1. Introduction and scope
MindFit is a cognitive training application that provides structured exercises, progress tracking, personalized difficulty, daily training, statistics, and subscription-based access. This Privacy Policy applies to information handled through the MindFit mobile application and the MindFit backend services that support it.
MindFit is a cognitive training product. It is not a medical device, diagnostic service, health-care provider, or treatment service. Exercise results and cognitive skill scores are training data, not medical or health records, and should not be interpreted as a diagnosis.
2. Information we collect
Account and authentication information
The current MindFit app offers Sign in with Apple and Google Sign-In. We process a provider-specific user identifier and an email address when supplied and verified by the provider. Apple may provide a private relay email address instead of your personal email.
User identifiers and profile information
We assign a MindFit public account identifier and maintain internal database identifiers that are not exposed through the public application interface. Profile setup collects your display name, preferred app language, and automatically detected time zone. Time zone is used for account preferences and training behavior; MindFit does not collect precise GPS location.
Device and notification identifiers
If Firebase Messaging is available on your device, MindFit may receive and store a Firebase Cloud Messaging registration token and the device platform so notifications can be delivered. A current token may be associated with your authenticated MindFit account. We also store your daily-reminder preference. The app subscribes eligible installations to a general service-notification topic independently of the daily-reminder preference; daily reminder topic membership follows that account preference.
Training and performance data
We process data necessary to operate and personalize training, including assigned exercises, puzzle families and versions, difficulty, answers submitted, correctness, mistakes, completion state, active-solving time, expected time, performance scores, experience points, levels, streaks, skill ratings, uncertainty and sample counts, daily-session history, adaptive-difficulty state, and policy/version snapshots needed for reproducibility and consistency.
Private puzzle solutions and validation data are retained on the backend and are not intended to be exposed to the app. Timing is based on server-observed activity signals and is used as training telemetry; it is not a medical measurement.
Usage and product interaction data
MindFit necessarily receives authenticated API requests and product interactions such as beginning, pausing, resuming, answering, and completing training. These interactions are used for app functionality and product personalization, including progress summaries, scoring, and adaptive difficulty. They are not currently collected through a general-purpose product analytics service. The current mobile application does not include Firebase Analytics, and the current backend does not expose an active general-purpose analytics event collection endpoint.
Subscription and purchase information
For Apple auto-renewable subscriptions, MindFit processes verified App Store transaction and subscription information such as product identity, transaction references, environment, subscription status, expiration, renewal or revocation facts, and an account-binding identifier. This information is used to validate access and prevent a subscription or original transaction from being transferred between MindFit accounts.
MindFit does not collect or store payment-card or bank-account details. Apple processes App Store payments under its own terms and privacy practices.
3. How we use information
We use the information described above to:
- create, authenticate, secure, and maintain your account and sessions;
- provide exercises, validate answers, record progress, calculate scores and XP, and maintain streaks;
- select exercise families and adjust difficulty to your current training performance;
- show your historical dashboard, skills, statistics, and eligible rankings;
- verify subscription entitlement and enforce purchase ownership;
- deliver general service notifications and optional daily reminders;
- operate, troubleshoot, and protect MindFit; and
- comply with applicable legal obligations and prevent misuse.
Adaptive training and personalization
Training data is linked to your MindFit account because ongoing progress and personalized difficulty require continuity across sessions. The adaptive system uses factors such as correctness, mistakes, timing quality, prior same-skill attempts, and current difficulty to select an appropriate next difficulty. It evaluates training performance only; it does not diagnose health or medical conditions.
4. Analytics, linked data, and tracking
Account, device-notification, purchase, and training information is linked to your MindFit account when necessary to provide app functionality and personalized training. Training and product-interaction information is used to generate your statistics and operate adaptive training; it is not currently used by a general-purpose analytics system to measure an audience or product performance.
The production app uses Firebase Core to initialize configured Firebase services and Firebase Cloud Messaging for notifications. It does not currently integrate Firebase Analytics, Firebase Crashlytics, or Firebase Performance Monitoring. MindFit does not use personal information for cross-app tracking, third-party advertising, or data-broker sharing.
MindFit does not sell personal information and does not display third-party advertising.
5. Third-party services
Sign in with Apple
If you choose Sign in with Apple, Apple authenticates you and provides MindFit with a verified identity token containing a provider identifier and, when available, an email address. Apple may also provide your name during the first authorization when you choose to share it; MindFit can use that name to initialize your display name. MindFit uses a nonce to protect this sign-in flow. Apple handles information under its own privacy practices.
Google Sign-In
If you choose Google Sign-In, Google authenticates you and provides MindFit with a verified identity token containing a provider identifier and, when available, an email address. The backend verifies the token's signature, issuer, intended audience, authorized presenter, validity period, and subject. Google handles information under its own privacy practices.
Firebase Cloud Messaging
MindFit uses Firebase Cloud Messaging, a Google service, to obtain notification registration tokens, manage notification topics, and deliver push notifications. Notification permission is controlled through your operating-system settings. If you disable notification permission at the operating-system level, visible notifications may not be delivered even if a backend reminder preference remains associated with your account.
Apple App Store and StoreKit
MindFit uses Apple's StoreKit and App Store services to offer and restore subscriptions. Apple handles payment processing. MindFit verifies signed transaction information and App Store Server Notifications to determine entitlement, lifecycle state, and account ownership.
These providers may process information on their systems under their own terms and privacy policies. MindFit does not control their independent processing.
6. Data storage and retention
MindFit account and training records are stored in the custom MindFit backend. Authentication secrets are protected using hashing or encryption appropriate to their purpose: only hashes of MindFit bearer tokens are persisted, while raw bearer tokens are stored locally by the app using secure device storage. Subscription evidence that must be rechecked may be stored in protected form on the backend.
We retain account-associated information while your account is active and for as long as reasonably needed to provide training history, preserve transaction and scoring integrity, verify entitlements, protect the service, and meet applicable legal obligations. Different records may have different retention needs. Expired sessions and recovery tokens may be retained temporarily for security and operational cleanup; purchase and transaction records may need longer retention.
The app may store limited local preferences, such as onboarding completion, language choice, and other interface state. The language selected on this page is stored in your browser's local storage only.
7. Account deletion and its consequences
You can permanently delete your MindFit account from Profile. After explicit confirmation, MindFit deletes the account and associated profile, authentication identities and sessions, notification device data, training assignments and attempts, progress, skills, XP, daily history, and subscription entitlement records. The app also clears the local session and account-specific cached state.
To prevent a deleted App Store transaction from being claimed by another MindFit account, we retain a minimal non-personal purchase-ownership record containing the provider and a transaction reference or protected token hash. We also retain a short-lived hashed deletion-request receipt for safe retry handling. Store notification replay-protection records and information required by law or to protect transaction integrity may be retained where necessary.
For Sign in with Apple accounts, MindFit revokes the Apple authorization credential during deletion when a revocable credential was captured. A legacy account without such a credential is still deleted immediately and the app explains how to stop using Sign in with Apple from Apple Account settings.
8. Your choices and privacy rights
Depending on your jurisdiction, you may have rights concerning access, correction, deletion, restriction, objection, or portability of personal information. The app allows you to view core account information, update supported profile fields, choose the app language, change the daily-reminder preference, and permanently delete your account. Operating-system settings control notification permission, and App Store settings control your subscription.
9. Security and international processing
MindFit uses technical and organizational safeguards appropriate to the service, including encrypted network transport, parameterized database operations, server-side validation, hashed authentication tokens, revocable sessions, provider signature verification, subscription ownership controls, and restricted exposure of internal identifiers and private puzzle state. No system can guarantee absolute security.
MindFit and its service providers may process information in countries or regions other than where you live. Those locations may have different data-protection laws. Where applicable, information is handled using protections required by relevant law and by the contractual and technical controls of the services involved.
10. Children's privacy
MindFit is not directed to children under 13, or a higher minimum age where required by local law, and we do not knowingly collect personal information from children below the applicable minimum age. The app does not currently include a child-account or parental-consent workflow.
11. Changes to this Privacy Policy
We may update this Privacy Policy when MindFit's features, data practices, service providers, or legal obligations change. The effective date at the top of this page identifies the current version. Material changes should be presented through an appropriate in-app or service notice where required.