Privacy Policy
Last updated: October 13, 2026
This policy explains what personal data MindFy (the app for Android, iOS and the web) collects, why, who we share it with and how you can exercise your rights. It follows Brazil’s General Data Protection Law (Law 13,709/2018, “LGPD”) and applies to users everywhere.
1. Who is responsible
The data controller is Luis Henrique Jung. For any privacy matter, including reaching our data protection officer, write to [email protected].
2. Data we collect
Account data
- Email and password, if you sign up with email. The password is stored only as a hash; we never see it.
- If you sign in with Google, we receive an account identifier and your email from Google (through Firebase Authentication).
- Display name, chosen language and the goals you pick (Focus, Calm, Study, Sleep).
Usage data
- Playlists you create and tracks you favorite.
- Listening history: which track played, when, for how long and whether it finished. We use it for recommendations, “continue listening” and catalog statistics.
- Playback preferences (such as track crossfade) are stored only on your device.
Subscription data
- Plan (monthly, yearly or lifetime), status, start and renewal dates and the transaction identifier.
- We never receive card details. Payments are processed by Google Play, the App Store or, on the web, Stripe.
Technical data
- IP address, access date and time and request details, logged by our servers for security (for example, blocking repeated login attempts).
- A device session identifier to keep you signed in.
- On the free plan, Google’s ads SDK (AdMob, and AdSense on the web) may collect your device’s advertising ID, IP address and ad interaction data.
We do not collect precise location, contacts, photos, audio recordings or health data. MindFy tracks are wellness content; listening to a category such as “Calm” or “Sleep” is not treated as health data.
3. Why we use it and our legal basis
| Purpose | Legal basis (LGPD, art. 7) |
|---|---|
| Create and keep your account, play music, save playlists and favorites | Performance of a contract |
| Unlock and manage your Premium subscription | Performance of a contract |
| Security and fraud and abuse prevention | Legitimate interest |
| Recommendations and aggregate statistics to improve the catalog | Legitimate interest |
| Show ads on the free plan | Legitimate interest, or consent where required |
| Keep access and purchase records | Legal obligation (Brazilian Internet Civil Framework and tax law) |
4. Who we share it with
We do not sell your data. We share it only with providers that run the service on our behalf:
- Google Firebase Authentication: Google sign-in.
- RevenueCat: subscription management, linked to your account identifier.
- Google Play, Apple App Store and Stripe: payment processing.
- Google AdMob and Google AdSense: ads on the free plan.
- Railway: server and database hosting.
- Cloudflare: storage and delivery of audio files and artwork.
We may also share data when required by law or by order of a competent authority.
5. International transfers
These providers may process data outside Brazil, mainly in the United States. Such transfers follow article 33 of the LGPD, with contractual clauses and appropriate security measures.
6. How long we keep it
- Account data, playlists and favorites: for as long as your account exists.
- Access logs (IP, date and time): 6 months, as required by Brazilian law.
- Purchase records: for the period required by tax and consumer protection law.
- When you delete your account, listening history and purchase records are no longer linked to your email or sign-in and are used only for statistics.
7. How to delete your account
In the app, open Profile › Delete account and confirm. We immediately erase your email, password, Google sign-in links, profile, playlists, favorites and active sessions. If you can’t sign in, request deletion at [email protected] from the email address on your account; we reply within 15 days.
Deleting your account does not cancel a subscription. Cancel it first in the store where you subscribed (Google Play › Payments & subscriptions, or Settings › Subscriptions on iPhone) so you are not charged again.
8. Your rights
Under the LGPD (art. 18), you may at any time request:
- confirmation that we process your data, and access to it;
- correction of incomplete or outdated data;
- anonymization, blocking or deletion of unnecessary data;
- data portability;
- information about who we share it with;
- withdrawal of consent, where consent is the legal basis;
- objection to processing based on legitimate interest.
Write to [email protected]. You may also file a complaint with Brazil’s National Data Protection Authority (ANPD) at gov.br/anpd or with the data protection authority where you live.
9. Ads
The free plan shows Google ads, which may be personalized according to your Google account settings. On Android you can delete your advertising ID under Settings › Google › Ads; on iPhone, under Settings › Privacy & Security › Tracking. To learn how Google uses this data, see policies.google.com/technologies/partner-sites. Premium subscribers see no ads.
10. Children
MindFy is not directed at children under 13 and we do not knowingly collect their data. Teenagers between 13 and 18 should use the app with a parent’s or guardian’s permission. If you learn that a child has created an account, write to [email protected] and we will delete it.
11. Security
All traffic uses HTTPS, passwords are stored only as hashes, access to our internal panel is restricted and sign-in attempts are rate limited. No system is fully immune; if an incident poses a relevant risk to you, we will notify you and the ANPD.
12. Changes to this policy
We may update this policy. The date at the top shows the version in force; for material changes we will notify you in the app or by email before they take effect.