MindFriend MindFriend ← Back to Home

Privacy Policy

Effective Date: January 14, 2026 Last Updated: January 14, 2026

Plain-language note: MindFriend is a mental health and wellness app. We may process information that can be sensitive (like mood check-ins and what you write in chats). We designed this policy to be readable while staying legally accurate.

Not medical care / not emergency services: MindFriend provides wellness tools and supportive features. It does not provide medical diagnosis or treatment and is not intended for emergencies. If you are in immediate danger, contact local emergency services.

Contents

1. Introduction

This Privacy Policy describes how we collect, use, disclose, and protect information when you use:

This policy applies globally. Additional region-specific terms (e.g., GDPR for the EEA/UK, CCPA/CPRA for California) are included where relevant.

Who we are (roles under privacy laws)

HIPAA notice

MindFriend is a consumer wellness app. We are not a "covered entity" or "business associate" under HIPAA in typical consumer use. Therefore, information you provide in MindFriend is generally not "PHI" regulated by HIPAA.

2. Information We Collect

We collect information in the following categories. Some of this data may be considered sensitive under certain laws (e.g., "special category" under GDPR or "sensitive personal information" under CPRA).

2.1 Account and profile information

2.2 Wellness and mental health-related information (sensitive)

You may provide information that relates to your mental health and wellbeing, including:

Important: You control what you choose to share. Please avoid entering information you do not want processed (e.g., highly sensitive identifiers).

2.3 Social and community information (Circles)

If you use friend Circles:

2.4 Purchases and subscriptions

Payment information: Purchases are processed by Apple (App Store). We do not receive your full payment card details.

2.5 Usage and analytics data

2.6 Device and technical information

2.7 Customer support communications

If you contact support, we may collect:

2.8 Information we do not intentionally collect

We do not intentionally request:

3. How We Collect Information

We collect information through:

3.1 Information you provide directly

3.2 Automatically collected information

3.3 Information from third parties

4. How We Use Your Information

We use personal information for the following purposes:

4.1 Provide and operate the Services

4.2 Personalization and improvement

4.3 Safety and integrity

4.4 Communications

4.5 Legal and compliance

4.6 Research and analytics (de-identified/aggregated where possible)

If you are in the European Economic Area (EEA), United Kingdom, or a jurisdiction requiring legal bases, we rely on:

5.1 Contract (Article 6(1)(b))

Processing necessary to provide the Services you request, such as:

5.2 Consent (Article 6(1)(a); special category: Article 9(2)(a))

We rely on your consent for:

You may withdraw consent at any time (see Section 9). Withdrawal does not affect processing before withdrawal.

5.3 Legitimate interests (Article 6(1)(f))

We may process data to:

When we rely on legitimate interests, we balance them against your rights and expectations.

5.4 Legal obligations (Article 6(1)(c))

We process data as required to comply with laws and regulatory requests.

6. Data Sharing and Disclosure

We do not sell your personal information. We share data only as described below.

6.1 With your Circles (social sharing you control)

If you join a Circle, information you post (e.g., mood emoji, check-in text) is visible to other Circle members. Please share thoughtfully. Circle content is intended to be private to that Circle, but we cannot fully control what other members do with what you share.

6.2 With service providers (processors)

We use vendors to help operate the Services:

Provider Purpose
Supabase, Inc. Database hosting, user authentication, Edge Functions (backend logic)
xAI AI chat processing — your messages to the AI companion are sent to xAI to generate responses
Apple (APNs) Push notification delivery

We require service providers to:

6.3 With Apple (payments)

Subscriptions and in-app purchases are processed by Apple. Apple provides us limited transaction verification and subscription status information needed to grant entitlements.

6.4 Legal requirements and protection

We may disclose information if we believe in good faith that disclosure is necessary to:

6.5 Business transfers

If we undergo a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, user information may be transferred as part of that transaction. We will provide notice and choices where required by law.

6.6 De-identified and aggregated information

We may share aggregated or de-identified data that cannot reasonably identify you, for example for analytics, research, or reporting.

7. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

7.1 Retention periods

Data Type Retention Period
Account data (profile, settings) While your account is active
Mood entries, quests, exercises, chats While your account is active (unless you delete specific items)
Circle posts While your account is active or until deleted
Security logs and events 90 days
Subscription and accounting records 7 years (legal/tax compliance)
Encrypted backups 30 days after deletion

7.2 Deletion

You can request deletion of your account and associated data (see Section 9). Deletion generally:

8. Data Security

We implement administrative, technical, and physical safeguards designed to protect your information, including:

No system can be guaranteed 100% secure. You are responsible for keeping your device and account credentials secure.

9. Your Rights

Depending on where you live, you may have rights regarding your personal information.

9.1 Global rights (all users)

9.2 GDPR/UK GDPR rights (EEA/UK users)

You may also have:

9.3 California privacy rights (CCPA/CPRA)

If you are a California resident, you may have the right to:

Do Not Sell/Share: We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

9.4 How to submit requests

We will respond within the timeframes required by applicable law.

10. Children's Privacy

MindFriend is not intended for children under 13. We do not knowingly collect personal information from children under 13.

If you are between 13 and the age of majority in your jurisdiction, you should use MindFriend only with appropriate parental permission where required.

11. International Data Transfers

MindFriend may process and store information in countries other than your own, including the United States and other locations where our service providers operate.

When required by law, we use appropriate safeguards for cross-border transfers, such as:

Contact support@mindfriend.app for more information about transfer safeguards.

12. Cookies and Tracking Technologies

MindFriend is a mobile app. We do not use cookies, but we may use similar technologies:

Your choices

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the App and/or other appropriate means.

14. Contact Information

If you have questions, concerns, or requests related to privacy or this policy, contact:

Email: support@mindfriend.app

Appendix: California "Notice at Collection" Summary (CPRA)

Categories collected:

Purposes:

Retention: See Section 7
Sale/Sharing: We do not sell personal information; we do not share for cross-context behavioral advertising.