging app. No SMS gateway, aggregator, or other intermediary is involved, and your carrier receives nothing from Mortui beyond the message itself and the number it is addressed to. Your carrier’s own privacy policy governs what it retains about messages sent from your line.

No Analytics Services

The Mortui app does not use Google Analytics, Firebase Analytics, Crashlytics, or any other third-party analytics service. Mortui (the company) cannot track your usage patterns because your data never leaves your device. We do not share any data with advertisers or third parties.

Purchases

Paid features are unlocked by a one-time purchase through Google Play — not a subscription, so there is no renewal that could lapse. Google handles all payment processing; we receive only confirmation that the purchase succeeded, never your payment details.

Your Rights

Regulatory Compliance

GDPR Ready

Mortui's privacy-by-design architecture naturally aligns with GDPR requirements:

• Data minimization: the app measures only what the detection model needs, and none of it reaches us
• Purpose limitation: Data used only for stated purposes
• Right to erasure: Easy data deletion available
• Data portability: Export functionality provided
• Privacy by design: Built into the architecture