Privacy policy
Effective October 28, 2026
Mechy is made by Winding AI Inc. (Winding Labs), Mill Valley, California, USA. This page says what we collect when you use Mechy (the app at mechy.si/app, the iPhone and Android apps, and this website), why, how long we keep it, and who helps us run it. Questions: privacy@mechy.si.
The short version
- We collect what we need to make your guides and run your account, and nothing else: no location, no contacts, no ad tracking in the app.
- Your photos are cleaned of hidden data (like GPS) when you upload them, and are used to make your guide.
- Your guides are private unless you share them. You can delete any guide, or your whole account, in the app.
- We don't sell your personal information.
What we collect, and why
| What | Why | How long | Shared with |
|---|---|---|---|
| Phone number or email | To sign you in with a one-time code | Until you delete your account | Twilio (texts the code), Cloudflare (emails the code) |
| Name, and your Google or Apple account id | If you sign in with Google or Apple. We don't keep your profile picture | Until you delete your account | Google or Apple (they sign you in) |
| Photos you take or upload | To make your guide. We re-save each photo, which removes hidden data such as GPS location | As long as the guide they belong to | The AI model that reads them, through OpenRouter, with zero data retention |
| Voice notes | Turned into text so Mechy knows what you asked | Deleted once transcribed (within a day) | Cloudflare Workers AI; OpenRouter (zero data retention) as a backup |
| What you asked (typed or transcribed) | To make your guide | As long as the guide | The AI models that plan the guide, through OpenRouter, with zero data retention |
| Your guides (steps and drawings) | So you can open them again and share them | Until you delete them | No one, unless you share a link |
| Read-aloud audio | To read steps out loud | 90 days | Cloudflare Workers AI |
| Signed-in devices (IP address, browser or device type) | To show your devices and keep your account safe | The life of the session (60 days at most) | No one |
| Hashed IP, phone and email | To stop abuse, such as code spamming | 2 days | No one |
| Subscription | To run Pro. Your card details go to Stripe and never reach us | Until you delete your account; Stripe keeps invoices as the law requires | Stripe |
| Product analytics | To see which features help, as counts and codes tied to a random id, never your name, contact details, photos or what you asked | PostHog's retention period | PostHog |
| Error reports | To fix crashes, tied to a random id only | 90 days | Sentry |
| The teams and pilot form (email, company, fleet size, your note) | To answer you about Mechy for teams | 12 months | No one |
| Problem reports (the reason and your note) | So a person can check the guide | As long as the guide, or until you delete your account | No one |
We don't ask for your location or contacts, and we don't use advertising SDKs in the app.
How the AI part works
To make a guide, your photos and your request go to AI models through OpenRouter, a service that routes requests to model providers. Every call that carries your photos, voice or words uses a provider endpoint with zero data retention: the provider doesn't keep it or train on it. The model that draws the animations gets only the step text we wrote, never your photos, voice, words or name.
Sharing and the public catalog
If you share a guide, anyone with the link can see its steps and drawings. Your photos are never on a shared page. You can turn a share link off at any time.
We may publish a copy of a guide in Mechy's public catalog after a person has reviewed it for safety. A published copy holds only the steps and drawings: never your photos, voice, name or anything that identifies you. See the Terms.
This website
The website (not the app) uses Google Analytics to count visits and which pages lead people to try Mechy. It is not loaded when your browser sends Global Privacy Control or Do Not Track, and you can turn it off here:
Product analytics (PostHog) runs on our own domain, without cookies for people who aren't signed in, and records no names, emails or form contents.
Your choices and rights
- Delete: delete a guide or job in the app, or your whole account in Settings. See Delete my account.
- Get a copy: email privacy@mechy.si from the address on your account, or tell us the phone number, and we send you your data.
- Correct: change your name or contact details in the app, or email us.
We answer privacy requests within 30 days. If you live in California or another place with privacy laws, you have these rights by law, and we won't treat you differently for using them.
How long we keep things
Besides the times in the table: jobs that failed or were refused are deleted after 30 days, and accounts made without signing up (your first free guide) are deleted after 30 days without use. When you delete your account we delete your profile, jobs, photos, audio and guides, including copies in storage.
Children
Mechy is not for children under 13, and we don't knowingly collect their information. If you think a child has used Mechy, email privacy@mechy.si and we'll delete it.
Who helps us run Mechy
- Cloudflare: hosting, storage, sign-in emails, speech-to-text and read-aloud.
- Twilio: sign-in codes by text message.
- OpenRouter and the model providers it routes to: reading photos and writing guides, with zero data retention for anything containing your data.
- Google: Sign in with Google, and Google Analytics on this website only.
- Apple: Sign in with Apple.
- Stripe: payments.
- PostHog: product analytics.
- Sentry: error reports.
Changes
If we change this policy we'll update the date at the top, and tell you in the app if the change matters.
Contact: Winding AI Inc., Mill Valley, California, USA. privacy@mechy.si