Privacy Policy

Last updated: November 4, 2026 · Effective: November 4, 2026

This Privacy Policy explains what personal data MindDoor Network ("MindDoor", "we", "us") collects when you use the MindDoor app and minddoor.network (the "Service"), why we use it, who we share it with, how long we keep it and what rights you have. It should be read together with our Terms of Service.

1. Who is responsible for your data

The controller of your personal data is MindDoor Network, an independent developer. You can reach us, including on any data-protection question, at [email protected] (subject "Privacy").

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) where it applies to you, and other applicable privacy laws, including those of US states such as California.

2. Data we collect

2.1 Data you give us

2.2 Data created by the Service

• Analysis of thoughts: detected language, an emotion label (one of seven), writing style, moderation results and flags, and a mathematical representation of the meaning of the text (an "embedding").
• Matching and rooms: which rooms you were matched into, room themes, participation and counters such as resonances.
• Insights: your aura colour and the monthly emotion statistics shown in the Soul Diagram and Soul Card.
• Limits and safety: posting counters, rate limits, cooldowns, warnings and enforcement history.
• Support: how many reactions of each kind your thoughts received, your lifetime number of reactions received, and how many reaction notifications we sent you today (to send at most two a day and never at night we use your device's time-zone offset).

2.3 Technical data

• IP address, device model, operating system, app version, language settings and time zone;
• authentication and session tokens, and, if you allow notifications, a push-notification token;
• server and security logs (for example times of requests and errors) kept by us and our hosting providers.

We do not collect your contacts, your photos or files, your precise GPS location, your microphone audio, advertising identifiers or your browsing activity in other apps.

3. Sensitive information in your thoughts

What you write can reveal "special categories" of personal data, for example information about your physical or mental health, your sex life or sexual orientation, or your religious, philosophical or political beliefs. MindDoor does not ask you for this information, and we recommend that you never include details that could identify you or anyone else.

When you create an account you give your explicit consent to MindDoor processing any such information contained in your thoughts and messages, for the sole purpose of providing the Service as described in this policy (moderation, emotion labels, matching, rooms and your insights). We never use it for advertising, we never sell it and we never use it to profile you for any other purpose. You can withdraw your consent at any time by deleting the relevant thoughts in My Thoughts, or by deleting your account; the Service cannot work without processing the text you write.

4. How we use your data

• To provide the Service: create and secure your account, show your thoughts, form Mind Rooms, deliver messages, run Mind Friends and groups, generate your aura, Soul Diagram and Soul Card, and remember your settings.
• Safety and moderation: detect and remove prohibited content, show support resources when a thought may describe a crisis, enforce limits, investigate reports, prevent spam, fraud and abuse, and protect children.
• Premium: verify purchases with Google or Apple, unlock Premium features and handle renewals, cancellations and refunds.
• Communication: send verification and password-reset codes, important service and security notices, changes to our terms, replies to your requests and, if you enable them, push notifications.
• Improving the Service: monitor performance and errors and understand how features are used, using aggregated or technical data.
• Legal: comply with legal obligations, respond to lawful requests, and establish, exercise or defend legal claims.

We do not sell personal data, rent it, use it for targeted advertising, or use your thoughts and messages to train AI models.

5. Legal bases

Where the GDPR or a similar data protection law applies, we rely on:

6. Automated processing and AI

When you post a thought, its text is sent to our AI provider (OpenAI, see Section 8) to check it for harmful content, detect its language, assign an emotion label and writing style, and create an embedding used to find similar thoughts. AI is also used to write short room themes. Language detection may also run on your device.

• Under our provider's API terms, data sent through the API is not used to train its models. The provider may keep it for up to 30 days to detect abuse, and then deletes it unless the law requires otherwise.
• Automated results can be wrong. They decide whether a thought is accepted, how it is labelled and who it is matched with, but they do not make decisions that produce legal effects for you. You can ask for a human review of any decision about your account at [email protected].
• Embeddings are deleted automatically after 8 days.

7. What other users can see

• Your public profile: username, avatar, aura colour, country/region and counters such as your number of thoughts and support received. Users you have blocked cannot see it.
• Public thoughts: shown in the Global or Regional feed for up to 24 hours together with your username and avatar. Other users can save a copy; copies are removed when you delete the thought or your account.
• Private thoughts are not shown to other users, but they are used to match you into rooms, where the matched thought is shown to the other participants.
• Mind Rooms: participants see your username, avatar, the matched thought and your messages in that room.
• Messages and groups: visible to the people in that conversation or group.
• Reactions: everyone can see how many reactions of each kind a public thought has. Nobody, including the author of the thought, can see who reacted.

Anything you share with other users can be copied or screenshotted by them. We cannot control what they do with it.

8. Who we share data with

We share personal data only as described here. Our service providers process data on our instructions, under contracts that require them to protect it.

We may also disclose data:

• to authorities when required by law, a court order or a valid legal process, or when we believe in good faith that disclosure is necessary to prevent death, serious harm, fraud or other illegal activity, or to protect the safety of a child;
• to report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) and/or competent law-enforcement authorities;
• to protect our rights, including enforcing our Terms and defending legal claims;
• in a business transfer, such as a merger, acquisition, sale of assets or transfer of the Service to a company we set up. The recipient must respect this policy, and we will tell you beforehand;
• with your consent or at your direction, for example when you share a Soul Card to another app.

9. International transfers

Our providers may process data in the European Union, the United States and other countries. When personal data is transferred to a country that is not recognised as providing an adequate level of protection, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework, together with additional measures where needed. You can ask us for more information about these safeguards.

10. How long we keep data

11. Security

• All data is encrypted in transit (TLS). Our database and storage providers encrypt data at rest.
• Passwords are stored only as secure hashes. Access to data in the database is restricted by row-level security rules, so each user can read only what they are allowed to see.
• Administrative keys are kept on the server side. Access to personal data is limited to authorised people who need it for moderation, support or maintenance.
• If a personal-data breach is likely to put your rights at risk, we will notify you and the competent authority as required by law.

No online service is completely secure. Please use a strong, unique password and never share it. Messages are not end-to-end encrypted, so do not use MindDoor to share passwords, financial details or other highly confidential information.

12. Your rights

Depending on where you live, you have the right to:

• access your personal data and get a copy of it;
• correct inaccurate data (most of your profile can be edited in the app);
• delete your data, including your whole account directly in the app (see our Delete Account page);
• restrict or object to certain processing, including processing based on legitimate interests;
• data portability: receive the data you gave us in a structured, machine-readable format;
• withdraw consent at any time, without affecting processing that happened before;
• not be subject to a decision based solely on automated processing that significantly affects you, and to ask for human review;
• lodge a complaint with a supervisory authority (Section 18).

To exercise your rights, email [email protected] with the subject "Data request" from the email address of your account. We may ask you to verify your identity. We reply within one month (extendable by two months for complex requests, as the law allows) and free of charge, unless a request is manifestly unfounded or excessive.

13. Additional information for US residents

Residents of California and other US states with privacy laws have the right to know what personal information we collect, use and disclose; to delete and correct it; to obtain a copy; and not to be discriminated against for exercising these rights. You can use these rights as described in Section 12, or through an authorised agent with your written permission.

• Categories we collect: identifiers (email, username, device and account IDs, IP address); commercial information (subscription status); internet or electronic activity (use of the Service, logs); approximate location (country/region you choose, IP address); inferences (emotion labels, aura, insights); and sensitive personal information (contents of your messages, and health or other sensitive information you choose to write).
• Sources: you, your device, the app stores and our own analysis as described above. Purposes: those in Section 4. Recipients: those in Section 8.
• We do not sell personal information and do not share it for cross-context behavioural advertising. We use sensitive personal information only to provide the Service as permitted by law. We do not knowingly collect information from anyone under 18.
• We do not respond to "Do Not Track" signals because we do not track you across other websites or apps.

14. Children

MindDoor is only for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18, and there is no parental-consent option. If we learn that an account belongs to a person under 18, we delete it and its data. If you believe a minor is using MindDoor, please report them in the app or email [email protected] with the subject "Underage user". See also our Child Safety Standards.

15. Cookies, local storage and tracking

• App: the app stores your login session securely on your device, together with settings such as language and cached data, so it works quickly. It contains no advertising or analytics SDKs and no cross-app tracking.
• Website: minddoor.network does not use advertising or analytics cookies. Our hosting provider may set strictly necessary security cookies. Fonts are loaded from Google Fonts, which receives your IP address when the page loads.

16. Device permissions

• Microphone and speech recognition (optional): used only while you dictate a thought. Your device's speech service (Google on Android, Apple on iOS) converts your voice to text under its own privacy terms. We receive only the text and never record or store audio.
• Notifications (optional): to tell you about rooms, friend requests and messages. You can turn them off at any time in your device settings.
• Photos / gallery (optional): used only to save a Soul Card image when you choose to. We do not read your photos.

17. Changes to this policy

We may update this policy when the Service or the law changes. The date at the top shows the latest version. If a change is material, we will inform you in the app or by email at least 30 days before it applies, and ask for your consent again where the law requires it.

18. Contact and complaints

If you are not satisfied with our answer, you can complain to a supervisory authority. If you live in the EU or EEA, you can complain to the data protection authority of your country, place of work or where an alleged infringement took place. We would appreciate the chance to resolve your concern first.