Privacy Policy

1. Information We Collect

2. How We Use Your Information

3. Data Encryption

4. Third-Party Service Providers

MULIO uses the following third-party services to operate. Each service receives only the minimum data necessary to perform its function.

5. AI Models & Where Your Data Is Processed

MULIO’s core AI features — the Sunday Weekly Report, the daily Game Plan, and Ask MULIO responses — are produced by an AI language model called DeepSeek V4 Pro, operated by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (“DeepSeek”). This section explains what that means for your data.

Where the model runs

DeepSeek is a Chinese AI company. The DeepSeek V4 Pro model runs on servers located in mainland China. DeepSeek’s published privacy policy states they “directly collect, process and store your Personal Data in People’s Republic of China.” When MULIO generates a report or answers an Ask MULIO question, the relevant inputs are sent from our backend (Google Cloud, in the United States) to DeepSeek’s API, which routes the request to a model running on Chinese infrastructure.

What is sent to DeepSeek, and what is not

• Sent:the relevant journal text, your profile fields (role, industry, goals, language preference), your goals, recent plans and progress, and any context that the report, plan, or question explicitly requires (e.g. last week’s report summary).
• Not sent: your name, your email address, your Apple ID, your Firebase user ID, your subscription billing information, your raw HealthKit readings, your IP address, or any field MULIO does not explicitly include in the prompt. We send what the model needs to do its job and nothing else.

Your journal text is stored under Google Cloud’s encryption at rest and read by our backend only when generating your guidance. It is never used for advertising and never sold.

Jurisdictional implications

Data processed by DeepSeek is subject to applicable laws of the People’s Republic of China, which include the Cybersecurity Law (2017), the Data Security Law (2021), and the Personal Information Protection Law (2021). Under these laws, Chinese authorities may, in certain circumstances, request access to data processed within China. We are not in a position to limit such requests beyond DeepSeek’s published privacy commitments. If you are uncomfortable with this, please do not use MULIO, and existing users may delete their account at any time via Settings → Data & Privacy → Delete Account.

Why we made this choice

We chose DeepSeek V4 Pro for two reasons: (1) the model produces substantially more useful coaching responses for our domain (longitudinal behavioral analysis and evidence synthesis) than the alternatives we evaluated, at our quality bar; and (2) the cost is roughly 1/20th of equivalent-quality U.S.-hosted models, which lets us keep the subscription priced at $9.99/month rather than $40+. We considered the privacy trade-off and decided to disclose it transparently rather than hide it.

How DeepSeek handles your data

DeepSeek’s published privacy policy is the source of truth for retention, model training, and your rights as a user. Please read it directly at cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html. Two points worth pulling out, accurate at the time of writing:

• Retention. DeepSeek’s policy states they “retain Personal Data for as long as necessary to provide our Services” and that account-tied data is kept “for as long as you have an account.” DeepSeek does not publish a specific retention duration in days for API request data. Deleting your MULIO account does not, by itself, delete prior request data already on DeepSeek’s servers — but it does ensure no further requests are made on your behalf.
• Model training. DeepSeek’s policy describes using collected data “to improve and develop the Services and to train and improve our technology, such as our machine learning models and algorithms.” DeepSeek offers a user-level opt-out from training. Whether MULIO’s specific API calls are subject to training depends on DeepSeek’s API contract terms; if you have a strong preference, the safest path is account deletion.

If DeepSeek changes its data-handling commitments in a way that materially affects MULIO’s data flow, we will update this section and notify subscribers via the in-app changelog.

Where Anthropic fits

MULIO’s backend uses Anthropic’s Claude model for one narrow job: a nightly step that distills each day’s activity into the long-term memory notes described in §2. Anthropic is not involved in generating your reports, plans, or Ask MULIO answers — those run on DeepSeek as described above. Anthropic’s processing happens on U.S. infrastructure under the privacy policy linked in §4.

6. Data Retention

7. GDPR Rights

If you are located in the European Economic Area (EEA), you have the right to:

• Accessyour personal data (Settings → Privacy → Export Data).
• Erasureof your personal data (Settings → Data & Privacy → Delete Account).
• Portability of your data in machine-readable format (JSON export).
• Restrictionof processing — contact hello@exitroom101.com.
• Objectto processing — contact hello@exitroom101.com.
• Lodge a complaint with your local data protection authority.

Data export is available once every 24 hours. Account deletion removes all data from our systems within 30 days, with the exception of the anti-abuse identifier described in §6.

8. Children’s Privacy (COPPA)

9. Security

• Encryption at rest (Google Cloud) for all stored data, plus field-level Evervault encryption for sensitive profile fields.
• Firebase App Check to prevent unauthorized API access.
• Sign in with Apple for secure, private authentication.
• TLS 1.2+ for all data in transit.
• All MULIO infrastructure is hosted in the United States (Google Cloud, Firebase). The only data flow we intentionally route outside the U.S. is the AI call to DeepSeek (mainland China), described in §5.

10. Changes to This Policy

11. Contact