Privacy Policy

1. Introduction

Mindleau ("we", "our", "us") is a mental well-being application that helps users practise journalling, mindfulness, and mood reflection. This Privacy Policy explains what data we collect, how we use it, and what rights you have over it. By using Mindleau you agree to the practices described in this policy.

If you have questions or concerns, contact us at contactus@aishayy.com.

2. Information We Collect

Information you provide

• Journal entries, mood tags, and focus tags you write inside the app
• The display name you enter during onboarding, and your email address if you choose to link one to your account
• Session progress and personal preferences

Information collected automatically

• App usage data — sessions completed, streaks, feature interactions (via Firebase Analytics)
• Crash reports and diagnostic data (via Firebase Crashlytics)
• Device identifiers used by Firebase (Firebase Installation ID)
• Advertising identifiers and ad interaction signals used by Google Mobile Ads to serve, limit, and measure ads
• If you buy or restore the optional Remove Ads purchase: the purchase record (product, price, currency, transaction date, store receipt) and whether it is active, processed by RevenueCat

What we do NOT collect

• Precise or approximate location
• Photos, videos, or audio
• Card numbers, bank details, or billing addresses. Purchases are paid through the Apple App Store or Google Play, and we never see your payment details.
• Contact list, calendar, or any other device data

3. How We Use Your Information

• To provide and improve the Mindleau experience
• To back up your data and sync it across devices (Cloud Firestore). See section 7.
• To process, verify, and restore the optional Remove Ads purchase, and to stop showing ads once you own it (RevenueCat, Apple App Store, Google Play)
• To analyse app stability and fix bugs (Firebase Crashlytics)
• To understand how features are used so we can improve them (Firebase Analytics)
• To show limited banner, interstitial, and app open ads in a moderated way (Google Mobile Ads)

We do not sell your data. We do not share your personal reflections, mood entries, or journal content with advertisers.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), our legal bases for processing your personal data are:

• Performance of a contract — to provide the app's core features and to deliver and restore any in-app purchase you make.
• Legal obligation — to keep purchase and transaction records where tax and accounting law requires it.
• Legitimate interests — to improve stability and features via anonymised analytics and crash reports.
• Consent — for optional analytics, crash reporting, and personalised advertising, which you can accept or decline via the in-app consent dialog on first launch. You can manage your preference at any time in Settings.

5. Third-Party Services

Mindleau uses the following third-party services. Each has its own privacy policy.

• Firebase Analytics (Google) — anonymised usage data to understand feature engagement. Google may process data in the US.
• Firebase Crashlytics (Google) — crash reports and device diagnostics to improve stability.
• Cloud Firestore (Google) — cloud backup and synchronization of your journal entries, mood check-ins, session progress, and preferences. Data is encrypted in transit and at rest.
• RevenueCat — processes the optional Remove Ads purchase: it validates store receipts, records whether you own the purchase, and lets you restore it. RevenueCat receives your Mindleau user ID (an anonymous identifier from Firebase Authentication), the display name you entered in the app, your purchase and transaction history, and basic device and app information such as platform, app version, and IP address. It does not receive your journal entries or mood data. See RevenueCat's privacy policy.
• Apple App Store and Google Play — handle payment for in-app purchases under their own terms and privacy policies. We receive confirmation of the purchase, not your payment details.
• Google Mobile Ads / AdMob (Google) — limited advertising, frequency capping, fraud prevention, and ad measurement. Google may process advertising identifiers, device information, and ad interactions according to its own policies.

We only share the minimum data necessary for these services to function. Journal text, mood tags, focus tags, and reflection history are not shared with advertising partners.

6. Advertising

Mindleau may show moderate ads to keep the app free. Ads are intentionally limited: a small banner may appear near the bottom navigation, interstitial ads are capped and only considered after completed actions, and app open ads are capped and never shown on first launch. Ads should not interrupt writing, onboarding, or core reflection moments.

You can remove all ads with the optional, one-time Remove Ads purchase in Settings. Once you own it, Mindleau stops loading ads and does not start the Google Mobile Ads SDK when the app opens, so no new advertising requests are made from the app.

Google may use advertising identifiers and similar technologies to deliver and measure ads. Depending on your region and device settings, you may be able to reset your advertising ID, limit ad personalisation, or manage consent through your operating system or Google's controls.

7. Data Storage and Security

• Journal entries and reflections are stored locally on your device first, in the app's private storage, so the app works offline.
• After you finish onboarding, the app creates an anonymous account for you and backs up your data to Cloud Firestore in the background over an encrypted (TLS) connection. Linking an email address lets you restore that backup on another device.
• We implement industry-standard security measures including TLS encryption in transit.
• Access to backend systems is restricted to authorised personnel only.

8. Data Retention

We retain your data for as long as you maintain an account with us. If you delete your account, all associated data is permanently removed within 30 days. Anonymised analytics data may be retained in aggregate form longer for product improvement purposes.

Purchase and transaction records are kept by RevenueCat, Apple, and Google for as long as needed to let you restore your purchase and to meet tax, accounting, and fraud-prevention obligations. These records may be kept after you delete your Mindleau account.

9. Your Rights and Choices

Depending on your location, you may have the right to:

• Access a copy of your personal data
• Correct inaccurate data
• Delete your account and all associated data
• Export your data in a portable format
• Withdraw consent at any time without affecting previous processing
• Object to or restrict certain processing

To exercise any right, email us at contactus@aishayy.com or use the account settings inside the app.

10. Account Deletion

You can delete your account and all associated data at any time:

• In the app: Settings → Delete Account
• Or email contactus@aishayy.com with the subject line "Delete My Account"

Upon deletion, all journal entries, mood data, session progress, and personal information are permanently and irreversibly removed.

Deleting your account also removes your display name from RevenueCat and disconnects your Mindleau user ID from future purchases. It does not cancel or refund a Remove Ads purchase, because that purchase belongs to your App Store or Google Play account. You can bring it back at any time with Settings → Restore Purchases.

11. Children's Privacy

Mindleau is not directed at children under the age of 13. We do not knowingly collect personal information from anyone under 13. If you believe we have inadvertently collected data from a child under 13, please contact us immediately at contactus@aishayy.com and we will delete it promptly.

12. Health Disclaimer

Mindleau is a personal wellness and mindfulness tool. It is not a medical device, clinical service, or substitute for professional mental health treatment. The app does not provide diagnosis, therapy, or medical advice. If you are experiencing a mental health crisis, please contact a qualified healthcare professional or emergency services.

13. International Users

Mindleau is operated globally. If you are located outside the country where our servers are based, your data may be transferred internationally. We ensure such transfers comply with applicable data protection laws through appropriate safeguards (e.g., Standard Contractual Clauses).

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, for material changes, notify you within the app or by email. Continued use of Mindleau after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

• Email: contactus@aishayy.com
• Response time: within 2 business days