Privacy Policy

This Privacy Policy explains how GRAFSIM PTY LTD ABN 59699800827 trading as Murmurly (Murmurly, we, us or our) collects, holds, uses and discloses personal information when you use the Murmurly mobile applications, web application, website and related services (Platform).

Murmurly is a consumer journalling and wellness platform. It provides private journals, shared spaces (shown in the applications as circles), an artificial intelligence-assisted conversational feature (Coach), session summaries and longer-running Murmurly insights derived from a user's journal history.

By opening or using the Platform, you acknowledge this Privacy Policy and consent to the handling of your personal information as described in it where consent is the applicable legal basis. You may withdraw consent where the law permits, but this may affect features that depend on that processing.

This Privacy Policy applies together with our Terms of Service, Website Terms and Cookie Policy.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Account creation, sign-in and application services are currently offered only in Australia. We do not represent that this policy implements the GDPR, UK GDPR or United States state privacy laws for a service offered in those jurisdictions.

Journal or Coach content may reveal health, religious, sexual, political or other sensitive information. We treat journal and Coach content as sensitive. Before any journal content is processed by Coach, we ask for your express, separate consent to that processing, identify the AI provider and processing country, and allow you to withdraw that consent later. Withdrawal turns off Coach but does not delete your Account or writing.

We collect only information reasonably necessary to provide, secure, administer and support the Platform, comply with law and protect our legal rights. We do not use analytics providers and do not collect personal information for behavioural advertising.

Depending on how you use the Platform, we may collect:

• account and identity information, such as your email address, authentication identifiers, age confirmation and account settings;
• if you sign in with Google or Apple, the information Google or Apple sends us about your account, described in "Signing in with Google or Apple" below;
• journal entries, prompts, responses, attachments and other content you submit to your private journal;
• shared-space information, including invitations, membership, ownership or administrative status and content contributed to a shared space;
• Coach conversations, feedback and information generated by AI features, including session summaries, action items, extracted profiles and longer-running Murmurly insights;
• the text your device produces from what you say, if you use voice in the Murmurly mobile applications to talk with the Coach or to dictate a message. Your device turns your speech into text on the device itself, and we do not receive or store recordings of your voice;
• transaction and credit information, including purchases, credit balances, receipts, billing status, Stripe customer identifiers and payment-method tokens where you choose to save a card. We do not receive or store full payment-card numbers;
• communications and support records, including enquiries, complaints and requests to exercise privacy rights;
• contact email addresses that you expressly select through the optional operating-system contact picker for a shared-space invitation;
• device, security and technical information reasonably required to operate and protect the Platform, such as IP address, device or browser type, operating system, timestamps, error or security logs, session identifiers and push-notification tokens;
• consent, policy acceptance and compliance records, including consent type and version, a hash of the wording shown, locale, lawful basis, grant or withdrawal timestamps, and records of when the AI disclosure sheet was shown; and
• a short marketing-source label, if you reach Murmurly through one of our own marketing links, for example social-test. The label names the campaign or channel that referred you. We keep it on your account to understand which of our own channels bring people to Murmurly. We do not share it with advertisers or data brokers and do not use it for advertising.

We generally collect personal information directly from you when you create an account, use a journal or shared space, interact with the Coach, purchase credits, contact us, configure notifications or exercise a right.

We may also receive limited information from service providers that support authentication, hosting, notifications, email delivery and payments, or from another user who invites you to a shared space.

If you use the optional add-from-contacts feature, the operating system displays its own permission and contact picker. We do not read your address book in bulk. Only email addresses you expressly select leave your device and are stored as invitation records. Declining permission does not affect manual email entry.

If you use voice in the Murmurly mobile applications, to talk with the Coach or to dictate a message, the operating system asks for permission to use your microphone. Your device turns your speech into text on the device itself, and the applications offer voice only on a device that can do so. The sound of your voice is therefore not sent to us or to anyone else, and the applications do not keep a recording of it. Only the text is sent. When you talk with the Coach, the text recognised so far may be sent while you pause, so the Coach can start preparing its reply. We keep that text only once it is sent as your message. The microphone may also pick up other people speaking near you. What they say is turned into text with your words, and we keep it only if it is sent as part of your message. Declining microphone permission does not affect typing.

When you attempt to create an Account or sign in on the Website, our hosting edge derives an approximate country from your network address to enforce Australia-only availability. The country result is used for that request and is not stored or logged by us.

If you provide personal information about another person, you must be authorised to do so and must not use the Platform to disclose information unlawfully.

You can create an Account or sign in with your Google or Apple account. You confirm who you are with Google or Apple directly, for example with your password or Face ID. We never see or receive your Google or Apple password. When you sign in this way, Google or Apple sends us the following information about your account:

• from Google: your email address and whether Google has verified it, your name, a link to your Google profile picture, an identifier for your Google account and, if an organisation such as a workplace or school manages your Google account, the organisation's domain name; and
• from Apple: your email address, which may be a private relay address (see below), an identifier for your Apple account and, if you choose to share it, your name.

We ask only for this basic information. Signing in with Google or Apple does not give us access to your emails, contacts, files, photos or anything else in your Google or Apple account, and it does not give Google or Apple your journal or Coach content. Google or Apple will know that you have signed in to Murmurly, and handles your sign-in under its own terms and privacy policy, not on our behalf.

We use this information to create your Account, sign you in and keep your Account secure. The email address becomes the email address of your Account. We use it to recognise you when you sign in, to connect any shared-space invitations sent to that address, and to send you account emails, such as security alerts and the receipt we send when you delete your Account. If the email address Google or Apple confirms already belongs to a Murmurly Account, we connect the sign-in to that Account. When we do, we email that address to tell you that a Google or Apple sign-in was added to the Account.

If Google or Apple sends your name, we suggest it when we ask what you would like to be called. You can keep it, change it or skip that step. Until you choose a name, we use the first part of your email address, the part before the @, as your name: other participants in your shared spaces see it, the invitations you send show it, and the Coach uses it. The name you choose is stored separately from the name Google or Apple sends, and it is the name the Coach uses and other participants in your shared spaces see. The name from Google or Apple stays with your sign-in record and is updated each time you sign in with them. We do not use it for anything else, and we do not use your profile picture.

We store this information in Australia with the rest of your Account. Our email provider, which is in the United States, receives your email address to deliver our emails. We disclose this information only as described in "Disclosures and sub-processors". We do not sell it, use it for advertising or use it to train AI models. Our use of information we receive from Google follows the Google API Services User Data Policy.

If you choose Hide My Email when you sign in with Apple, Apple gives us a private relay address instead of your own email address and forwards our emails to you. We use the relay address as the email address of your Account and do not try to find out your own address. If you turn off forwarding in your Apple settings, our emails to you, including the receipt we send when you delete your Account, will not reach you.

When you confirm Account deletion, we delete your sign-in record, including the name, profile picture link and account identifier Google or Apple sent us, as part of that request. Some records that include your email address, such as the record of your deletion request, are kept as described in "Retention, deletion and backups". Deleting your Murmurly Account does not delete your Google or Apple account. Google or Apple may continue to list Murmurly among the apps connected to your account until you remove it in your Google or Apple account settings.

We use personal information only for the following purposes:

• to create and administer accounts and authenticate users;
• to store, encrypt, display, synchronise, export and delete journal and shared-space content;
• to provide Coach conversations and generate requested session summaries, action items, extracted profiles and Murmurly insights;
• to administer shared spaces, invitations, membership and group deletion;
• to process credit purchases, maintain credit balances, store a payment method with Stripe where you choose to save it for later web purchases, and meet accounting, tax and transaction-record obligations;
• to deliver service, security and push notifications chosen or required by you, including message previews where you enable them on a device;
• to maintain security, prevent misuse, diagnose faults and provide support;
• to comply with legal obligations and respond to valid legal process; and
• to establish, exercise or defend legal claims and manage a corporate transaction, subject to appropriate safeguards.

We do not sell personal information, use journal or Coach content for advertising, or allow that content to be used to train general-purpose AI models.

When you use the Coach or request an AI feature, the relevant prompt and context are processed through Anthropic Claude models made available through the Amazon Web Services Bedrock service in Australian regions. Our current arrangement is designed so that this content is not shared with Anthropic and is not retained by the model service after processing.

When you talk with the Coach in the Murmurly mobile applications, the Coach speaks its replies. To do this, the text of each reply is sent to Amazon Polly, a speech service of Amazon Web Services, in Sydney, Australia, which turns it into computer-generated speech that your device plays. Spoken replies are available only in your private Coach conversations, not in shared spaces. Our current arrangement is designed so that Amazon Web Services does not store this text or the audio and does not use them to improve its services. We do not store the audio, and the applications delete it from your device after it plays or when you close the voice screen.

A persistent AI control is shown on Coach screens. It identifies Coach as an AI system, the provider operating it and the processing location. The disclosure opens automatically at the start of a session and thereafter no more than once in a 24-hour period. We record when it is shown. This is a transparency notice, not a consent request.

Session summaries and Murmurly insights are generated from relevant parts of your journal history to provide requested summaries, action items and longer-running reflections. They may be incomplete, inaccurate or inappropriate and should not be treated as professional advice or a clinical assessment.

AI outputs may be generated automatically, but we do not use them to make decisions that produce legal or similarly significant effects about you.

Content posted to a shared space is intended to be visible to the participants in that space and to the Coach. The group creator or owner may administer membership, but no participant owns another participant's content merely because it appears in the group.

You should only add content to a shared space that you are comfortable sharing with all current participants. We cannot control screenshots, copying or disclosures made by another participant outside the Platform.

A participant may leave a shared space at any time. When the final participant leaves, the shared space, its content and its encryption key are deleted.

If you leave a shared space while other participants remain, the space and everything you wrote in it stay with them, and the Coach may keep using that content in the space. Any action items you created in that space are removed when you leave and are permanently deleted within 30 days, and rejoining later does not restore them.

Murmurly does not actively monitor journal entries, Coach conversations or shared-space content, and no human monitoring or intervention is currently provided.

Coach is instructed to respond with crisis resources when a conversation raises self-harm or suicide and to remain in the conversation without screening, diagnosis or risk assessment. A separate automated check reads AI-generated session-summary text, not the user's original words, only to decide whether to display a hotline banner. These features are automated signposting only and do not promise detection, monitoring, human review or intervention.

We do not contact emergency services or another person merely because crisis language appears. If we actually become aware of existing information and are legally required to access or disclose it, or reasonably believe disclosure is necessary to address a serious and imminent threat as permitted by law, we may take the limited action authorised or required by law. This does not mean deleted content can be recovered.

We disclose personal information only as reasonably required to provide and secure the Platform, complete transactions, obtain professional advice, comply with law or protect rights and safety.

Our current providers cover Australian hosting and infrastructure, AI processing, web delivery, payments, transactional and authentication email, and push notifications. We keep one list rather than two, so the authoritative and always-current record of who they are, what each one processes and where, is the sub-processor list below rather than this paragraph.

The current sub-processor list, including processing purpose and location information, is published at /legal/subprocessors. We may update providers where reasonably necessary and will update that list when appropriate.

Murmurly is Australian-first. Journal, Coach and core customer data are intended to be stored and processed in Australia. If we expand, we intend to use in-country storage where reasonably available.

Journal content, Coach conversations and AI inference stay in Australia: Supabase in Sydney, Vercel compute in Sydney, AWS Bedrock across Sydney and Melbourne, and, for spoken Coach replies, Amazon Polly in Sydney. Payments, transactional and authentication email, push-notification delivery and website edge delivery involve providers outside Australia, principally in the United States. The sub-processor list names each provider and its country, and is the record we keep current.

Where an international disclosure is regulated, we use reasonable contractual, technical and organisational safeguards and take steps required by applicable law.

We use encryption in transit and at rest. Individual users have separate encryption keys, and each shared space uses a separate group key.

Our systems retain an administrative or master key-management capability that may technically permit authorised access in limited circumstances, including support, security, recovery or legal compliance. Encryption materially protects information, but it does not make access by Murmurly technically impossible.

No system is completely secure. You are responsible for protecting your credentials and should contact us promptly if you suspect unauthorised access.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide the Platform, to meet legal or accounting obligations, or to establish, exercise or defend legal claims.

Journal, Coach and shared-space content is retained while the relevant Account or shared space remains active, unless deleted earlier. When you confirm Account deletion, we destroy the applicable encryption key as part of that request, making encrypted journal and Coach content unreadable immediately. Tombstoned database rows are hard-deleted by a scheduled process within 30 days.

Backups contain the same encrypted data and do not restore the destroyed key, so restored backups do not make deleted content readable. We do not retain crisis-flagged journal or Coach content under a separate key. In a shared space, a departing user's messages are replaced for remaining participants with a deleted-user placeholder so the conversation remains coherent.

We retain tax records for at least five years where required by Australian law and may retain a Stripe customer object and related billing cross-reference for up to seven years for tax-audit purposes. Consent, policy acceptance, security, complaint and rights-request records may be kept for the period reasonably required to demonstrate compliance or resolve disputes. We email an Account-deletion receipt identifying what was erased, what was retained and why.

The precise retention period depends on the data category, legal requirements, sensitivity, security risk and technical backup cycle. We periodically review retained information and delete or de-identify it when no longer required.

You may have rights under Australian privacy law to access or correct personal information and to complain about our handling of it. The Platform also provides tools to export data, delete your Account and withdraw the separate consent used for Coach processing.

You may contact privacy@murmurly.app to exercise a right. We may need to verify your identity and may refuse or limit a request where permitted by law, including where information must be retained or affects another person's rights. We aim to respond to an access or correction request within 30 days of receiving it and any information we need to verify your identity. Confirmed Account deletion makes encrypted journal and Coach content unreadable immediately, and the remaining hard-deletion process completes within 30 days.

You may complain to the Office of the Australian Information Commissioner if you are not satisfied with our response.

The Platform is not intended for anyone under 16. During signup you must self-declare that you are at least 16. The mobile applications are listed for a 16 and over audience: a 16+ rating on the App Store, and a 16 and over target audience on Google Play. Neither implements nor relies on any app-store age-assurance interface. We do not collect your date of birth. If you believe a person under 16 has created an Account, contact us so we can investigate and take appropriate steps.

Cookies

Our Website uses only cookies and similar technologies reasonably required for functionality, authentication, security, preferences and transactions. We do not currently use advertising or third-party analytics cookies. Further information is in our Cookie Policy.

Push notifications

We may send operational, security, transactional and user-selected notifications. Message previews are off by default and controlled separately on each device. If you enable previews, up to 120 characters of another participant's latest message may pass through Apple, Google and Expo to reach your device.

Content generated by Coach, and the summaries, profiles and insights it produces, is not included in a notification preview. When a session summary is ready, we send the same short message every time, and it carries none of that content. It arrives like any other notification, so a person who can see your device can tell that a summary is waiting.

Any direct marketing will be sent only where permitted by law and will include an available opt-out method.

If we suspect an eligible data breach, we will take reasonable steps to complete the assessment expeditiously and, where the Privacy Act requires, within 30 days. If we have reasonable grounds to believe an eligible data breach has occurred, we will prepare the required statement and notify the Office of the Australian Information Commissioner and affected individuals as soon as practicable, subject to the exceptions in the Privacy Act.

We may update this Privacy Policy to reflect changes to the Platform, providers or law. We will publish the updated version and, where a change is material or consent is required, provide additional notice or seek consent as required.

Privacy enquiries, requests and complaints may be sent to privacy@murmurly.app or GRAFSIM PTY LTD, 704/458 Brunswick Street, Fortitude Valley, QLD, 4006.

We will acknowledge a privacy complaint promptly and aim to provide a written response within 30 days of receiving it. If we need additional time or information to complete our investigation, we will tell you before that period ends and explain why.