Privacy Policy

Effective date: September 24, 2026

Mess Map is operated by JBSPB LLC, a Michigan limited liability company. Mess Map is our product/brand name. This policy covers the Mess Map website and app.

Contact: messmapadmin@gmail.com. Mailing address: 2991 5 Mile Rd NE, Grand Rapids, MI 49525.

The website and the app

This informational website does not offer photo uploads, create accounts, or include advertising or product-analytics trackers. Vercel hosts the website and processes requests and technical information, such as network addresses, for delivery and security. Opening the separate Mess Map app lets you use the account and cleaning features described below.

Information we process

• Accounts: email, authentication identifiers, sign-in method, session information and optional profile information. Supabase handles email/password authentication. Sign in with Apple may supply a private-relay email and a name on first authorization. Google sign-in supplies an identifier, email and basic profile information to Supabase, which may include a name and profile-image URL. We do not receive your Apple or Google password. Google sign-in currently requires an approved Google OAuth test account.
• Photos and cleaning choices: photos you select and submit, scan mode, available cleaning time and laundry-related choices. Photos can reveal possessions, people, documents and details of a home. Keep faces, private documents and sensitive details out of submitted images.
• Plans and progress: generated cleaning steps and room descriptions, saved rooms, completed/skipped steps, history, timing, check-ins, and Quest XP, levels and ranks. These records can be linked to your account.
• Tokens and access: Mess Token balances, promotional grants/redemptions, reward claims, scan spending and settlement records. The current iOS build does not complete purchases or collect payment-card details. Planned Apple token packs and monthly subscriptions will require transaction, renewal and entitlement processing once StoreKit is implemented and verified; we will update this policy to describe any new purchase data processing before paid launch.
• Technical and support information: request identifiers, status, errors, timing, service-usage records, security information and anything you send to our support email. Hosting and authentication services also process network addresses and technical logs. Abuse controls use keyed hashes of IP/account identifiers and short-lived counters.

We do not record camera-preview video or microphone audio. Task read-aloud uses a device voice. The current app has no advertising identifiers or advertising/product-analytics SDK and does not intentionally request precise location, contacts, health records or biometric identification.

Photos and AI processing

Before your first AI photo submission, we ask you to explicitly agree to send chosen photos and cleaning choices to OpenAI to create your plan. Backing out sends no photos. We record your agreement with your account, the disclosure version and a timestamp. You can then scan without repeat prompts while this provider and purpose remain unchanged. Review the disclosure or withdraw permission in Profile/Settings → Photo & privacy. Withdrawal stops future submissions; it cannot recall processing already dispatched. A material provider or purpose change may require renewed agreement.

When you submit a scan, selected images and relevant cleaning choices pass through our hosted backend to OpenAI to generate a plan. This processing happens on servers, not only on your device. Our AI request does not intentionally include your account email or display name, but identifying details visible in a photo are still transmitted.

The current application does not persist submitted photo files in its own server database or object storage. Generated plans and operational records are stored. Small before/after previews stay on your device. Optional after photos are not sent for AI analysis by the current app.

Our requests disable stored Responses history. This does not guarantee immediate deletion by OpenAI: its separate abuse-monitoring retention normally lasts up to 30 days, with exceptions and other applicable processing. OpenAI's API policy excludes training by default unless the customer opts in. We do not claim a special zero-retention arrangement. See OpenAI's data controls.

We keep the current consent record while your account exists, including its version, acceptance date and any withdrawal date. Account deletion removes this record.

OpenAI documents encryption of API content in transit and at rest. This does not mean end-to-end encryption: OpenAI can process submitted photos. Device-local previews rely on your browser/device protections; we do not claim those previews are separately encrypted by Mess Map.

Why we use information

We use information to sign you in, generate plans, save and restore progress, calculate XP and token balances, provide support, prevent abuse and duplicate charges/rewards, troubleshoot problems and meet legal obligations. We do not sell personal information or use it for cross-app targeted advertising in the current service.

Service providers and sharing

• Supabase: authentication and account-linked plans, progress, XP, token and operational records.
• Vercel: website/backend hosting, request processing, scan uploads in transit and technical logs.
• OpenAI: analysis of submitted photos and cleaning choices, and generation of plan content.
• Upstash: rate-limiting and abuse-prevention counters, hashed identifiers and request/lease identifiers, not room-photo storage.
• Apple and Google: optional sign-in and related platform services under their own privacy notices. Google permissions are limited to identity, email and basic profile, not Gmail, Drive or contacts.

Support messages sent to our Gmail address are processed by Google as our email provider. Do not send passwords, reset links or sign-in codes in a support message.

We may disclose information where legally required or reasonably necessary to protect rights, security or users. A business transfer would remain subject to applicable privacy obligations.

We do not publish your room photos in a public gallery. If you choose to share a before/after image, Mess Map creates it locally and hands it to your selected sharing destination or download. That recipient or service controls its own copy.

Storage and retention

• Device previews: expire seven days from the scan's start. Cleanup happens while the app runs or when it next opens. You can remove previews sooner; camera-roll originals remain under your control.
• Generated content: server scan results have a seven-day expiry. Saved cleaning progress has a separate rolling 35-day expiry renewed when saved and can include a plan copy. Cleanup uses access-time and maintenance routines; this is not a promise that every copy disappears after seven days.
• Progression: XP has no inactivity or streak-loss penalty while the account remains active. Account closure removes XP and check-in records.
• Accounting and security: some token/accounting, fraud-prevention, reconciliation and unresolved scan evidence can remain after deletion. Retained accounting is disconnected from its Auth user but is not necessarily anonymous. Retention depends on reconciliation, abuse investigation and applicable legal obligations; unresolved scan evidence follows its bounded expiry/settlement cleanup.
• Providers and backups: technical logs, backups and legally required records follow separate provider retention arrangements. We do not promise immediate erasure from backups or independent providers.

Your choices and account deletion

You can choose not to submit photos, remove selected photos before a scan, change camera permissions, delete device previews, sign out and initiate account deletion. Removing app/site data may remove local preferences and previews.

In the iOS app, open Profile/Settings → Delete account and follow the confirmation and sign-in steps. The implemented deletion removes the authentication account and sessions, saved progress, accessible plan content, XP/check-ins and this device's account previews. The retained records described above may remain. Deletion does not erase camera-roll originals, shared copies or copies on another device immediately.

Deleting a Mess Map account does not currently revoke its Google connection. You can remove that connection through your Google Account's third-party connections settings. Mess Map does not persist Google access/refresh tokens for later access to Google services; it uses Supabase credentials for your Mess Map session. Apple grant revocation is not yet implemented in the current beta deletion flow; account deletion must not be understood as confirmation that the Apple connection was revoked.

Email us for access, correction or deletion assistance, including if you cannot access the app. We may verify identity before responding. We will honor applicable privacy rights; this policy does not limit statutory rights.

Audience and children's privacy

Mess Map is a general-audience, parent-managed household productivity app. Account holders must be adults (18 or older) and legally able to enter an agreement. Adult account holders choose and approve room photos submitted for AI analysis. Parents or guardians may use Mess Map with their children, including supervised use of Quest Mode. We do not offer independent under-13 accounts, directly market Mess Map as an under-13 app, or launch it in Apple’s Kids Category. We do not operate a COPPA parental-consent service. Adult supervision is not permission for a child to independently create an account or upload photos. Keep identifiable children under 13 out of uploaded photos. Contact us if you believe a child has independently provided personal information so we can investigate and take appropriate action.

Cookies and local storage

The informational website does not set application cookies or use browser storage for advertising or analytics. The separate web app uses necessary authentication cookies, including a short-lived Google sign-in verification cookie, and local storage for preferences and previews. The native app uses secure storage for authentication. Read the cookie and storage notice.

We do not currently use cross-site advertising tracking. The app has no special response to legacy Do Not Track signals. If practices change, we will assess the necessary notices and choices.

Security, processing locations and changes

We use encrypted network connections, access restrictions and account-owner checks. No online service guarantees perfect security. Providers may process information outside your state or the United States; we make no exclusive U.S. storage promise.

We will update the effective date when the policy changes and provide additional notice or consent where required. Questions can be sent to messmapadmin@gmail.com.