Privacy Policy

1. What we collect

• Account details: name, email address, password (handled securely by Supabase Auth — we never see your raw password)
• Content you enter: tasks, brain dumps, memories, habits, notes, and preferences (like your mood check-ins or ADHD profile)
• Money tools data: any figures you manually enter into the Money Co-Pilot or Impulse Buy Pause (we never access your bank account)
• Together data: if you set it up, a display name, username, and avatar; who you're connected with; messages you send in Focus Rooms, buddy chat, or circles; your broad session preferences (goal, duration, focus style); and any reports or blocks you file. If you enable notifications, we store a device subscription token so we can send them — no message content is ever included in a push notification itself.
• Billing information: handled entirely by Stripe — we never see or store your card details, only your subscription status
• Basic usage data: which features you use and how often, to enforce free-plan limits and improve the app

2. Why we collect it

We use your data to: provide the Service you've signed up for (storing your tasks, running AI features, managing your subscription); keep your account secure; and understand basic patterns in your own usage to show you insights within the app. We don't use your personal content for advertising, and we don't sell your data to anyone.

3. Who we share it with

We use a small number of trusted service providers to run Mind+Do. Each only receives what it needs to do its job:

• Supabase — hosts our database and handles authentication
• Stripe — processes payments; handles your card details directly, we never see them
• Anthropic (Claude AI) — processes the text you submit to AI features (Brain Dump, Break It Down, Day Builder, Rescue My Day, Communication Assistant, "I'm Stuck") in order to generate a response. This text is sent for processing but is not used by Anthropic to train their models under their API terms.
• Vercel — hosts the application itself
• If you enable Together push notifications, your browser's push service (e.g. Google, Mozilla, or Apple, depending on your browser) relays the notification to your device — this is a standard part of how web push works everywhere, and we send only a generic title/body, never message or task content.

Some of these providers may process data on servers outside the UK/EEA (for example, in the US). Where this happens, they do so under standard contractual safeguards recognised by UK data protection law.

4. Together — what other users can see

Together is the only part of Mind+Do where other users can see any of your information. A buddy or session partner can see your display name, avatar, and — only for a session you're both in — your broad goal (e.g. "study") and whatever you type in chat or a check-in. They never see your exact task, brain dumps, notes, or any other private content. If you file a report, the person you reported is never told who reported them. Blocking someone immediately stops them matching, messaging, or being matched with you again.

5. How long we keep it

We keep your data for as long as your account is active. If you delete your account, we delete your personal data from our systems, other than what we're legally required to keep (for example, billing records for tax purposes).

6. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete your data ("right to be forgotten")
• Ask us to export your data in a portable format
• Object to certain uses of your data
• Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you think we've mishandled your data

To exercise any of these, contact us via the details on your account or billing receipts.

7. Security

Your data is protected by Row Level Security in our database, meaning no user can ever access another user's data, even at the database level. Connections to Mind+Do are encrypted. No system is 100% secure, but we take reasonable, industry-standard steps to protect your information.

8. Cookies

We use strictly necessary cookies to keep you logged in securely. We don't currently use advertising or tracking cookies. We use privacy-friendly analytics (Vercel Analytics) that count page visits without cookies or personal profiles. If that changes, we'll update this policy and ask for your consent where required.

9. Children

Mind+Do is not intended for anyone under 16, and we don't knowingly collect data from children. Together specifically requires you to confirm you are 18 or over, since it involves contact with other users.

10. Changes to this policy

We may update this policy from time to time. If we make significant changes, we'll let you know in the app.

11. Contact

Questions about this policy or your data? Reach out via the contact details on your account or billing receipts.