Privacy Policy

Effective 30 August 2026

This Privacy Policy explains how personal information is handled when you use the MindstackApp mobile application and mindstackapp.com, together referred to as the Service. Please read it alongside our Terms of Service.

Scope and controller

The Service is provided by TFH Software, which is the data controller responsible for personal information processed through it. This policy applies to everyone who uses the Service, wherever they are located.

It does not apply to third party websites you reach by saving or opening a link. Those sites are governed by their own policies.

Information we collect

Information you provide

• Account details. Your email address and a display name. If you sign in with a third party identity provider, we receive your email address and name from that provider. We never receive your password.
• Content you save. The photos, links and notes you add, and the tags you organise them with. For a saved link this includes the address and the page title.
• Profile and preferences. An optional profile picture, your reminder time, your weekly summary day and time, and the purpose you select during setup.
• Correspondence. Messages you send us, and the address you send them from.

Information collected automatically

• Device time zone. So that a reminder set for 9pm arrives at 9pm where you are. This is a time zone, not a location, and we do not store it as a place.
• Service and diagnostic logs. Standard records of requests to our servers, including a timestamp and technical details needed to keep the Service running and secure.

Information we do not collect

We do not collect precise or approximate location, contacts, calendar entries, microphone input, health data, or advertising identifiers. The Service contains no third party analytics, advertising or tracking software, and the app does not request permissions for any of the above.

How we use information

We do not use your content to train machine learning models, and we do not use it for advertising or profiling.

Legal bases for processing

Where the General Data Protection Regulation or equivalent law applies, we rely on the following legal bases:

• Performance of a contract. Running your account and storing what you save, so that we can provide the Service you asked for.
• Consent. Optional reminder and summary emails. You may withdraw consent at any time, and withdrawing it does not affect processing carried out beforehand.
• Legitimate interests. Keeping the Service secure and reliable, preventing abuse, and responding to support requests, where those interests are not overridden by your rights.
• Legal obligation. Where we are required to retain or disclose information by law.

How information is shared

We share personal information only in the circumstances set out below. We engage a small number of service providers who process information on our instructions, under contract, and only for the purpose given:

• Identity and authentication providers, to verify who is signing in.
• Cloud infrastructure and database providers, to host the Service and store your account and content.
• Media storage and delivery providers, to store and serve the images you save.
• Transactional email providers, to deliver the messages described in this policy.

We will also disclose information where we are legally required to do so, where it is necessary to establish or defend legal claims, or where it is necessary to protect the rights and safety of our users or the public. If our business is transferred, personal information may be transferred as part of that transaction, and this policy will continue to apply until you are given notice of any change.

If you would like the identity of the specific service providers we use, write to us and we will provide the current list.

We do not sell your information

We do not sell personal information, and we do not share it for cross context behavioural advertising, as those terms are defined under the California Consumer Privacy Act as amended, or under comparable laws in other jurisdictions. We have not done so in the preceding twelve months. There is nothing for you to opt out of, because we do not do it.

International transfers

The Service is operated from India, and personal information is processed there. Some of our service providers process information in other countries, which may include the United States and countries in the European Economic Area.

Where personal information is transferred out of a jurisdiction that restricts such transfers, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses or an equivalent mechanism, together with contractual commitments from the provider receiving it.

Retention and deletion

We keep your account information and the content you save for as long as your account remains open, because the entire purpose of the Service is to hold it until you come back for it. We do not apply an expiry to your content.

Service and diagnostic logs are retained for a limited period, generally no longer than twelve months, and then deleted or aggregated so that they no longer identify you.

Deleting an individual item removes it, and deleting a photo also deletes the stored image. Deleting your account removes your account record, all of your content and all of your uploaded images.

A short delay may occur before deleted information is purged from routine backups. We may retain limited information where the law requires us to, for example to comply with a tax or accounting obligation, or to establish or defend a legal claim.

Security

We use technical and organisational measures appropriate to the sensitivity of the information we hold. These include encryption of traffic in transit, encryption of stored data, access controls limiting who can reach production systems, and authentication handled by specialist identity providers so that we never hold your password.

No service can promise perfect security. You are responsible for keeping your own sign in credentials and your device secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant supervisory authority where the law requires it.

Your privacy rights

Subject to your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your personal information.
• Obtain a portable copy of information you provided to us.
• Object to, or ask us to restrict, certain processing.
• Withdraw consent where processing is based on consent.
• Be free from discrimination for exercising any of these rights.

Two of these you can exercise immediately, without asking us. Settings then Export my data produces a complete copy of everything you have saved. Settings then Delete my account erases your account and its contents. For anything else, write to us and we will respond within the period required by applicable law, and in any event within 30 days.

We may need to verify your identity before acting on a request, which we will normally do by confirming control of the email address on the account. You may use an authorised agent where the law permits it.

Regional disclosures

European Economic Area and United Kingdom

You have the right to lodge a complaint with your local supervisory authority. We would ask you to contact us first so that we have the chance to resolve the matter.

California

In the preceding twelve months we collected the categories of personal information described in section 2, being identifiers, internet or network activity information, and the content you choose to store. We collected it for the purposes in section 3 and disclosed it only to the categories of service providers in section 5. We did not sell or share personal information, and we do not knowingly collect or sell the personal information of anyone under 16.

India

Where the Digital Personal Data Protection Act applies, we process personal data for the lawful purposes described above, and you may contact us to exercise the rights that Act provides, including access, correction, erasure and grievance redressal.

Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete the account and its contents promptly. Where local law sets a higher age of digital consent, that higher age applies.

Cookies and similar technologies

The mobile app does not use cookies. It stores a small amount of data on your device so that you remain signed in and your display preferences persist between sessions.

This website uses only what is strictly necessary to serve the pages you request. It sets no advertising or analytics cookies, so there is nothing to consent to and no tracking to refuse.

Changes to this policy

We may update this policy as the Service develops or the law changes. The effective date at the top of this page always reflects the current version. If a change materially affects your rights, we will give notice in the app or by email before it takes effect, rather than relying on you to notice an edit to this page.

How to contact us

For any privacy question, request or complaint, write to TFH Software at hello@mindstackapp.com. Please tell us what you would like us to do and which email address your account uses, so that we can identify it.