About Us Our Principles Log in

Privacy Policy

Last updated: June 12, 2026

Maya Migrate builds tools to help immigrants understand and navigate the immigration process. We start from a simple promise: your safety shapes every decision we make. We minimize what we collect, keep the most sensitive data off our servers entirely, and build for a real adversarial threat model (subpoenas, device seizure, detention).

This policy explains what we collect, why, who processes it, and your rights.

We do not collect sensitive personal data we don’t need, and we do not sell your data.

1. What We Collect

Information you give us

  • Account: when you sign in with Google or an email magic link, we receive your email address (and, for Google, your name).
  • Waitlist: if you join the waitlist, the form (Tally) collects your email.
  • Preferences: settings you choose, such as your time zone and how you want dates and times formatte, so we can display information correctly for you. Never used to identify you.

Information that stays on your devic, not on our servers

  • Emergency contacts (Digital Rapid Response): the names and relationships of your emergency contacts are stored encrypted on your device only and never sent to us. The only contact detail that reaches our servers is each contact's email address. We need it to send the alert, and we keep just that: everything else about your contacts is erased, so if you ever set up Digital Rapid Response again, you won't have to re-enter everyone. We use email on purpose: getting an email address doesn't require showing ID, so holding one doesn't reveal a person's legal name, date of birth, or home address the way a phone number can.

Information we generate

  • Web analytics via Google Tag Manager / Google Analytics: page views, clicks, and general browser/device info on our marketing site.
  • Diagnostic logs (Axiom): error and usage events to fix bugs. We do not deliberately log IP addresses or email addresses.
  • Push token (Firebase Cloud Messaging): a device identifier used only to deliver Digital Rapid Response notifications. Google sees that a notification was sent, not its contents.

2. Why We Collect It

  • Let you sign in and personalize your experience (e.g., greeting you by name).
  • Operate the Digital Rapid Response safety feature.
  • Fix bugs, understand usage, and decide what to build next.
  • Email you sign-in links and Digital Rapid Response alerts: the only emails we currently send.

3. Who Processes Your Data

We rely on a small set of processors:

  • Supabase: authentication, the sign-up / sign-in emails it sends (magic links), and database (PostgreSQL).
  • Railway: application hosting.
  • AhaSend: transactional email (check-ins and alerts).
  • Google: sign-in (OAuth), push delivery (Firebase Cloud Messaging), and website analytics (GA4 via Tag Manager).
  • Tally: waitlist form.
  • Axiom: diagnostic logging.

Most of these processors store data in the EU/EEA: Railway (our hosting region), AhaSend (Hetzner, Germany/Finland), and Tally. Our Supabase database is in [CONFIRM region] (AWS), and Axiom holds diagnostic logs in [CONFIRM location]. Google operates globally and relies on Standard Contractual Clauses for transfers outside the EEA. We may share anonymized, non-identifying data with researchers or partners, never personal or identifying data. If legally compelled (e.g., a subpoena), we will comply; otherwise we do not share data with governments or other companies, and our data-minimization design means there is little to disclose.

We sign data processing agreements with the services that handle your data, binding each one to protect it, use it only to provide their service to us (never for their own purposes), and notify us of any breach without undue delay.

4. Where and How Your Data Is Stored

  • Stored in Supabase (PostgreSQL); encrypted in transit and at rest, with access limited to those who need it.
  • We retain account data until you ask us to delete it.
  • You can delete your account and associated data from settings.

5. Your Choices

  • Delete your account and data at any time.
  • Analytics: [CONFIRM cookie/opt-out posture for GA4 — the earlier “cookieless” claim doesn’t match GTM/GA4 as currently configured].

6. Children

As of now, Maya is not available to children, and we do not knowingly collect personal data from them.

7. Changes

We’ll update this policy as the product evolves and note the date above.

8. Questions

If you have questions about this policy or your data, contact us at contact@mayamigrate.com.