Privacy Policy

1. Who I am

I'm Mohammed Albalawi, an independent developer based in Saudi Arabia, and I operate meslzy.com and its apps, such as Push at meslzy.com/push (the "Platform"). For anything privacy-related, write to [email protected].

2. What I collect

Account data: your email, username, and password (stored as a secure hash — never in plain text).

Profile details you choose to add, such as your name, mobile number, country, city, time zone, and a short bio.

App data: what you create in an app, such as Push projects, recipients, and notifications, as described in the app's section below.

Billing data: payments are processed by Paddle.com as merchant of record. I receive transaction and credit-balance information, never your card details.

3. What I don't collect

No third-party analytics, no advertising trackers, no cross-site tracking, no precise location, no contact lists — and your data is never sold.

4. How I use your data

To run the apps you use, manage your account and credits, send account emails such as verification and billing notices, keep the Platform secure, and meet legal obligations. Nothing else.

5. Push notifications

Push (meslzy.com/push) lets account holders send browser notifications to people they invite. A person who receives notifications does not need an account: they connect a browser by opening a connect link, clicking to enable notifications, and accepting the browser's permission prompt. Nothing is asked when the page loads.

For each connected browser, Push stores the push address and encryption keys the browser provides (encrypted at rest) and a short label such as "Chrome on Windows", derived from the browser's user agent. The full user agent is not stored. Push also records each delivery attempt's status and whether the notification was clicked, used through an action button, or closed.

To deliver a notification, Push sends it encrypted end to end to the push service that belongs to the browser: Google, Mozilla, Apple, or Microsoft. Those services cannot read the content. Push never fetches the images or icons in a notification; the recipient's browser does when it shows it.

IP addresses are used only for short-lived rate limiting on the public connect and event endpoints and are not stored with Push data.

Notification content (title, body, links, images, actions, and data) is kept for the period the sender chooses for their project: 7 days (the default), 30 days, or not kept, in which case it is removed within about an hour after sending finishes. Delivery records are deleted entirely after 90 days. A connected browser's record is kept until the sender deletes the recipient or the project. Anyone can stop receiving notifications at any time by disconnecting from the connect page or turning notifications off in the browser's settings.

Senders decide what they send and to whom. For notifications sent by a Push customer, that customer is responsible for the content and for having the recipient's consent.

6. Cookies

The Platform uses two essential cookies: a session cookie that keeps you signed in and a flag that tells pages you are signed in. Both are set for meslzy.com and its API at api.meslzy.com, and nothing else reads them. Your light or dark color-scheme choice is kept in your browser's local storage, not in a cookie. No advertising or analytics cookies.

7. Third-party processors

Paddle.com handles checkout, taxes, and payment processing. Resend delivers account emails. Browser push services (Google, Mozilla, Apple, and Microsoft) deliver Push notifications. Cloudflare provides DNS and network protection for the Platform's domains, Sentry receives error reports (without personal data by default), and hosting infrastructure runs the Platform's servers.

8. Data retention

Account data is kept until you delete your account. What you create in an app is kept until you delete it or your account, and Push notification content and delivery records follow the shorter periods described in the Push notifications section. Server logs are kept for a short period (around 30 days) for security and debugging.

9. Your rights

You can ask to access, correct, export, or delete your data at any time by emailing [email protected] — I respond within 30 days.

If you're in the EEA or UK, you have the GDPR rights of access, rectification, erasure, restriction, portability, and objection, plus the right to complain to your supervisory authority. California residents: I do not sell personal information.

10. Security

All traffic is encrypted in transit (HTTPS), passwords are hashed, and access to infrastructure is limited to me. If a breach affects your data, you'll be notified.

11. Children

The Platform isn't directed at children under 13 (under 16 in the EEA), and I don't knowingly collect their data. If a child has used the Platform, contact [email protected] and the data will be deleted.

12. International transfers

The Platform's servers and providers may be located outside your country. Where the law requires it, appropriate safeguards apply to those transfers.

13. Changes and contact

Updates to this policy are posted here with a new "Last updated" date. Questions or requests: [email protected].