Privacy Policy

1. What we collect

• Account information — your name, email address, and password (stored securely with industry-standard hashing).
• Study content — documents, pasted text, and video transcripts you upload, plus the chunks, quizzes, scores, and reports we generate from them.
• Payment information — handled entirely by Dodo Payments. We never see or store your card number.
• Technical data — basic usage logs (pages visited, error events) used to keep the service running and secure.

2. How we use it

We use your information to: provide and improve the service (including AI chunking, quiz generation, and grading); manage your subscription; respond to support requests; and send service notices (e.g., billing or policy changes). We do not sell your personal data and we do not show you ads.

3. Legal bases

Where the GDPR applies, we process your data on the basis of contract performance (providing the service you asked for), legitimate interests (security and service improvement), and your consent where required.

4. Who we share data with

• Supabase — database, authentication, and file storage for your account and content.
• Vercel — hosting and serving the application.
• Dodo Payments — payment processing and subscription management.
• AI providers — your study content is sent to AI services (currently DeepSeek) to generate chunks, quizzes, and grading. It is used only to fulfill your request.
• Google — if you sign in with Google, we receive the profile information you authorize.

5. Retention & security

We keep your data while your account is active. When you delete your account, your sessions, uploads, and Beans are permanently removed. We use encryption in transit (HTTPS), role-based access control on stored data, and restrict administrative access to the minimum needed to operate the service.

6. Your rights

You may request access to, correction of, or deletion of your personal data at any time by contacting us. You may also export your study material (your Beans contain your original content and history) before deletion. We respond to data-rights requests within 30 days.

7. Children's privacy

The service is not directed at children under 13 and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.

8. Changes

We may update this policy as the service evolves. Material changes will be announced in the app or by email. See also our Cookie Policy.

9. Contact

Privacy questions or requests: mindfold.app@gmail.com.