Your privacy and safety of your data is important to us. This Privacy Policy document describes types of information that is or may be collected, used or shared by MINDSYNC.APP when you visit, use or make a purchases.If you have any additional questions or require more information about our Privacy Policy or about how we handle user data and personal information, or wish to withdraw your consent for the continued collection, use or disclosure of your Personal Information, please feel free to contact us, to withdraw your Cookie Consent,
Your privacy and the security of your data are paramount at MindSync (operated by MindSync, Gdańsk, Pomorskie, "We", "Us", "Our"). This Privacy Policy details how we collect, use, store, and protect your information when you use our mobile app ("App"), website ("Website"), and related services (collectively "Services").
Personal Information: We collect personal data you voluntarily provide, such as your name, email address, and contact information during registration, subscriptions, support interactions, or other communications.
User-Generated Content: MindSync collects journal entries, notes, and voice inputs you voluntarily share, which may include sensitive mental health information. This content is processed automatically by AI to provide insights such as emotional pattern detection, sentiment analysis, and behavioral summaries. We will implement explicit consent collection during onboarding for processing this sensitive data in the future.
Log Data and Cookies: We automatically collect data such as IP addresses, browser type, device type, operating system, timestamps, referring URLs, and interactions on our platforms for analytics and improvement purposes. We use cookies managed by a cookie consent management platform, allowing users to review and customize cookie settings at any time.
We process your personal and sensitive data to:
- Provide and improve our services and AI-driven insights.
- Handle subscriptions, user account management, and support.
- Send promotional and marketing communications (with explicit double opt-in consent).
- Legal bases include explicit consent, contract fulfillment, and our legitimate interests (service enhancement and security).
We may share your data with trusted third-party providers for service functionality:
- AI Analysis: OpenAI (Privacy Policy: https://openai.com/policies/privacy-policy)
- Cloud Storage: Microsoft Azure (EU and US data centers)
- Payment & Subscription Handling: Google Play and Apple App Store (We do not store payment card data)
- Marketing & Communication: GetResponse (https://www.getresponse.com/legal/privacy)
- Analytics: Google Analytics (https://policies.google.com/privacy)
- International data transfers follow GDPR standards and safeguards, including Standard Contractual Clauses.
We implement robust security measures, including encryption (AES-256) of data at rest, secure data backups, controlled access, and regular reviews of security practices to protect against unauthorized access, alteration, disclosure, or destruction.
You have explicit rights concerning your data:
Access: Request access to your stored personal data.
Rectification: Correct inaccurate or incomplete information.
Portability: Download your data directly from the App.Deletion: Request deletion of your personal data by contacting us via email.
Withdrawal of Consent: You may withdraw your consent for processing at any time.Requests can be made through our support email provided below.
Subscriptions are handled exclusively by Google Play and Apple App Store, including auto-renewal features. We do not directly process or store payment information.
We only send promotional emails after obtaining explicit double opt-in consent. You can opt-out at any time by clicking the unsubscribe link in any promotional email.
Personal data is retained for the duration of your active account plus a reasonable period (up to 1 year) following account inactivity or deletion requests to fulfill legal obligations or resolve disputes.
Support communications via email are stored securely and used solely to address your inquiries. We do not use this information for other purposes.
In case of a data breach, we will notify affected users and relevant authorities within 72 hours of becoming aware of the breach in compliance with GDPR regulations.
Our services are exclusively for users aged 18 and above. By using MindSync, you represent that you meet this age requirement.
We currently do not respond differently when your browser sends a "Do Not Track" signal.
In the event of an acquisition, merger, or bankruptcy, personal data may be transferred or acquired by third parties. Any acquiring entity must adhere strictly to the privacy commitments outlined in this policy or provide equivalent privacy protections. Users will be notified of any such change.
MindSync’s AI-driven analysis does not currently involve making significant automated decisions (e.g., decisions impacting employment, financial status, or legal rights). We provide insights purely for informational and supportive purposes.
We may update this Privacy Policy periodically. Users will be informed of significant changes via email or within the App.
For questions, concerns, or to exercise your data rights, please contact us:
MindSync Team
E-mail: support@mindsync.app
California residents have additional privacy rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt-out of data sales. MindSync does not sell user data.
By using MindSync services, you consent to this Privacy Policy and agree to its terms.
Last updated: July 25, 2026
The short version: MindSync is a private space for your therapy. Your journal, notes, recordings, and mood data belong to you. We store them encrypted, we do not read them, and we never sell them or use them for advertising. We use AI (OpenAI) to turn your entries into insights, because that is what the app is for. You can export or delete everything inside the app, at any time.
MindSync is operated by ToTalkTo Dariusz Wiśniewski, registered in Gdańsk, Poland (NIP: 5922231851, REGON: 363389287). Under EU data protection law (GDPR), this is the "data controller" of your personal data. For anything privacy related, write to hello@mindsync.app.
Account data: your name or a pseudonym, your email address, and a password when you create an account.
Your therapy content: everything you put into MindSync so it can work for you. That means journal entries and notes, voice notes, recordings of therapy sessions, conversations with Reflect (our AI), mood and symptom check-ins, therapy goals and session dates, homework, and check-ins about your relationship with your therapist. This is sensitive wellbeing data, and we treat it with more care than anything else we hold. Voice notes and session recordings are transcribed, and the audio file is deleted once the transcript exists.
Usage data: how the app and the website are used. Device type, operating system, app version, screens visited, features used, crash reports, your IP address, and the rough city-level location it points to. We do not read your precise GPS location, your contacts, or your photos.
Support data: emails and messages you send us.
Website signups: if you leave your email on our website, for example to download a guide, we store it to send you what you asked for and, if you agreed to it, occasional emails about MindSync.
We never sell your personal data. We never use your therapy content for marketing or advertising. There are no ads in MindSync.
MindSync is built around AI. To create transcripts and insights, your entries travel to OpenAI in the United States through its business API: text, voice audio for transcription, mood scores, and the context needed to make sense of them. Our agreement with OpenAI means your data is not used to train its models, and audio is deleted after transcription. AI insights exist to support your own reflection. They are not medical advice, and MindSync makes no automated decisions about you that would have legal or similarly serious effects.
A short list of providers keeps MindSync running. Each one is bound by a data processing agreement and only does its own job:
Beyond that, your data leaves MindSync in three cases: you share it yourself (for example, you send a weekly summary to your therapist, and you decide what goes in it), the law requires it, or MindSync changes owners, in which case this policy still applies and we will tell you.
Therapists have no access to your data in MindSync. Sharing always starts with you. Participants in our pilot program receive separate information and give separate consent.
Your data sits on cloud servers run by Heroku, a Salesforce company. Some of our providers are American companies (OpenAI, Google, Salesforce, Loops), so some processing happens in the United States. Every transfer outside the EU is covered by EU-approved safeguards: the EU-US Data Privacy Framework and Standard Contractual Clauses.
Your data is encrypted in transit (TLS) and at rest (AES-256). Entries stay encrypted in storage and are decrypted only to show them to you and to run the analysis you asked for. We do not read your entries. Access to production systems is restricted and logged. No system is perfectly secure, though. If a breach ever affects you, we will notify you and the supervisory authority within 72 hours, as GDPR requires.
Your account and content stay as long as your account exists. When you delete your account in Settings, your personal data is permanently erased within 30 days, backups included. If you want a copy, export it first; that also works inside the app. Support emails are kept for up to 2 years. Billing records stay as long as tax law says they must.
You can access your data, take a copy with you, correct it, delete it, restrict or object to processing, and withdraw any consent. Withdrawing consent for AI analysis has a real consequence: MindSync loses the ability to produce your insights. If that happens, we will explain your options, including deleting your account.
To use any of these rights, use the tools in the app or email hello@mindsync.app. We answer within 30 days and never charge for it. We may ask you to confirm your identity first, so nobody else can pretend to be you. If you are in the UK, the same rights apply under UK data protection law.
If you think we handled something badly, you can complain to a data protection authority. In Poland that is the President of the Personal Data Protection Office (UODO, uodo.gov.pl); in other countries, your local authority.
Privacy laws in California, Colorado, Connecticut, Texas, Virginia, Oregon, Montana, and a growing number of other states give you rights to know, access, correct, delete, and receive a portable copy of your personal information, and to opt out of "sales", "sharing", and targeted advertising.
We do not sell personal information. The only "sharing" we do happens through advertising cookies on our website (Google, Meta). You can opt out through your cookie settings or by browsing with Global Privacy Control turned on; we honor that signal. Data from the app itself is never used for advertising.
Your journal and check-ins count as "consumer health data" under laws such as Washington's My Health My Data Act. We process this data only with your consent and only to provide MindSync. You can withdraw that consent and have the data deleted whenever you choose.
Exercising these rights will never cost you features, prices, or service quality. Email hello@mindsync.app; an authorized agent may act for you, and we may verify your identity before acting. If we deny a request, reply to our decision to appeal. If the appeal fails, your state Attorney General can hear the complaint.
The app contains no advertising trackers. The website (mindsync.app) uses three kinds of cookies. Essential cookies keep the site working. Analytics tools (PostHog on EU servers, Contentsquare, and Google) show us how the site is used. Advertising tags from Google Ads and Meta measure our campaigns and may share website visit data with those platforms.
Where consent is required, non-essential cookies wait until you agree. You can change your choice at any time in the cookie settings on the site or in your browser, and Global Privacy Control works as an opt-out of advertising sharing.
Your entries and recordings sometimes involve other people, most often your therapist. You are responsible for making sure you may record or describe them, and we process that information only as part of your content, under your instructions.
MindSync is for people aged 16 and older. We do not knowingly collect data from anyone younger. If we learn that we have, we delete it.
When something significant changes, we tell you in the app or by email before it takes effect. The date at the top always shows the current version.
ToTalkTo Dariusz Wiśniewski (MindSync), Gdańsk, Poland
NIP: 5922231851, REGON: 363389287
hello@mindsync.app