Privacy Policy

This Privacy Policy explains how Maze Tech, Inc. ("Maze", "we", "us", or "our"), the operator of Maze, collects, uses, stores, protects, and shares information when you use our website, app experiences, account features, account sign-in, optional Gmail connection, item extraction tools, public profiles, item pages, story sharing tools, and related services.

Maze is designed to help you build a visual collection of things you own. Because Maze can connect to Gmail, we treat email data with extra care. We request read-only access and use Gmail data only to provide and improve user-facing Maze features that you choose to use.

By using Maze, you agree to this Privacy Policy and our Terms of Service. You can read our Terms at /terms.

Maze's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Signing in with Google and connecting Gmail are two separate things in Maze, and one does not turn on the other. Signing in with Google uses the basic sign-in scopes openid, email, and profile: it tells Maze your email address and your name, and it gives Maze no access to your mail at all. Connecting Gmail is a second, optional step with its own consent screen, and it is the only step that requests the gmail.readonly scope. You can use Maze signed in with Google and never connect Gmail. You can disconnect Gmail on its own at any time and stay signed in.

Maze uses Gmail API access only to scan for purchase confirmations, shipping receipts, order receipts, and related commercial emails, so we can extract product details and build your Maze collection. The items Maze builds this way also set the order in which Maze shows you other people's items, on your For You feed and on the feed of people you follow: those items are arranged by how closely they resemble what you already own and have saved. This ordering is worked out on your device and is never stored as a profile of you. It decides the order of what you are shown and nothing else. It is never used to order what anyone else is shown, and it does not change who can see your collection or where your own items appear on Maze. What other people can see of your collection is set by the visibility rules described in section 6, not by this ordering. Maze does not use Gmail data to serve advertisements. Maze does not sell Gmail data. Maze does not use Gmail data for third-party advertising, creditworthiness, insurance, lending, employment, or unrelated profiling.

Maze will not transfer Gmail data to others except as necessary to provide or improve Maze's user-facing features, comply with applicable law, address security or abuse, or as part of a merger, acquisition, or sale of assets, subject to appropriate privacy protections. One such transfer is abuse screening: to keep objectionable content off Maze, item text is sent to an automated moderation service, as described in section 5. Push notifications are not such a transfer. Maze delivers notifications through Apple's Push Notification service, and the message Maze hands Apple contains only the @handle of the Maze user who acted and a fixed phrase. Nothing Maze read in your email is put in it.

Maze will not allow humans to read your Gmail data unless we have your affirmative agreement for specific messages, doing so is necessary for security purposes such as investigating abuse, doing so is necessary to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

Scanning runs on a schedule as well as on demand. Once you connect Gmail, Maze re-scans your inbox for new purchase emails about once a week. This runs on Maze's servers and does not require you to open the app, so newly delivered orders appear in your collection on their own. A scheduled scan uses the same read-only access and the same purchase-confirmation filters as a scan you start yourself, picks up where your last completed scan left off, and is processed the same way, including the AI processing described in section 5. Scheduled scanning stops as soon as you disconnect Gmail in Maze, revoke Maze's access in your Google account permissions, or delete your Maze account.

• Two separate consents: signing in with Google grants Maze no access to your mail. Only the optional Gmail connection requests gmail.readonly, and it can be revoked on its own.
• Read-only access: Maze cannot send emails, delete emails, edit drafts, or manage contacts.
• Purpose limitation: Gmail data is used to identify purchased items, build your Maze collection, and order the feeds Maze shows you. It is not used for any purpose outside the Maze features described in this policy.
• Ordering, not visibility: what Maze found in your inbox is used to order what you see, and is never used to order what anyone else sees. It does not make your collection, or any item in it, more or less visible to other people. What other people can see is set by the visibility rules in section 6.
• Advertising limitation: Gmail data is never used for ads or sold to advertisers.
• Notification limitation: a notification Maze sends to your phone never contains anything from your email. It carries the name of the Maze user who liked your item or followed you and a fixed phrase, and the item itself is visible only after you open Maze.
• Human access limitation: human review is limited to the narrow cases described above.
• Scheduled scanning: once Gmail is connected, Maze re-scans for new purchase emails about once a week until you disconnect.
• Revocation: you can disconnect Gmail from Maze in the product or revoke Maze's access from your Google account permissions at any time.

We collect information you provide directly, information generated through your use of Maze, the identity information your sign-in method hands us, information from your Google account if you separately authorize Gmail access, and technical information collected automatically when you visit or use Maze. Maze supports three ways to sign in: Google, Sign in with Apple, and an email address and password. Each one hands Maze a different amount of information, and none of them gives Maze access to your email.

• Account information, such as your email address, user ID, session information, name, username, profile image, location, and onboarding status.
• If you use Sign in with Apple, Apple sends Maze a stable ID for your account and, if you allow it, your name and your email address. Apple sends the name only on your first sign-in and never again. If you choose Hide My Email, the only address Maze ever holds for you is the private relay address Apple generates, ending in privaterelay.appleid.com. Maze cannot see your real address behind it and does not try to. If Apple sends no address at all, Maze has no email address for you until you add one.
• If you connect Gmail, Maze temporarily processes receipt content and metadata needed to identify purchased products. Maze stores the item information you keep, such as product names, brand names, item variants, colors, sizes, quantities, categories, product links, and product images when available. Maze does not store product prices, Gmail message IDs, email subject lines, email dates, or order dates on purchased item records.
• Collection information, such as items you keep, edit, delete, reorder, save, like, share, or manually add.
• If you turn on notifications, Maze stores the notification token your device gives it, whether that token is for Apple's test or live notification environment, your device's time zone, and when it was registered. The time zone is used for one thing: so a notification is not delivered to you in the middle of your night. The token identifies an installation of the app, not you personally, and all of it is deleted when you delete your Maze account.
• Uploaded content, such as profile images and outfit or product photos you upload for item detection or visual generation.
• Usage and log information, such as browser type, device type, operating system, IP address, referring pages, pages viewed, timestamps, feature interactions, and diagnostic logs.
• Communications with us, such as emails or support requests you send to Maze.

We use information to operate Maze, authenticate users, scan Gmail for purchase-related emails, extract product details, enrich item pages with images and links, order the feeds Maze shows you using the items already in your collection, let you edit and share collections, provide public profile pages, support saved items, generate story images, respond to support requests, maintain security, debug issues, and improve the Service.

We may use usage information and aggregated or de-identified information to understand product performance, improve user experience, detect abuse, and develop new features. Some of that usage information reflects Gmail data indirectly. When Maze records that a card was shown to you in a feed, the position it appeared at depends on the ordering described in section 2. Those records carry a reference to the item shown and its position, and they do not carry email content, senders, subjects, prices, or a list of what you bought. Maze uses them to work out how far people scroll, and for nothing else. We do not use Gmail data for advertising.

Maze uses AI and automated services to extract products from email receipts, detect items in uploaded photos, search for product images and links, and generate or improve product visuals. These systems may process relevant item text, email receipt snippets, image URLs, uploaded photos, and item metadata.

AI and enrichment results can be incomplete or inaccurate. You can review, edit, remove, and reorder items in your collection. Maze does not use Gmail data, or any Google user data obtained through Google APIs, to develop, improve, or train generalized or non-personalized AI and/or ML models. Maze's AI processing runs on fal.ai, which hosts the models Maze uses and receives the receipt text needed to identify a purchase. Maze does not permit that data to be used to train generalized models. Maze's use of Gmail data is limited to providing and improving Maze's user-facing features.

Maze also screens what people put on Maze, so objectionable content stays off it. When you add an item, or save your username, display name, location, or profile photo, that text and that photo go to OpenAI's moderation endpoint, which returns category scores and no content of its own. Maze uses those scores to hold an item or take down a profile photo until someone reviews it. Item text can include details Maze pulled out of a receipt email. OpenAI processes this on Maze's behalf under its API terms, which do not permit that data to be retained for abuse monitoring or used to train models.

Maze is built around shareable collections. If you create a username, complete onboarding, keep items, or share item/profile links, parts of your profile and item collection may be publicly visible. Public information can include your display name, username, location if you provide it, profile image, item images, brands, product names, categories, product links, and generated share images. Public items are also shown to other people inside Maze: items from a public collection, including items Maze built from your receipts, can appear in other people's feeds. You can make your account private, which limits your collection to the Mazers you accept. Liking and following are not private. When you like someone's item, or follow them, Maze tells that person you did it, and shows them your name, username, and profile image. Saving is different. Maze never tells the owner of an item who saved it, and never shows any other Maze user a list of who saved something. In the Maze app, an item's save count appears only once at least five people have saved the item, and that count is the same number for everyone who sees it. The list of what you have saved is yours: only you can see it in Maze.

Maze can also send those two notifications to your phone, if you turn notifications on. A notification from Maze carries the @handle of the person who liked your item or followed you, the words liked an item of yours or followed you, and an internal reference Maze uses to open the right screen. It carries nothing else. It never carries anything Maze read in your email: no brand, product name, category, retailer, price, image, or link. Which item was liked is visible only after you open Maze.

You control which extracted items you keep during setup and can edit or delete items later. Please do not add or share anything you do not want others to see.

We do not sell your personal information or Gmail data. We share information only as needed to provide Maze, comply with law, protect rights and safety, or operate our business.

• Service providers: we use vendors for hosting, database and storage, deployment, authentication support, AI processing, content moderation, image generation, image resizing and delivery, product and image search, push notification delivery, analytics, monitoring, and support. Apple delivers Maze's notifications to your device through the Apple Push Notification service. Maze sends Apple your device's notification token, the @handle of the Maze user who liked your item or followed you, and a fixed phrase, and never anything Maze extracted from your email. Current vendors include Convex, Vercel, Google, Apple, fal.ai, OpenAI, Oxylabs, wsrv.nl, Resend, and PostHog.
• Affiliate links: Maze has no approved affiliate programs today, and no affiliate network sits in any link on Maze. Tapping Buy sends you to a redirect on trymaze.app, which forwards you straight to the retailer. Maze records that the tap happened: the item, the brand, the retailer's hostname, and whether you were on web, iOS, or the browser extension. It does not record who tapped, your IP address, the full destination link, or anything Maze extracted from your email. If Maze joins an affiliate program later, we will update this policy before turning it on.
• Public sharing: information you publish or share through Maze, such as public profiles and item pages, may be viewed by others.
• Legal and safety: we may disclose information if required by law, legal process, or to protect Maze, users, or others from fraud, abuse, security threats, or harm.
• Business transfers: if Maze is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction subject to appropriate protections.

We retain account information and item data for as long as your account is active or as needed to provide Maze. Gmail-derived item data that you choose to keep may remain in your Maze collection until you remove the items or request deletion. Google sign-in does not require Maze to store Gmail OAuth tokens. Gmail OAuth tokens are retained only if you choose to connect Gmail, and can be deleted by disconnecting Gmail or invalidated if you revoke access.

If you sign in with an email address and password, Maze stores your password only as a one-way hash, never the password itself. The 6-digit codes Maze emails you to verify a new account or reset a password are also stored only as a one-way hash. A verification code expires after 15 minutes, a reset code after 30 minutes, each works once, and each stops working after five wrong entries.

We may retain limited logs, backups, security records, and legal records for a reasonable period after deletion where necessary for security, fraud prevention, legal compliance, dispute resolution, or business continuity. When we no longer need identifiable information, we delete it or de-identify it.

You can manage your Maze information in several ways. Some controls are available in the product, and you can also contact us at michaela@trymaze.app.

• Disconnect Gmail from Maze in profile edit mode, or revoke Maze's access in your Google account permissions.
• Edit, remove, or reorder items in your Maze collection.
• Delete or change profile information such as name, username, location, and profile image where supported.
• Delete your account from profile edit mode, or request access to, correction of, export of, or deletion of your personal information by contacting michaela@trymaze.app.
• Clear your local browser session by signing out.

Maze may use cookies, local storage, and similar technologies to keep you signed in, remember session state, operate the Service, understand usage, diagnose issues, and improve performance. You can configure your browser to block or delete cookies, but some Maze features may not work correctly.

Maze does not use Gmail data for advertising. Our analytics tools are used to understand product usage and performance, not to sell Gmail data or serve ads based on Gmail content. Maze's product analytics run on PostHog, which processes them on Maze's behalf and is not an advertising network or a data broker. Section 4 describes what Maze sends there. Maze runs no advertising, affiliate, or ad-network scripts on any page, signed in or signed out. When you tap Buy, you pass through a redirect on our own domain and go straight to the retailer, with no third party in between and no cookie set by Maze along the way. The retailer's own site will set its own cookies, as any site does.

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit, access controls, hashing of session tokens, passwords, and one-time codes, and restricted access to production systems. No service can guarantee perfect security, and you are responsible for keeping your account and devices secure.

Maze is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. Some countries set a higher minimum age for using a service like Maze without a parent or guardian's permission. If you are under that age where you live, please do not use Maze without it. If we learn that we hold personal information from someone below the applicable age, we will take reasonable steps to delete it.

Maze may process and store information in the United States or other countries where our service providers operate. By using Maze, you understand that your information may be processed outside your country of residence.

Depending on where you live, you may have rights to know, access, correct, delete, export, or restrict certain uses of your personal information. Maze does not sell personal information as the term is commonly understood under privacy laws, and we do not sell Gmail data.

To exercise privacy rights, contact michaela@trymaze.app. We may need to verify your identity before fulfilling a request. We will not discriminate against you for exercising privacy rights.

Maze may link to retailers, marketplaces, product pages, social platforms, and other websites we do not control. Those websites have their own privacy practices. We are not responsible for their content, security, or privacy policies.

Maze has no affiliate programs today. If that changes, links out of Maze may become affiliate links, and if you buy something after clicking one, Maze may earn a commission at no extra cost to you. This will never change which items appear in your collection or how they are ordered.

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify you, such as posting the updated policy on this page or providing notice through the Service. Changes are effective when posted unless otherwise stated.

If you have questions, requests, or concerns about this Privacy Policy or Maze's handling of personal information, contact us at michaela@trymaze.app.