Privacy Policy

Melo stores vocabulary you choose to learn and makes it available in the iOS app and through AI clients you connect. This policy covers the app and Melo's remote Model Context Protocol (MCP) server.

Information Melo stores

Account identifier and connection credentials. The iOS app uses the stable identifier returned by Sign in with Apple as the Melo account token. This is an Apple-provided identifier, not a separately generated or hashed Melo token. The app requests no name or email scopes and does not receive your Apple password. The account token is stored in the device's Keychain and identifies the vocabulary list in the backend. Treat your personal MCP URL as a secret: anyone who has it can read or change that list.

Vocabulary. Entries can include a word or expression, meaning, language, pronunciation, part of speech, grammatical gender, feminine form, example sentences and translations, inflections, and a date. These fields can include text from your conversation if you ask your AI client to save it. Avoid saving personal or sensitive information in vocabulary entries or examples.

OAuth connection records. When you connect an AI client, Melo stores its registered client ID, callback URLs and optional client name, short-lived authorization codes, and access-token records associated with your Melo token.

How Melo uses and stores information

Melo uses these records to authorize connections, save and retrieve vocabulary, search it, sync it to your device, and perform requested updates or deletions. Cloudflare Workers processes requests and Cloudflare KV stores vocabulary and OAuth records. The iOS app also caches vocabulary in UserDefaults for offline access. Signing out preserves that cache.

Melo has no advertising or third-party analytics SDKs. The Worker does not intentionally record MCP request bodies, vocabulary, or credentials in application logs, and its Worker invocation logging is disabled. Cloudflare may process network and operational information as the infrastructure provider.

Connected AI clients and service providers

Cloudflare processes and stores information to operate Melo. An AI service you connect, such as Claude by Anthropic, sends tool arguments to Melo and receives tool results. Those results can include your saved vocabulary. The AI service handles its own conversation and connection data under its own policies.

Melo does not receive an entire chat transcript, Claude memory, or chat history through its connector. It receives the tool requests the connected client sends. Melo does not sell vocabulary or use it for advertising or model training.

Retention and deletion

Vocabulary stays in Cloudflare KV until it is deleted. You can delete individual words in the app or through a connected client. The app's Delete Account action and the delete_account tool remove the account's stored vocabulary; the app also clears its local vocabulary cache when that action is used there. Backend changes may take time to propagate through Cloudflare KV and to devices until they sync.

Authorization codes expire after five minutes. OAuth access-token records expire after one year. Client registration records currently have no automatic expiry. Deleting vocabulary does not automatically remove OAuth registration or access records, revoke existing access tokens, or invalidate the Apple-provided account token. A connected client can save new words after vocabulary deletion. Removing the connector from an AI client stops its use there; Melo does not currently provide in-app account-token rotation or an OAuth revocation endpoint.

For assistance deleting remaining connection records, contact hi@zui.ooo. Do not email your account token or personal MCP URL.

Children

Melo is not directed at children under 13. Melo does not knowingly collect their information.

Changes and contact

Updates are published with a new effective date. For privacy questions, support, or deletion requests, email hi@zui.ooo.

Melo for iOS: Melo on the App Store.