What Mati does with your data.

Effective 27 June 2026(intended publish date, to confirm on go-live)

Mati is a code editor that reads what you (or your AI) wrote and teaches the concepts inside it. This policy describes what data Mati actually collects, why, and what it deliberately does not. It is written to match how the product works, not from a template.

Who we are and how to reach us

Mati (mati.zonivan.com) is a product of Zonivan. For any question about this policy, or to make a request about your data, email abhishek@zonivan.com.

This policy covers the Mati product only. Other Zonivan products run on shared infrastructure but are governed by their own terms and notices.

What we collect

Account

Your email address and, optionally, your name. If you sign up with a password, we store a hashed (bcrypt) version of it and never the plaintext. If you sign in with Google, we receive and store your Google account identifier, email, and name (see Sign-in with Google below). We also keep account and security metadata such as your verification status, sign-up and last sign-in times, and one-time email-verification or password-reset codes.

Learning state

Mati tracks what you have learned: a status and review stage per concept, your recall scores, and spaced-repetition (SM-2) scheduling data such as ease factor, repetition count, and due dates. This is stored on our servers, one row per concept, keyed to your account. The schedule itself is computed in your browser and synced up.

Usage records

When you use a feature that calls the model (concept extraction, streamed explanations, the worked example, Ask Mati chat, code generation, recall generation), we record a usage row: which feature, token counts, a cost figure (sometimes an estimate), and a timestamp. These rows do not contain your prompt, the model’s response, or your code; the content field is stored empty. They exist to meter your credit usage against your quota and to understand which features get used.

Recall events

When you complete a recall, we record the concept and a coarse pass / partial / fail bucket, plus a per-tab session identifier. We do not receive the text of your answer (see What we do not collect).

Candidate concepts

When Mati detects a concept its catalog does not yet cover, it records the detected concept name, a suggested catalog slug, the programming language, a source label, and a short context excerpt of at most 200 characters (a few lines around the detection). That excerpt is the only verbatim slice of your code Mati keeps.

GitHub (only if you connect it)

If you connect a GitHub account, you authorize Mati through GitHub’s OAuth to read the repositories you grant access to. The resulting access token is stored encrypted (Fernet) on our backend, used only to fetch the files you open, never sent to your browser, and deleted when you disconnect.

Technical and security data

Like any web service, our servers process your IP address and browser’s User-Agent string on each request to keep the service running and to prevent abuse (rate limiting). On Mati’s endpoints this is used transiently in memory and may appear in security logs; it is not stored on your account record.

How we use it

To authenticate you and keep your account secure.
To provide the teaching features: extract concepts from your code, stream explanations, show the corrected example, answer questions, and generate code on request.
To track and schedule your learning (statuses and spaced repetition).
To meter your usage against your credit quota and to see which features are used.
To protect the service from abuse.

We do not sell your personal data, and Mati does not use your code or content to train its own models. Your code is sent to our LLM provider (OpenRouter) to generate responses, subject to its data policy; see Third-party processors.

What we do not collect

We do not store your source code. It is sent to our LLM provider to extract concepts and generate explanations, processed transiently, and not saved in our database. We do not keep your files or the model request and response bodies. The single exception is the 200-character candidate excerpt described above.
We do not receive your recall answers.The text you type as a recall answer stays in your browser’s local storage and is never transmitted to or stored on our servers. We store only a derived score and the coarse bucket, not the text.
No advertising or cross-site tracking. Mati sets no advertising or tracking cookies and embeds no third-party advertising or analytics trackers beyond cookieless Vercel Web Analytics.
We do not knowingly collect data from children under 16. Mati is intended for an adult, general developer audience.

Third-party processors

Mati relies on a small set of service providers. Each receives only what it needs to do its part, and each handles your data under its own terms. We do not sell personal data.

OpenRouter: Runs the language models. Receives the code and prompts needed to extract concepts and generate explanations, and returns the result.
Google: Sign-in only, via OAuth / OpenID Connect. We request the scopes openid, email, and profile and receive your verified email, name, and account id. Mati cannot access your Drive, Gmail, or any other Google data, and stores no Google token.
GitHub: The repository connector, used only if you connect it, to read the repositories you authorize.
Vercel: Hosts the Mati frontend and provides cookieless Web Analytics (aggregate page metrics, no cross-site tracking).
SendPulse: Sends transactional email such as your verification code and password-reset messages.
Google Cloud: Hosts our backend application and the PostgreSQL database that holds your account and learning data.

Cookies and analytics

Mati uses only first-party, essential cookies, all HttpOnly (not readable by browser scripts), SameSite=Lax, and Secure in production:

mati_auth: your session cookie, which keeps you signed in.
mati_pending_verification: a short-lived cookie used during email verification.
mati_oauth_state: a short-lived cookie that protects the Google sign-in round trip from cross-site request forgery.

We set no advertising or tracking cookies. Site analytics are provided by Vercel Web Analytics, which is cookieless and does not track you across sites.

Mati also keeps data in your browser’s local storage so the app works: your learning state, cached explanations, and extraction results. This stays on your device and is cleared when you reset the workspace or sign out.

Data retention

We keep your account and learning data while your account is active and until you ask us to delete it. Usage and candidate records are retained for credit accounting and product improvement. Recall answer text is kept only in your browser. On a verified deletion request we delete or anonymise your personal data within 30 days, unless we are legally required to retain it; note that closing your account currently deactivates it, and full erasure is actioned on request.

Your rights

You can ask us to access, correct, export, or delete your personal data by emailing abhishek@zonivan.com. We will authenticate the request and respond within 7 working days. Deletion is handled manually at this stage; we will action your request. Depending on where you live, you may have additional statutory rights under applicable data-protection law (including India’s), which we will honour.

Security

Your data is encrypted in transit using TLS. Passwords are stored hashed (bcrypt), never in plaintext. Any GitHub access token you grant is encrypted at rest (Fernet). No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

International data transfers

Mati is operated from India, and some of our processors are based elsewhere (for example, OpenRouter and Vercel in the United States). When your data is processed across borders, we rely on those providers’ standard safeguards to keep it protected to an equivalent standard.

Changes to this policy

We may update this policy as Mati evolves. When we do, we will revise the effective date shown at the top of this page, and we will flag material changes through the product or by email where appropriate.