Privacy Policy

Last updated: 2026-10-03

Who we are

MindRise is operated by Blackforge AS, Norwegian organisation number 937 768 532, at Fjogstadvegen 32, 4350 Kleppe, Norway. Blackforge AS is the controller of the personal data described here. Contact [email protected] for privacy requests. This policy covers the web edition and explains differences for earlier native installations.

Accounts and saved data

Web accounts use a verified email address and managed authentication through Supabase. Authentication information, sessions and security events are processed by Supabase; authentication and password recovery messages are delivered through our Zoho Mail sender. MindRise maps your authenticated identity to your application account. We do not store your plaintext password.

When you save or sync content while signed in, our application service on Railway stores account settings, journals, intentions, future-self entries, conversation history, favorites and playlist information. Private recordings use private object storage on Cloudflare and authorized access URLs. Browser storage provides a local cache. Guests' unsynced local data may be lost when browser data is cleared.

Earlier native Friends accounts use a random device key. Linking an existing account requires proof of that key and authentication of the new account. Knowing an email address does not prove ownership of an older device account.

Friends

Friends is optional and for adults aged 18 and over. We store your profile, connections, messages, voice notes, posts, reactions, check-ins and moderation records. Shared content is visible to its intended recipients. Reported content may be reviewed by moderators. Blocking, reporting, content filtering and account restrictions support community safety.

Ara and AI processing

When you request a signed-in Ara response, the text or audio and context needed for that response are sent through Cloudflare to OpenAI. When OpenAI rejects a text request because its credit is exhausted, configured text fallback may send the same requested context to Google Gemini. Signed-in Gemini fallback is restricted to adult accounts and a project using Paid Services; it does not replace OpenAI transcription or voice. This can include saved context you choose to use and conversation lines when you request a reply suggestion. Voice conversations involve audio processing by the AI provider. Ara is not medical care or therapy.

Guest Ara text chat is separately available to adults aged 18 and over who explicitly confirm their age before sending a prompt. This is self-attestation, not verified identity or a verified adult account. Your submitted prompt is sent through Cloudflare to Google Gemini using Paid Services with a fixed instruction. Each request is independent: no account data, saved journal or earlier conversation is sent. MindRise does not save guest prompts or responses in its application database or create a guest conversation history. Replies remain in the current screen until you leave it; provider processing is separate from this local display. Do not include information you do not want processed by the AI provider.

To limit abuse and spending, MindRise stores pseudonymous network counters derived with an HMAC from the trusted network address. IPv6 addresses are grouped by their /64 prefix; users sharing a network may share an allowance. These counters contain no plaintext address, prompt or reply. On each successful guest admission, we delete counters whose UTC calendar date is earlier than the UTC date eight days before that admission. This uses calendar dates rather than an exact elapsed-time limit; counters remain longer when the service is idle. Aggregate usage and shared spending totals also enforce the service budget. Essential processing for responding to your request and protecting the service is separate from optional marketing tracking.

Authenticated usage counters and voice-session allocations are stored to enforce allowances and prevent abuse. These counters do not need the contents of your journal. Conversation history you elect to save is account data. The proxy should not log raw conversations or recordings. OpenAI processes requests under its API data controls and retention policies; see https://openai.com/policies/privacy-policy. Google processes configured signed-in fallback and guest requests under its Gemini API Paid Services terms and data processing addendum. Those terms describe limited safety-related retention and state that paid-service prompts and responses are not used to improve Google products: https://ai.google.dev/gemini-api/terms.

Billing and partner referrals

When Stripe billing is activated, Stripe provides web checkout, subscription collection, invoices and the customer billing portal. MindRise stores partner contact profiles, accepted terms, preferences, campaigns, attribution and commission/payout records. Pending campaigns do not track referrals, and unavailable financial data is not presented as measured earnings. We receive opaque customer/subscription identifiers, billing status and verified payment/refund information. Payment card information is handled by Stripe. MindRise records payout preparation and confirmation; preparation alone does not send money. Existing Lemon Squeezy records, if any, remain subject to their original provider relationship.

A partner referral can be attributed using first-party links and a signed, expiring token. Optional tracking requires consent. An anonymous visitor identifier is hashed on the server for click deduplication; no customer email or wellness content is placed in the token. The initial attribution window is 30 days; renewals can remain attributed to the verified subscription. Partners receive their own aggregate campaign and financial information. They do not receive buyer emails, journals, recordings, Ara conversations or private social content.

Earlier Apple or Google purchases remain governed by the original billing provider and RevenueCat. Switching to the web does not by itself cancel an existing store subscription.

Permissions and local storage

Microphone permission is requested when you choose recording or voice features. Notifications require permission and supported browser installation. iPhone notifications require the app on the home screen. Web reminders are best effort and depend on connectivity and device settings.

Guest web reminders do not require a MindRise account. To deliver a guest reminder, we store a hash of a random installation capability, the browser push subscription endpoint and public keys, time zone, reminder title and type, schedule, language, enabled state, timestamps, and delivery occurrence records. A delivery occurrence records its status, attempt count, short-lived random claim token, and retry lease. Failed pending retries expire after 24 hours; sent and cancelled occurrence records used to prevent duplicate delivery expire after eight days. Guest delivery records are not linked to an account or email while they remain guest registrations. When you choose to move reminders to your signed-in account, we keep a transfer receipt for up to eight days containing the capability hash, account identifier, and a hash of the push endpoint so a retry can safely confirm the completed transfer. The receipt does not contain the raw capability or endpoint. After a successful move, the guest registration and guest delivery rows are removed. Relevant delivery state—status, local due date, attempt count, and retry timing—may be copied to account-owned delivery records to avoid losing or duplicating a reminder. Pending records follow the 24-hour retention; sent and cancelled records follow the eight-day retention above. We remove a registration when you revoke it. Otherwise, it expires after 90 days without a valid notification update or successful push-provider acceptance. To limit abuse, the application derives a keyed, process-local HMAC bucket from the request's network address. The limiter keeps only bounded, keyed buckets in memory; expired idle buckets are evicted during later limiter activity, and this state resets when the process restarts. It does not retain raw addresses in its own state or application database. Hosting and network providers may separately process connection data under their operational logging policies. Your browser's push service routes notifications to your device. Reminder titles may appear on your lock screen, so avoid sensitive wording. Notifications are best effort and are not a guaranteed alarm.

Essential browser storage supports sign-in, settings and permitted offline content. Account-specific caches are cleared on sign-out. Deleting browser data does not cancel subscriptions or remove server data. You can disable notifications and microphone access in browser or phone settings.

Why we process information

We process data to provide the service you request and fulfill our agreement with you, administer subscriptions, deliver security and recovery messages, keep the service safe, resolve support requests and comply with legal obligations. Optional referral tracking relies on consent where required. Necessary fraud prevention, moderation and technical diagnostics rely on legitimate interests with appropriate safeguards.

We do not sell private wellness data, make journals available to partners or use your private content to target advertising.

Service providers and international processing

The configured Supabase identity project uses the EU Frankfurt region. Private Cloudflare recording and backup buckets use the EU jurisdiction. Some providers and their subprocessors process information internationally. Applicable transfer safeguards, including Standard Contractual Clauses where required, must be in place.

Retention and backups

Account content remains until you remove it or delete the account, subject to necessary moderation or legal records. Private recordings follow the account's deletion process. Encrypted backups are retained on a rolling seven-day schedule; deleted content ages out of backups within that period. A restored backup must reapply account deletion records before returning to service.

We retain a minimal encrypted deletion ledger for as long as a restorable backup could contain the deleted account. It contains the identifiers and cleanup references needed to prevent deleted data from returning, not the journal or conversation content itself.

Billing providers retain records required for payments, disputes, fraud prevention and accounting. Those obligations can prevent deletion of some transaction records. Support correspondence is retained only as needed to resolve the request and satisfy applicable obligations. Technical reports must avoid private content and be retained only as long as necessary for reliability and security.

Export, deletion and subscription cancellation

Use Account to export saved data, manage billing or request account deletion. Deletion must remove or de-identify private content, remove social access and recordings, and revoke the managed identity. If provider cancellation or deletion is temporarily unavailable, the request must remain visibly incomplete and retryable; it must not be presented as successful.

Cancel a web subscription through Account's billing portal. Older store subscriptions must be cancelled with Apple or Google. Do not rely on uninstalling, clearing browser storage or removing the home-screen icon to stop billing.

Your rights

Depending on your location, you can request access, correction, deletion, restriction, portability or object to processing. You may withdraw consent to optional tracking. Norwegian and EEA users can complain to their data protection authority, including Datatilsynet in Norway. Contact [email protected]; we respond within applicable legal deadlines.

Age and security

Guest wellness content is for people aged 13 and over; users under 18 need any parental permission required by law. MindRise web accounts, Friends, guest Ara AI chat and the partner program require adults aged 18 and over. Guest Ara requires an explicit age confirmation without creating an account. We use encrypted connections, authenticated access and private storage controls. No online service can promise absolute security.

Material changes to this policy will be communicated in the app or through the contact information on your account.