Madi Privacy Policy
Last updated October 22, 2026
Madi is a moodboard web app made by The Casual Things (“Madi”, “we”). This page explains what happens to your information when you use Madi at app.madi.haus. The short version: your boards stay on your device, and in your own Google Drive if you turn on sync. Madi has no accounts and no server database, and we can’t see what you save.
What stays on your device
- Your trees, branches and cards (links, notes, task lists, images, videos, PDFs and other files), their titles, descriptions and tags, and saved website snapshots are stored in your browser’s private storage for this site.
- A few preferences, such as the last tree and branch you opened and the view you picked, are stored in your browser’s local storage.
- Things you share into Madi from another app go straight into that same storage.
- Backups you export are files saved on your device. Madi doesn’t upload them anywhere.
None of this is sent to us. We have no copy of it and can’t recover it for you, so export a backup now and then.
What leaves your device: link previews
When you save a link, Madi asks two small server functions for help, and sends them the link’s address:
- Preview (
/api/unfurl) reads the page’s title, description and preview image, and checks whether the page can be shown inside Madi. - Snapshot (
/api/snapshot) opens the page in a browser on the server and returns a picture of its first screen.
These functions visit the page themselves, so the website sees the server, not you. They don’t keep the addresses they receive or the results they return; the result goes back to your browser and is saved there. Only the link’s address is sent: never your notes, files or other cards.
Our host and bot protection
Madi runs on Vercel. Like any web host, Vercel processes your IP address and request details (including the link address sent to the functions above) to deliver the site, and keeps short-lived logs of those requests. Vercel also limits how often one IP address can use the functions.
To keep bots from abusing the functions, Madi uses Vercel BotID, an invisible check that runs in your browser and looks at signals from it to tell people from automated scripts. You never see a puzzle or a prompt. Vercel’s handling of this data is covered by the Vercel Privacy Policy.
Other websites
Some parts of Madi load content straight from the websites you save, and those sites see your IP address when they do:
- a link’s preview image, until its snapshot is saved;
- the live Preview of a page in a card, when you turn it on;
- any link you open.
What those sites do is covered by their own privacy policies.
Google Drive sync
Sync is off until you turn it on. When you choose Sync with Google Drive, you sign in on Google’s own page and allow Madi to see, create, change and delete only the files it makes in your Drive. It can’t see anything else in your Drive.
- Madi copies your trees, branches and media into a folder named “Madi” in your Drive, and copies them back to your other signed-in devices. The transfer goes straight between your browser and Google; it doesn’t pass through our servers, and we have no copy.
- To keep you signed in, a Madi server function exchanges Google’s one-time sign-in code for tokens and renews your access each hour. The long-lived token is kept only in a secure cookie in your browser that page scripts can’t read; we don’t store it, log it, or use it for anything else.
- Stop syncing signs Madi out of Google and deletes the cookie. Your boards stay on your device and in your Drive, where you can delete the Madi folder yourself. You can also remove Madi’s access in your Google Account’s security settings.
Madi’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We don’t use your Google data for ads, sell it, or let anyone read it.
This feature is in development.
If you choose to connect Pinterest, you sign in on Pinterest and allow Madi to read your boards and pins (read-only). A Madi server function exchanges Pinterest’s one-time sign-in code for an access token; it doesn’t store the code or the token. The token is kept only in your browser and is used to fetch the boards and pins you pick, which are saved as cards on your device like anything else you add. We don’t store your Pinterest data on any server, share it, or use it for anything but showing your pins in Madi. You can disconnect at any time in Madi, and remove Madi’s access in your Pinterest account settings.
What we don’t do
- No accounts, and no ads.
- No analytics or tracking. Madi sets one cookie of its own, and only if you turn on Google Drive sync: it keeps you signed in to Drive.
- We don’t sell or share your information.
Deleting your data
Delete cards, branches or trees in Madi, or delete everything by clearing this site’s data in your browser settings (or removing Madi from your Home Screen). Because nothing is stored on our side, that removes it completely. If you turned on Google Drive sync, the copies in your Drive’s “Madi” folder stay there until you delete them.
Children
Madi isn’t meant for children under 13.
Changes
If this policy changes, we’ll update this page and the date at the top.
Contact
Questions about this policy: info@madi.haus.