Mindum

Privacy Policy

Last updated: 14 October 2026

Who is responsible

Mindum, 122 rue Amelot, 75011 Paris, France (SIREN 998 927 552, RCS Paris). Contact: contact@mindum.app. Full company details are in the Legal notice.

What stays on your phone

Check-ins (energy, focus, mood, feelings, body signals, what’s draining, context), notes, your name, tool feedback and settings are stored only on your phone, in an encrypted database. They are not sent to Mindum.

What is processed

• On this website: pages are served by Cloudflare, which sees technical data such as the IP address when a page is requested. Mindum does not use this data to identify visitors.
• Analytics: only if you allow it, see Analytics and cookies.
• Waiting list: only if you join it, see Waiting list.
• Account: your email address, to sign you in with a link and to send messages about your account. Stored with Supabase in the European Union.
• Sign-in emails: sent through an email service provider acting on our behalf.
• Encrypted backup (when available): a copy of your entries, encrypted on your phone before it leaves it. We can’t read it.
• Anonymous usage data in the app (only if you switch it on): which screens are used, without knowing who you are. Never what you write or how you feel.
• Anonymous crash reports in the app (only if you switch them on): technical details when the app stops working.
• Purchases: subscriptions are handled by the App Store or Google Play. We receive whether a subscription is active, not your payment details.
• AI features (Mindum Plus, when available): only with your separate consent. Only what each request needs is sent, it isn’t stored by Mindum, and it isn’t used to train AI models.

Analytics and cookies

Mindum uses Google Analytics 4 to see which articles are read. It is used only after a clear yes in the banner. Until then, no cookie is set and nothing is sent to Google.

If analytics are allowed, Google Analytics sets cookies on your device (named _ga and _ga_ followed by an identifier) and receives data about your visit: the pages viewed, the time, the type of device and browser, the approximate location, and a random identifier stored in the cookie. Page titles are replaced by a generic label and only the page path is sent. Google signals, advertising features and personalised ads are switched off, and Mindum does not combine this data with anything else. The cookies last 13 months at most, and Google keeps the data for at most 14 months.

The legal basis is your consent (GDPR Art. 6(1)(a) and Art. 82 of the French Data Protection Act). Saying no has no effect on reading the site. The choice is stored on your device, in the browser’s local storage, with its date. The banner appears again after about 6 months or when something changes. You can change your choice at any time with “Privacy choices” at the bottom of every page. Withdrawing consent removes the analytics cookies and stops the measurement. It does not affect what happened before.

Google acts for Mindum under Google’s data processing terms. The data may be processed in the United States by Google LLC, which takes part in the EU-US Data Privacy Framework. Google’s standard contractual clauses apply as a back-up.

Waiting list

If you join the waiting list on mindum.app, Mindum keeps your email address, the language of the page and the date and time you joined. The only use is to send you one email when the app is ready. The legal basis is your consent (Art. 6(1)(a)), given by adding your address and pressing “Join the waiting list”. Joining is optional, and the rest of the site does not depend on it.

The address is stored with Supabase in the European Union. The launch email is sent through Resend, an email service acting on Mindum’s behalf, which may process the address in the United States under standard contractual clauses. The address is deleted once the launch email has been sent, or when you ask, and in any case 24 months after joining if no email has been sent.

The launch email contains a link to remove the address. Before that email, you can be removed by writing to contact@mindum.app. Removing yourself does not affect what happened before. If someone else’s address was entered by mistake, a message to the same address deletes it.

Recipients and processors

• Supabase: database and sign-in (European Union).
• Resend: emails, such as sign-in links and the waiting list message.
• Cloudflare: serving the website and its domain (a United States company).
• Google: Google Analytics, only if you allow it.
• Apple and Google Play: app subscriptions.

Each acts on Mindum’s instructions under a data processing agreement. Nothing is sold and nothing is used for advertising.

Transfers outside the European Union

Some of these providers are United States companies or use United States locations: Google (only if you allow analytics), Resend, Cloudflare, and the support staff of Supabase. Transfers rely on the European Commission’s adequacy decision for companies in the EU-US Data Privacy Framework, or on standard contractual clauses where the provider is not certified. A copy of the safeguards can be requested at contact@mindum.app.

Legal bases

Running your account and subscription: contract (GDPR Art. 6(1)(b)). Website analytics, the waiting list, anonymous usage data in the app, crash reports and AI features: your consent (Art. 6(1)(a) and, where relevant, Art. 9(2)(a)), which you can withdraw at any time.

How long

• Analytics cookies: 13 months at most. Data in Google Analytics: at most 14 months. Your analytics choice on your device: about 6 months, then the banner asks again.
• Waiting list: until the launch email is sent, or until you ask, or 24 months after joining, whichever comes first.
• Account data: kept while your account exists and erased when it’s deleted. Entries on your phone are erased with “Delete all my data” or by removing the app.

Your rights

You can ask for access, a copy, correction or deletion of your data, limit its use or object to it, and withdraw your consent at any time, by writing to contact@mindum.app. Replies come within one month. In the app, “Export my data” and “Delete all my data” are in Profile and settings. You can also complain to the CNIL (cnil.fr, 3 Place de Fontenoy, 75007 Paris) or to another data protection authority. Questions go to the same address: Mindum has no data protection officer.

Age

Mindum is for people 18 and older.

Not a medical service

Mindum is a self-awareness tool. It doesn’t diagnose, treat, or replace professional or emergency help.

Changes

If this policy changes in an important way, the app will say so before the change applies.