Website privacy · 16 September 2026
Privacy on this website.
This page describes this public website. It is not the privacy policy for the Mambo Meadow app.
Who operates this website
Finally done, MB operates this website and handles enquiries sent to support@mambomeadow.app.
Visiting
This website has optional, consent-based analytics and no advertising trackers or signup form. Fonts and screenshots are served with the website rather than loaded from third-party font or image services.
Hosting
Hosting providers process technical request information such as IP addresses, browser information and requested URLs to deliver and protect a website. The prepared hosting configuration uses Cloudflare. See Cloudflare’s privacy policy for its processing practices.
Contacting us
Email links open your email application. You choose what to send. Incoming messages are forwarded by Cloudflare Email Routing to Gmail, where correspondence is stored. Brevo provides the configured outgoing email service. These providers process message content and delivery information to provide those services. Please avoid sending health records, credentials or other sensitive information in an initial enquiry.
For questions about this website or your correspondence, contact support@mambomeadow.app.
Purpose and legal basis
Technical request information is processed to deliver and protect the website. Responding to a business enquiry serves the legitimate interest of communicating with prospective customers; where you ask for steps towards a contract, that correspondence may also be necessary to take those steps.
Your rights
Where applicable, you can request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. Contact support@mambomeadow.app. You may also complain to the Lithuanian State Data Protection Inspectorate or your local supervisory authority.
External links
Product websites and GitHub and LinkedIn links take you to separate services with their own privacy practices.
Optional website analytics
Updated 7 September 2026. If you allow analytics, Finally done, MB uses Google Analytics to understand website visits, traffic sources, active engagement and explicitly labelled interactions. Google processes browser/device information, approximate location and cookie identifiers. Analytics starts only after you allow it. Rejecting analytics does not affect the site.
We do not send note titles, note text, searches, health records, email content or form entries to Analytics. Advertising features and automatic enhanced measurement are disabled. This describes the public website, not new tracking in the native app.
Use Analytics settings on this site to withdraw permission. This stops subsequent measurement and removes this site's Analytics cookies. Withdrawal does not undo earlier processing. Your choice is stored in this browser for 180 days. Host-only cookies _ga and _ga_4R8B51XQ54 last up to 180 days without renewal. User and event data retention is two months, without reset on activity; aggregate reports may remain longer.
Google may process data outside the EEA. See Google's privacy notice for its processing and safeguards. Cloudflare processes technical requests to deliver and protect the site and provide aggregate traffic and crawler reports. Contact hello@finallydone.ai about data rights, including access, correction, deletion, restriction, portability and withdrawal where applicable. You may complain to the Lithuanian State Data Protection Inspectorate or your local authority.
Website traffic intelligence
We use technical request information to understand public website reach, crawler activity and reliability, and to guide improvements to our websites and services. Cloudflare supplies approximate country, region, city, timezone, network number (ASN) and network owner where available. We retain these derived fields together with the public page or asset requested, response status, browser/device families, self-declared crawler category, referring website domain and technical response measurements. Location is approximate and network ownership does not identify your employer. Unknown values remain unknown.
This server-side processing uses information already accompanying a website request. It does not set analytics cookies, read your notes or create an individual visitor profile. Our intelligence store does not retain raw IP addresses, full user-agent strings, cookies, URL query strings, note content, account identifiers or private synchronization requests. Google Analytics remains separate and starts only after your consent.
We rely on our legitimate interests in understanding and improving our public services, monitoring crawler access and maintaining website reliability. We limit the information, access and retention, and do not use it for advertising or decisions about individuals. You can contact hello@finallydone.ai to object to this processing or exercise applicable data rights.
Our access-restricted Cloudflare D1 archive retains detailed derived records for 90 days. Daily grouped statistics are retained for 24 full calendar months plus the current month, and monthly grouped statistics for 60 full calendar months plus the current month to compare product, audience and channel changes over time. Private recovery copies rotate within eight days, and restored records are checked against these limits before use. Access is restricted to operating and analysing these websites. Cloudflare may process requests internationally; our primary intelligence archive is hosted by Cloudflare, with versioned recovery copies on our private infrastructure. Expiry runs in bounded batches and can be delayed by service or quota interruptions. No archive information is published as a public visitor dashboard.
Analytics history
We also preserve consent-based Google Analytics reports in this private archive: daily reports for 24 full calendar months plus the current month, and monthly acquisition, interaction and successful-use aggregates for 60 full calendar months plus the current month. Explicitly marked testing visits are labelled separately. Historical reports without this label are treated as unclassified. These exports contain aggregate report dimensions and counts, not raw IP addresses, visitor identifiers or note content.
Before discarding the request IP address, we may compare it with published operator network ranges to retain a network or crawler classification, the matching source and its freshness. We keep observed request categories and claimed identities separate from verified evidence; network ownership alone does not establish residential access, a person or an employer. We also record requested and returned content formats and broad public route categories to distinguish successful machine-readable content from missing-page responses.
Automated clients may voluntarily send the fixed purpose, resource, tool and requester-type categories described at /agent-intelligence.json, and optionally a public organization domain or public HTTPS project URL they intend to disclose. We validate the format and discard unsupported values. Public project URLs may retain a simple public path, but never credentials, query parameters or fragments. These claims are not verified identities or proof of an affiliation. We retain these as unverified declarations alongside the technical request statistics above, under the same access and retention limits. Participation does not affect access. Please do not send prompts, queries, personal details, names, account identifiers, credentials, private project links or private task descriptions. We do not create a unique guest identifier or infer a person from these declarations.
On-site feedback and private updates
When the on-site feedback service is available, you can send an idea or issue without an account or contact details. Your message and any image, marks, or voice note you choose to include are sent only when you select Send. Capture and image review happen locally first. Review attachments before sending and avoid including credentials or unrelated sensitive information.
Basic technical details are a separate option, off by default. They include browser language, viewport size, and app build, not page addresses, form contents, or browsing history. You may optionally provide an email address or a messenger platform and handle. These contact details are private report data, not public updates or analytics data. We use reports to review and respond to feedback and improve the service.
The feedback service stores reports in Cloudflare D1 and attachments in private Cloudflare R2. The current configuration schedules attachments to expire after 30 days and reports, including optional contact details, after 90 days. Deletion runs periodically and can be delayed by service interruptions. Contact us about deletion or other applicable data rights.
A private receipt is stored in this browser's localStorage so My feedback can retrieve deliberately published updates. The receipt is an access capability, not an account. Other people or scripts with access to this browser and site storage may be able to use it. Receipts remain until the site's browser data is cleared; clearing them does not delete the server report. An unsent draft stays in memory for the current visit.
Email update delivery is currently off. If enabled, receiving updates requires a separate request and confirmation of the email address. Email preferences provides withdrawal and mailbox-based access recovery where available; recovery does not restore report-deletion authority. A response or update is not guaranteed.
Optional browser error and performance monitoring is currently unconfigured and off. When configured, it requires its own Monitoring preferences choice, separate from report diagnostics and Google Analytics. The shared controls describe the limited measurements before consent and allow withdrawal. They exclude report contents, images, audio, contacts, receipt secrets, and full page addresses. Its versioned choice is stored in this site's localStorage; unavailable or invalid storage does not enable monitoring automatically.