Privacy Policy

This Privacy Policy explains how MationX, a service operated by Petr Kynčl ("MationX", "we", "us") based in the Czech Republic, collects, uses, shares, and protects your personal data when you use the MationX website, MationX Studio, the MationX Client, and related services (together, the "Service").

For users in the European Union / EEA, MationX is the data controller for the processing described here, and we process your data in line with the General Data Protection Regulation (GDPR).

We collect the following categories of information to provide and improve the Service:

• Account information: your name, email address, username, plan, profile photo, and authentication identifiers when you sign in with Google or GitHub.
• Device information: data about the Android devices you connect, including device names, models, manufacturers, IP addresses, push (FCM) tokens, and secure hardware and pairing identifiers (such as TEE signatures) used to pair and secure devices.
• Device configuration and health: technical characteristics the device reports about itself so you can tell your devices apart and see which one needs attention. This covers the Android version, security patch level, build and hardware identifiers; the MationX Client version and whether it was installed from Google Play or from a file; the device language, region and time zone; the mobile network operator name, SIM and network country, the type of connection in use and whether a VPN is active; screen size, density and refresh rate; available storage and memory; battery level, charging state, health and temperature; how long the device has been running since its last restart; and configuration signals such as whether a screen lock is set and whether developer options or USB debugging are enabled. None of this requires a permission on the device, and it does not include your phone number, hardware serial numbers, precise location, or the name of the network you are connected to.
• Automation data: the automations, configurations, building blocks, selectors, variables, and UI-hierarchy Snapshots needed to build automations and sync the Studio with your Client.
• On-screen and device content read by your automations: when your automations run, the MationX Client may read on-screen content through the Android Accessibility Service, notification content, incoming SMS or MMS content (only if you build an automation that uses an SMS trigger), contact details it resolves to target a message, the contents of a file you point a file step at, the list of apps installed on the device (so you can choose which app to automate), and screen captures. Depending on the steps you build, this content may be sent to our servers and, for AI steps, to AI providers, and some of it may be stored. See Accessibility, Snapshots, and AI features below.
• Usage and technical data: logs, app diagnostics and crash reports (through Google Firebase and Crashlytics), and browser and device type.
• Sign-in and session records: when you sign in, or attempt to, we record the time, the method used, the IP address the request came from, the country that address resolves to, and your browser's user agent. We record failed attempts too, including attempts on email addresses that have no account, because those are what a break-in looks like. We also record when your account and your connected devices were online. The country is approximate, derived from the IP address by our network provider; we do not collect precise location.
• Payment data: handled by our payment processor (Stripe). We receive limited billing details but do not store full card numbers.
• Communications: messages you send us via support chat or email.
• Cookies: as described in the Cookies section below.

• to operate the Service and securely link your Client with the Studio dashboard;
• to store, sync, and run the automations you build, including AI-assisted steps;
• to handle subscriptions, billing, and affiliate referral tracking;
• to provide customer support and respond to your requests;
• to contact you about your account, including service messages and occasional product or onboarding emails (see Communications and email below);
• to secure the Service, prevent fraud and abuse, and keep it reliable;
• to analyze and improve the Service; and
• to comply with legal obligations.

When you create an account we may email you at the address you registered:

• Service messages that we send while you hold an account and that you cannot opt out of: sign-in and email verification, security and billing notices, and important changes to the Service.
• Onboarding and personal help from our team, such as asking whether you would like a hand setting up a project or a quick call. These are low in volume and rely on our legitimate interest in helping you use a service you chose to sign up for; you can ask us to stop at any time.
• Product and marketing emails (updates, tips, offers) only if you opt in. You can give or withdraw this consent with the marketing checkbox when you sign up and, at any time afterwards, from your account settings.

To stop non-essential emails, turn off product email in your account settings, use the unsubscribe link in any such message, or contact us at the address in the Contact section below. We keep a record of opt-outs and honour them promptly. We do not sell your email address, and we do not share it for third-party marketing.

• Performance of a contract: to provide the Service you sign up for.
• Consent: for example, for non-essential analytics cookies; you can withdraw consent at any time.
• Legitimate interests: to secure, maintain, and improve the Service, and to send you the account, onboarding, and product emails described above, where not overridden by your rights.
• Legal obligation: for example, to meet accounting and tax requirements.

The MationX Client uses the Android Accessibility Service API to automate the tasks you define. This lets the app read on-screen window content and perform simulated gestures (such as taps and swipes) strictly according to the automations you create in the Studio, and to react to events your automations listen for (such as an element appearing on screen or an incoming notification).

We do not use the Accessibility Service to monitor your general device activity. It is active only while running your authorized automations or when you manually use a feature that reads the screen (such as taking a Snapshot). Some automation steps do send the on-screen content they read off the device so the step can run: for example, Snapshots, screen-text extraction, and AI-assisted steps transmit the content they read to our servers, and AI steps additionally send it to AI providers. Some of this content is stored, as described under Snapshots and AI features below.

Because the content read from the screen is defined by the automations you build, it can in principle contain sensitive information shown by other apps. We do not intentionally seek out passwords, payment card numbers, or other sensitive data, and we recommend that you do not build automations that capture them. You are responsible for the automations you create and the data they read.

The Snapshot feature lets you capture your current screen so you can visually build and map your automations. A Snapshot includes the screen's structural data (the UI hierarchy) and an image of the screen at that moment. When you trigger it, that data is sent to and stored on MationX servers only to help you build your automations. Snapshots are captured on your command, not automatically in the background, and you can delete them.

Some steps in your automations are AI-assisted (for example, extracting structured data from a screen, finding an on-screen element by description, or the Studio assistant). When you use such a step, the content it needs to do its job, which may include on-screen content read from the device, text you provide, or automation data, is sent to an AI provider to process the request and return a result.

By default this provider is Anthropic; depending on your configuration, other providers we support (such as OpenAI, Google or DeepSeek) may be used. These providers act as our processors and handle the content only to perform your request under their API terms; they do not use it to train their models. We keep a limited record of AI requests and results to operate, secure, and debug the feature.

Where you connect a Google account (for example to sign in, or so an automation can work with Google Workspace services such as Gmail, Google Sheets, Drive or Calendar), MationX requests only the scopes needed for the feature you enabled, and uses that data only to provide it to you.

MationX's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, and without limitation:

• We do not use Google user data to develop, train, or improve AI or machine learning models. This applies to raw, aggregated, De-identified, and derived data alike, and to both our own models and any foundational or generalised models operated by third parties.
• AI steps only ever see Google data if your own automation sends it there. We never route Google user data to an AI provider on our own initiative. If you build a step that passes such data to an AI provider, it is processed solely to return your result under that provider's API terms, which prohibit training on it, and it is still never used to train or improve any model.
• We do not sell Google user data, and we do not use it for advertising, marketing, or any other purpose unrelated to providing or improving the user-facing features you enabled.
• We do not transfer Google user data to others, except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you.
• Humans do not read your Google user data, unless you give us explicit permission (for example while we help you with a support request), it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data is aggregated and De-identified for internal operations.

You can disconnect your Google account at any time from your MationX Studio settings, or revoke access directly from your Google account permissions page. Revoking access stops any further use of that data, and stored copies are deleted as described under Data retention.

Shared projects

Sharing a project publishes a frozen copy of it at a public address that anyone with the link can open. That copy carries what you put in it - the project's name, description, blocks and selectors - together with your public profile name and username, so people can see who built it. It does not carry your email address, your devices, or your Snapshots. Nothing is published unless you share it, and you can unshare it, which removes the public copy.

Webhooks and integrations

When you build a step that sends data somewhere - a webhook to your own endpoint, a row into Google Sheets, a message through an integration you connected - we send exactly what your automation tells us to send, to the destination you chose. We are not a recipient of that data beyond passing it on, and what the destination then does with it is governed by whoever runs it, not by this policy.

We do not sell your personal data. We share it only where necessary, with:

• Payment processing: Stripe, to handle subscriptions and payments.
• Authentication: Google and GitHub, when you choose to sign in with them.
• Infrastructure: Hostinger International, whose servers host the Service and its database (currently in the United States), and Cloudflare, which sits in front of our sites as a network and security layer and therefore handles requests in transit.
• Email delivery: Resend, which sends the account, verification, and product emails described above.
• Analytics and diagnostics: Google Analytics and PostHog, which help us understand how the Service is used, and Google Firebase and Crashlytics for push notifications, app diagnostics and crash reports.
• AI providers: to run AI-assisted steps, as described under AI features. They act as our processors.
• Integrations you enable: services such as Google Sheets or WhatsApp receive only the data your automations direct to them.
• Legal and safety: where required by law or to protect our rights, users, or the Service.

We use essential cookies to run the site, analytics (Google Analytics and PostHog) to understand and improve usage, and a live chat tool for support. You can control cookies through your browser, and where required we ask for your consent to non-essential cookies.

Our support chat is self-hosted on our own servers (chat.mationx.com, running Chatwoot). What you write to us there is not passed to a third-party chat vendor.

Campaign links. Some of our links carry a short campaign code, for example mationx.com/r/some-video in the description of one of our videos. Following one records the click on our own servers (the code, the time, the page you landed on, the referring address, your IP address and your browser’s user agent) and stores that code in a first-party cookie on your device for 90 days. If you later send us an enquiry, the code travels with it, so we know which video or post brought you to us. It is ours alone, it is not shared with any advertising network, and clearing your cookies removes it.

We keep your personal data for as long as your account is active and as needed to provide the Service. When you delete your account, it is disabled immediately and then permanently erased, together with your automations, devices, and Snapshots, after 90 days; during that window you can contact us to restore it. After that, we keep only the minimal records we are legally required to retain (for example, billing and tax records), for the period required by law and for no other purpose.

How long particular things live while your account is open:

• Account, automations, selectors and Snapshots: until you delete them or delete your account.
• Run history: pruned automatically on a window that depends on your plan, shown on the pricing page.
• Sign-in and session records: capped at a fixed number of the most recent records per account rather than by age, so the history stays useful for spotting unauthorised access. They are erased with the account.
• Support conversations: kept while they are useful for supporting you, on our own servers.

Backups. We back our database up regularly so we can recover from a failure. When data is deleted it is removed from the live Service immediately, but copies can persist in those backups until they rotate, currently within 14 days. Backups are not used to bring deleted data back into the Service; they are only ever restored whole, in a disaster.

We use industry-standard measures to protect your data, including bcrypt password hashing, encrypted TLS communication between the Client and our servers, and strict token-based authentication for your automations and connected devices. No method of transmission or storage is completely secure, but we work to protect your information.

If personal data is breached and that breach is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority within 72 hours of becoming aware of it, as the GDPR requires, and we tell you directly and without undue delay where the risk to you is high. We will say what happened, what data was involved, what we have done about it, and what you can do.

Depending on your location, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data ("right to be forgotten");
• restrict or object to certain processing;
• receive your data in a portable format; and
• withdraw consent at any time, without affecting prior processing.

You can delete your account from the MationX Studio settings at any time, or by emailing us. Deleting your account disables it immediately and then permanently removes your automations, devices, and Snapshots from our servers after 90 days via cascading deletion. See our account deletion page for details. EU/EEA users also have the right to lodge a complaint with a supervisory authority (in the Czech Republic, the Office for Personal Data Protection, ÚOOÚ).

How we handle a request

We answer within one month of receiving a request, and tell you if we need longer because the request is complex. We verify that a request comes from the person it concerns before we act on it - normally by requiring it from the email address on the account, and by asking for more if anything about the request does not add up. This protects you: handing over or deleting an account's data on the say-so of whoever sent an email would be a bigger risk to you than any of the rights above are worth.

Automated decisions

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you, and we do not use your data for that kind of profiling. AI features run the steps you build; they do not decide anything about you.

Your data may be processed by us or our providers in countries outside your own, including outside the EEA. Where that happens, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) to protect your data.

If you live in California or another US state with a comprehensive privacy law, you have rights to know what personal information we collect and why, to access and delete it, to correct it, and not to be discriminated against for exercising them. The sections above describe what we collect and why; use the same contact address to exercise these rights, and we will handle the request the same way.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising as those terms are defined by the California Consumer Privacy Act - so there is nothing to opt out of.

The Service is not directed to children, and we do not knowingly collect their personal data. To create an account you must be at least 16, or the age of digital consent in your country if that is lower - several EU member states set it at 13, 14 or 15.

If you believe a child has provided us personal data, contact us at [email protected]. We will take reasonable steps to verify the report and, where it is confirmed, delete the account and the data it holds. We verify rather than delete on request alone: an account can be someone's business, and a report we acted on blindly would be a way to take it from them.

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, for material changes, provide reasonable notice.

For any privacy questions or to exercise your rights, contact us at [email protected]. Data controller: MationX (Petr Kynčl), Czech Republic, Czech business ID (IČO) 29638330.