MindThis Privacy Policy explains how Mind handles information when you use the Mind app, website, and related services. Mind is designed for personal reflection and emotional support, so the information you choose to share may be especially sensitive. Please read this policy before entering personal or health-related information.
1. Who operates Mind
Mind is operated by Cognitic s.r.o., with its registered office at Pernerova 697/35, Karlín, 186 00 Praha, Czech Republic, company ID (IČO) 09117741 and VAT ID (DIČ) CZ09117741. Cognitic s.r.o. is registered in the Commercial Register maintained by the Municipal Court in Prague under file number C 331203.
Cognitic s.r.o. is the controller of the personal data described in this policy. You can contact us at hello@cognitic.ai.
2. Information we process
Depending on the features you use, Mind may process:
- Account and profile information: your account identifier, name, email address, authentication provider, age or birthdate, pronouns, language, timezone, preferred voice, and profile settings.
- Conversation and wellbeing information: text you type, voice audio while it is being processed, transcripts, uploaded images, session topics, feedback, mood or onboarding answers, memories, summaries, notes, insights, action steps, and questions generated from your sessions.
- Purchase information: subscription status, product, purchase and renewal events, and identifiers used to connect an App Store purchase with your Mind account. Apple processes your payment details; Mind does not receive your full card details.
- Device and technical information: app version, device and operating-system information, IP address, language, crash or error data, notification tokens, permission status, and security logs.
- Usage and attribution information: screens and features used, session counts and duration, broad interaction events, paywall activity, campaign or install attribution, and advertising identifiers when you allow tracking through Apple's App Tracking Transparency prompt.
- Communications with us: messages and information you send when requesting support, providing feedback, or exercising a privacy right.
Information in a conversation may reveal health, mental-health, sexual-orientation, religious, political, relationship, or other special-category information. You decide what to share, and you should not share information about another person unless you have the right to do so.
3. How we use information
We use information to:
- create and secure your account;
- provide text and voice conversations and generate responses;
- save ordinary chat history, memories, and session summaries so the app can provide continuity and personalization;
- generate session artwork from an abstract visual prompt;
- manage subscriptions and feature limits;
- deliver notifications you request;
- monitor response quality, safety signals, failures, abuse, and service reliability;
- understand product usage and improve Mind; and
- comply with law, enforce our terms, and protect users, Cognitic s.r.o., and others.
We do not sell personal data. We do not send conversation text, therapy notes, memories, or uploaded images to Meta or Mixpanel for advertising or general product analytics. We do send conversation transcripts to Raindrop for the monitoring described below.
4. Legal bases
Where the General Data Protection Regulation (GDPR) or similar law applies, we rely on one or more of these legal bases:
- Contract: processing needed to create your account, provide requested app features, and manage your subscription.
- Consent: processing special-category information you choose to provide and optional tracking or device permissions where consent is required. You may withdraw consent, but this does not affect processing that was lawful before withdrawal.
- Legitimate interests: securing, operating, diagnosing, and improving Mind, provided those interests are not overridden by your rights—especially given the sensitive nature of this service.
- Legal obligation or legal claims: processing needed to comply with law or establish, exercise, or defend legal claims.
Some features cannot work without processing the content you submit. If you withdraw consent for processing sensitive conversation content, stop using those features and contact us so we can apply your request.
5. AI processing and monitoring
Mind is an AI service, not a human therapist. To respond, conversation content is sent to an AI model provider. Text conversations are sent as text. During voice conversations, microphone audio is streamed to the selected voice model provider and the resulting transcript may be saved as part of ordinary chat history.
For ordinary, non-incognito conversations, Mind also sends the user message or voice transcript and Mind's response to Raindrop AI for production monitoring. The monitoring record includes a stable Mind account identifier, conversation identifier, model, text or voice modality, tool and safety signals, and usage information. Raindrop therefore receives and stores conversation content, including content that may be sensitive or may itself contain a name, email address, or other identifier you entered. We use this information to find unsafe, incorrect, or failed responses and improve reliability. The current Mind backend does not separately attach profile name or email fields to these monitoring records.
Incognito conversation content is excluded from Mind's Firestore chat history and from Raindrop monitoring. It remains in memory while the live request or connection is handled and is sent to the AI provider because that processing is necessary to answer. A minimal incognito chat record may remain without the conversation content so the current app can operate the session.
6. Service providers and recipients
We disclose information only as needed for the purposes above. Current provider categories include:
| Provider | Purpose | Information involved |
|---|---|---|
| Cloudflare | Network, API, website, and live-session infrastructure | Requests, IP and technical metadata; transient live-session data |
| Google Firebase and Google Cloud | Authentication, database, file storage, and push notifications | Account, profile, chat history, memories, session records, files, tokens, and technical data |
| OpenAI and xAI | AI text or voice responses, summaries, and memories | Prompts, conversation text, voice audio or transcripts, and relevant context |
| Raindrop AI | AI response monitoring and safety/reliability analysis | Ordinary conversation inputs and outputs, pseudonymous identifiers, model, modality, tools, signals, and usage |
| Replicate | Session cover generation | An abstract image prompt derived from a session's mood and the generated image |
| Mixpanel | Product analytics | Pseudonymous account identifier, app/device information, subscription state, and non-content usage events |
| RevenueCat and Apple | Subscriptions, purchase validation, and attribution | Account or app-user identifier, subscription and purchase data, and device attribution identifiers |
| Meta | Install and campaign attribution | App activity and attribution identifiers; advertising identifier only when permitted by your device setting |
| Apple and Google | Sign-in and platform services | Authentication and platform account information you choose to provide |
Providers may process limited information as independent controllers where their own terms and law require it, for example Apple for App Store purchases. We may also disclose information when required by law, to protect rights and safety, in a corporate transaction, or when you direct us to do so.
7. Storage and retention
Ordinary chat messages, transcripts, derived memories, and session records are stored in Google Firebase so you can access history and receive personalized continuity. Mind's Cloudflare Durable Object does not keep a second transcript or voice-event archive; live event data is held in memory for the connection and then discarded.
Cognitic s.r.o. does not intentionally store raw microphone audio in Firestore or Durable Object storage. AI voice providers still receive audio and may retain or log it under the settings, contract, and retention rules applicable to our account.
We keep account and core app content while your account is active or until it is no longer needed for the purposes in this policy. We retain security, monitoring, analytics, support, and transaction records only for as long as reasonably necessary for their purpose, contractual retention settings, dispute resolution, or legal obligations. Provider and backup deletion may take additional time. We may retain information that must be kept by law and may retain aggregated or de-identified information that can no longer reasonably identify you.
8. Account deletion and privacy requests
You can start deletion from the app's privacy settings or email hello@cognitic.ai. After recent reauthentication, the in-app flow places the account into an erasure state, stops active first-party content processing, and starts a durable deletion job for the user's Firestore document tree, user-linked feedback, and files under that user's Firebase Storage path before the authentication account is deleted. The job runs in bounded, retryable batches and may finish after the app has signed you out. We retain a minimal erasure record outside the deleted user tree to prevent delayed or retried writes from recreating the account. The in-app flow does not, by itself, guarantee immediate deletion of records already held by every processor, including Raindrop monitoring traces, subscription records, analytics events, legal records, or provider backups.
To request access, correction, deletion, restriction, portability, withdrawal of consent, or an objection to processing—including deletion of processor-side monitoring records—email hello@cognitic.ai. We may need to verify your identity. Your rights depend on where you live and may be limited where law requires or permits continued retention.
You may lodge a complaint with your local data-protection authority. In the Czech Republic, the supervisory authority is:
Úřad pro ochranu osobních údajů
- Pplk. Sochora 27
- 170 00 Praha 7, Czech Republic
- Email: posta@uoou.gov.cz
- Web: uoou.gov.cz
9. International transfers
Some providers process information outside the Czech Republic or European Economic Area. Where required, we use an approved transfer mechanism, such as an adequacy decision or standard contractual clauses, and apply additional safeguards appropriate to the information and risk.
10. Security
We use technical and organizational measures designed to protect information, including encryption in transit, access controls, authenticated APIs, and encryption at rest provided by our infrastructure providers. No system is completely secure, and we cannot promise absolute security.
11. Device permissions and tracking choices
You can change microphone, notification, and tracking permissions in iOS settings. Denying a permission may disable the related feature. Apple's App Tracking Transparency choice controls access to the advertising identifier; it does not turn off processing that is necessary to operate the app or all first-party product analytics.
12. Children
Mind is not intended for children under 13. If local law requires parental authorization above that age, a parent or legal guardian must provide it. In the Czech Republic, a child generally has capacity to consent to an online service's personal-data processing from age 15. If you believe a child has used Mind without valid authorization, contact us.
13. Changes to this policy
We may update this policy when the product, providers, or law changes. We will post the updated version here, change the date above, and provide additional notice when required.
14. Contact
Questions and privacy requests can be sent to hello@cognitic.ai.