Privacy

Who runs MindIn

MindIn is run by MindIn Technology Ltd, a company registered in England and Wales (company number 17520222). Our registered office is at 66 Paul Street, London, EC2A 4NA. MindIn Technology Ltd is the data controller for information collected through the app and this website. Questions about privacy can be sent to contactys@mindin.co.uk.

What the app collects

To save entries and see your history, you create an account. MindIn then holds:

• Account details: your email address and password. The password is handled by the sign-in service and is never visible to MindIn.
• Entries: the words you write, the emotion you confirm, and the date and time, linked to your account.

The AI's list of suggested emotions and any distress flag are not saved to your account.

A few things stay only in your browser on your device: your sign-in session, an unsent draft, your settings, a record of when a support message was shown (never what you wrote), and counts used for wellbeing suggestions. Signing out clears the sign-in session and unsent draft. Settings, wellbeing records and support-message records stay in the browser until browser data is cleared.

How app data is used, and why

Account details and entries are used only to:

• keep your history, so it is available on any device once you sign in
• suggest an emotion for each entry, and check for signs of distress so a support message can be shown
• send account emails, such as confirming your address or resetting your password
• keep the service working and secure, respond to your requests, and meet legal duties

The distress check may not detect every sign that someone needs support. Full checks only run on entries submitted after signing in, and may not run if there is a technical problem.

Entries are never sold, never used for advertising, and never used to build a profile for marketing. The app and this website use no analytics or advertising trackers.

Our lawful basis

We use account details and entries to provide the service you sign up for (UK GDPR Article 6(1)(b)). We use limited account and technical information to keep MindIn secure, because we have a legitimate interest in protecting the service and the people who use it (Article 6(1)(f)). We may also use information where the law requires it (Article 6(1)(c)).

Entries may reveal information about your health or other sensitive matters. We process this information only with your explicit consent, given when you create your account (Article 9(2)(a)). You can withdraw consent by asking us to delete your account and entries at contactys@mindin.co.uk. This does not affect processing that happened before you withdrew it.

Who handles app data

MindIn uses three services, each acting as a data processor on MindIn's behalf:

• Supabase stores accounts and entries, and sends account emails.
• Anthropic receives the text of an entry, through a MindIn server function, to suggest an emotion and check for signs of distress, then returns the result.
• Vercel hosts the app and the server function that passes entries to Anthropic.

The server function runs in London, and the Supabase database is hosted in Ireland. Anthropic may process entry text outside the UK, including in the US. Some other information may also be processed outside the UK, including in the US. Where this happens, MindIn relies on the safeguards in each provider's data processing agreement. Contact contactys@mindin.co.uk to request a copy of these safeguards.

Under Anthropic's commercial terms, entries are not used to train its AI models. Anthropic automatically deletes entries and results within 30 days, unless it needs to keep them longer to enforce its Usage Policy or comply with the law.

How entries are protected

Entries travel over encrypted connections, and each account can access only its own entries through the app. MindIn has technical access to the database where entries are stored. We don't read entries as part of running the service. MindIn only accesses an entry if needed to fix a technical or security problem, respond to a request about an account or meet a legal duty.

How long app data is kept

Accounts and entries are kept while the account is open, until deletion is requested or an unused account is deleted after 24 months, following an email warning. To delete your account and all its entries, email contactys@mindin.co.uk, as there is no delete option in the app yet. We will complete your request within 30 days.

What the waiting list collects, and why

The waiting list form asks for your email address. It is used only to send updates about the MindIn beta and launch. The lawful basis is consent, given by ticking the box on the form (UK GDPR Article 6(1)(a)). You can withdraw consent at any time by replying to any email or contacting contactys@mindin.co.uk.

Who handles the waiting list form

Form submissions are received through GoDaddy, which provides MindIn's website form service, and are delivered to MindIn's Microsoft 365 email inbox, which is provided through GoDaddy. Waiting list updates are sent from that email account. Some information may be processed outside the UK, including in the United States. Where this happens, MindIn relies on the safeguards in each provider's terms.

How long waiting list details are kept

Details are kept until you unsubscribe, or for 12 months after public launch, whichever comes first. They are then deleted. If you unsubscribe, we may keep your email address on a suppression list only to make sure we do not contact you again.

Rights over this information

Anyone with a MindIn account or on the waiting list can ask MindIn to:

• give them a copy of the information held about them, including their entries
• correct inaccurate information
• delete their information, including their account
• restrict how their information is used
• stop using information we process on the basis of legitimate interests
• provide their information in a portable format

Some rights depend on the lawful basis and the circumstances. Consent can be withdrawn at any time by unsubscribing or by emailing contactys@mindin.co.uk. Requests can be sent to the same address and will be answered within one month. Deletion requests are completed within 30 days. Backup copies may take longer to expire.

Complaints

If you are unhappy with how we have handled your information, please contact contactys@mindin.co.uk. We will acknowledge your complaint, look into it and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk (opens in a new tab).

Cookies and tracking

Neither the app nor this website uses tracking or analytics cookies. The share buttons use your device's share menu or copy a link, and no social media scripts are loaded. The app keeps your sign-in session and the items listed above in your browser's storage, only so it works. This website loads fonts from Google Fonts, so your browser connects to Google, which receives your IP address.

About this policy

MindIn is intended for people aged 18 and over who live in the UK.