Your mind, your data.

What we collect — and what we don’t

We collect only what the app needs to work. MindPillars, 179 Runda Drive, Nairobi, Kenya, is the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR) and equivalent laws.

What we collect

• Account data — your name, email address and password (stored only as a secure hash), plus a profile photo if you choose to add one.
• Wellbeing data — what you choose to record: mood check-ins, journal entries, recovery tracking, your onboarding wellbeing check-in, and meditation or breathing activity.
• Therapy requests — if you request a session: the topic you select, your preferred times and any note you write.
• Purchase data — if you subscribe to Premium: an anonymous app user ID, your subscription status and store receipt data, processed by our subscription provider.
• Technical data — the minimum needed to run a secure service, such as authentication tokens and server logs. Server logs are kept briefly for security, then deleted.

What we don’t

• No advertising, no third-party analytics, and no tracking across other apps or websites.
• No precise location, contacts or browsing history.
• No card or mobile-money details — subscriptions are paid through Google Play or Apple’s App Store, and therapy sessions through Paystack.
• No selling your data, ever, and no sharing it with advertisers or data brokers.

Your wellbeing data needs your consent

Moods, journal entries, recovery progress and therapy topics are health-related data — special-category data under Article 9 GDPR. We process them only with your explicit consent, which you give by choosing to record them in the app. You can withdraw that consent at any time by deleting individual entries or your whole account, or by emailing us.

Your journal is private to you. Our team does not read your entries.

The app isn’t intended for anyone under 16. If you believe a child has created an account, contact us and we’ll delete it.

Security

Here’s how your data is protected, in plain words.

• Encrypted in transit. All data travels encrypted with TLS.
• Encrypted at rest. Your data is stored encrypted.
• Row-level security. Access to your entries is enforced by row-level security tied to your account, so only your signed-in account can retrieve them.
• Hashed passwords. Passwords are stored only as secure hashes.
• Breach notification. No system is perfectly secure. If a breach ever affects your data, we’ll notify you and the supervisory authority as the GDPR requires.

Think you’ve spotted a security issue? Tell us at reaganprezzo@gmail.com.

Who we share data with

We share data only with the service providers (processors) needed to run the app, under data-processing agreements.

If you book a therapy session, the details of your request are shared with our care team so a licensed professional can contact you.

Some of our providers process data outside the European Economic Area. Where that happens, transfers are protected by an adequacy decision of the European Commission (including the EU–US Data Privacy Framework, where the provider is certified) or by the Commission’s Standard Contractual Clauses.

We never sell personal data or share it with advertisers or data brokers. We would disclose data to authorities only where the law requires it.

Your rights

Wherever you live — and especially under the GDPR — you have the right to:

• access the personal data we hold about you, and get a copy;
• correct inaccurate data;
• delete your data (the “right to be forgotten”);
• receive your data in a portable, machine-readable format;
• restrict or object to certain processing;
• withdraw consent at any time, without affecting processing that happened before.

To use any of these, email reaganprezzo@gmail.com. We respond within one month, as the GDPR requires, and we will never treat you differently for exercising your rights.

You can also lodge a complaint with your local data-protection supervisory authority. If you’re in the EU or EEA, that’s the authority of the country where you live.

If we change our Privacy Policy in a way that matters, we’ll tell you in the app before the change takes effect — and where the change concerns your wellbeing data, we’ll ask for your consent again.

Deleting your data

You decide what stays. Delete individual entries whenever you like, or delete your whole account from Settings → Delete account in the app, or by emailing us from your registered address.

When you delete your account, your profile, photo, journal entries, moods, recovery data and therapy requests are permanently removed from our systems, with residual copies purged from backups within 30 days. Purchase records are kept as long as tax and accounting law requires. Deletion is permanent and can’t be undone.

How to delete your account, step by step