Your privacy, plainly

MindNest (“MindNest”, “we”, “us”) provides the MindNest wellness app and website at https://www.mindnesthq.site. We are the data controller for the personal data described in this policy.

For anything privacy-related, including exercising your rights, contact us at privacy@mindnesthq.site. If we appoint a Data Protection Officer or an EU/UK representative, their details will be listed here.

Information you give us

• Account details: your email address, first name and password (stored only as a salted bcrypt hash).
• Onboarding and preferences: the areas you want to focus on, theme, voice and notification choices, and anything you add to your profile, such as medication reminders, a sobriety start date or nicknames for people in your life.
• Conversations: the messages you send to Lumina and the replies it gives, organised by space (therapy, mindfulness, grief and so on).
• Wellbeing logs: mood check-ins, sleep, water, meals, movement, weight, journal and gratitude entries, dreams, grief reflections, cravings and sobriety check-ins, and session ratings.
• Relationship notes: encrypted on your device before they are sent. We store only the encrypted text and cannot read it.
• Support requests: your email, subject and message when you contact us through the support form.
• Waitlist: your email, the plan you are interested in and your country code.
• Cycle and activity (optional): period days, flow, symptoms and mood you log in Cycle; daily step counts, active minutes, a posture score and the walks, runs, treks and hikes you save. Raw motion-sensor and mouse data stays on your device; only these daily totals are saved.
• Reminders: the habit and medication reminders you create (name, times, days and any dosage note).
• Provider applications: if you apply at /providers as a professional, the details on the form, including your licence number and contact details. Only approved profiles are shown, and never your email, phone, address or licence number.
• Connected music (optional): if you connect Spotify, an encrypted access token, your Spotify display name and whether your account is Premium. We read what’s playing while a music player is on screen, and, to show them in Settings, your playlists, your last 20 played songs and your Liked Songs. We don’t store any of these, and we never change your library.

Information collected automatically

• Usage records: when you were last active, how many messages you sent today, streaks, coins and milestones.
• Time zone: sent by your browser so streaks and daily resets follow your local day.
• IP address: used briefly to work out your country (to show local prices and the right crisis lines) and to rate-limit requests. We do not store your IP address in our database.
• Server logs: standard technical logs (request time, route, status code) kept for security and reliability.

Special category (health) data

Much of what you share in MindNest, such as mood, sleep, weight, substance use and what you tell Lumina, is health data, which data protection law treats as especially sensitive. We process it only because you explicitly choose to give it to us to use these features, and only to provide them to you.

• We do not sell or rent your personal data, and we do not “share” it for cross-context behavioural advertising.
• We do not show advertising, and we do not use third-party analytics, ad pixels or tracking cookies.
• We do not use your conversations or wellbeing data to train our own or anyone else’s AI models.
• We do not make decisions with legal or similarly significant effects about you based solely on automated processing.

Lumina is powered by a large language model from OpenAI. When you chat, request an insight or use voice mode, the relevant messages and a short summary of context (such as your first name, focus areas and today’s mood) are sent to OpenAI over an encrypted connection to generate the reply or the spoken audio.

Under OpenAI’s API terms, data sent through the API is not used to train their models by default, and may be retained by OpenAI for a limited period for abuse and misuse monitoring. AI replies can be wrong or incomplete: see our Safety page.

Every message is also checked automatically for signs that you might be at risk. If it is, Lumina responds with extra care and the app shows crisis lines. A crisis flag is stored with the message. We do not contact anyone on your behalf.

We share personal data only with service providers that help us run MindNest, under contracts that limit their use of it:

• OpenAI: AI replies, insights, letters and text-to-speech.
• Hosting and database providers: to store and serve the app.
• ip-api.com: receives your IP address to return your country (for prices and crisis lines). The result is cached briefly; we keep only the country.
• Freesound.org: if you play community lo-fi music, the audio streams from Freesound, which can see your IP address like any website.
• Spotify (only if you connect it): to show and control what’s playing, list your playlists, recently played songs and Liked Songs in Settings, and play what you choose. Cover art loads from Spotify’s servers. You can disconnect in Settings, or remove MindNest under Apps in your Spotify account. Spotify’s own privacy policy covers your Spotify account.
• Apple (Apple Music), coming soon and only if you connect it: the same role as Spotify, under Apple’s privacy policy.
• Resend: to deliver account, support and (if you keep them on) update and weekly-letter emails.
• Google Maps (only when you search in Find Care): your location, or the place you type, is sent to Google to find hospitals, clinics, therapists and pharmacies near you. The map loads from Google only after you choose to search. MindNest doesn't store your location. Google's privacy policy applies to that search.
• Payment provider (when paid plans launch): to process payments. We will never see or store your full card number.

We may also disclose data if required by law, to protect someone’s life or safety, or as part of a merger or acquisition (in which case this policy will continue to apply to your data).

Our providers, including OpenAI, may process data in the United States and other countries. Where data protection law requires it, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent mechanisms under Nigeria’s Data Protection Act 2023.

• Account, chats and logs: for as long as your account exists. You can delete individual entries, clear chats, or delete your account at any time.
• When you delete your account: your account and all associated chats, logs and preferences are deleted from our live database immediately. Copies in encrypted backups are overwritten within 30 days.
• Support tickets: up to 24 months after they are resolved, so we can follow up and spot recurring problems.
• Waitlist: until paid plans launch and we have contacted you, or until you ask us to remove you.
• Rate-limit counters: a few minutes. Server logs: up to 30 days.

Depending on where you live (for example under the GDPR, UK GDPR, Nigeria Data Protection Act 2023 or California law), you have the right to:

• Access the personal data we hold about you and get a copy of it.
• Correct data that is inaccurate.
• Delete your data (“right to be forgotten”). You can do this yourself in Settings → Privacy & data.
• Port your data to another service in a machine-readable format.
• Object to or restrict certain processing.
• Withdraw consent at any time, without affecting processing that happened before.
• Know, and opt out of, any sale or sharing of personal information. We do neither.
• Not be discriminated against for exercising any of these rights.

To make a request, email privacy@mindnesthq.site from the address on your account. We will respond within one month (45 days for California requests), and may need to verify your identity first. You also have the right to complain to your local data protection authority, such as the Nigeria Data Protection Commission, the UK ICO, or your EU supervisory authority.

We protect your data with encryption in transit (HTTPS), hashed passwords, access controls, rate limiting and on-device encryption for relationship notes. No system is perfectly secure, but we work hard to protect yours. Read more on our Security page. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

MindNest does not use advertising or analytics cookies. We use your browser’s local storage only for things the app needs to work, such as keeping you signed in and remembering your theme and sound settings. See our Cookies & storage page for the full list.

MindNest is for adults aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a minor has created an account, contact us and we will delete it.

We will update this page when our practices change and revise the date at the top. If a change is significant, we will tell you by email or in the app before it takes effect.