MindfulHand Privacy Policy
MindfulHand
Privacy Policy
How MindfulHand handles your information
Effective: April 29, 2026
MindfulHand ("we," "our," or "us") is a wellness companion app that offers tools for journaling, mood tracking, breathing exercises, crisis planning, and supportive conversations with our AI companion, Ollie. We care deeply about your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.
This policy applies to the MindfulHand mobile app, our website at mindfulhand.com, and any related services. By using MindfulHand, you agree to the practices described here.
MindfulHand is not a healthcare provider, mental-health professional, or crisis-response service. If you are in immediate danger, call 911 or contact the 988 Suicide and Crisis Lifeline.
Information We Collect
Information you give us
When you create an account or use MindfulHand, we collect the following types of information you provide directly:
Account information: email address, password (stored as a one-way hash, never in plain text), and a display name.
Date of birth: we collect your date of birth at signup to enforce our minimum age requirement (13 years old) and to determine whether parent or guardian consent is needed (for users aged 13–17).
Parent or guardian email (if you are 13–17): we collect a parent or guardian's email address so we can send them a one-time confirmation link. We use this address only to obtain consent and to follow up if a question arises. We do not share it with third parties or use it for marketing.
Profile information: first and last name, school name, school year, and any wellness notes you choose to share with Ollie.
Sign-in identifiers: if you sign in with Apple or Google, we receive a unique identifier ("sub") from those providers, plus the email address you authorize them to share with us. We never receive your Apple or Google passwords.
Wellness content: journal entries, mood-check-in responses, daily goals, conversations with Ollie, and any saved coping strategies or crisis-plan items you create.
User-generated memories: Ollie may extract short factual statements from your conversations (for example, "prefers tea over coffee") and save them so future conversations feel personalized. You can view and delete these in your profile.
Information collected automatically
Session data: we use server-side session cookies (PHPSESSID) to keep you signed in. These cookies are stored on your device and on our server while you are signed in.
Device data: approximate IP address, device type, and operating-system version, captured by standard server logs to help us diagnose issues and protect against abuse.
Notification tokens: if you enable Daily Affirmations, MindfulHand schedules notifications locally on your device using the operating system’s built-in notification scheduler. We do not send notifications from our servers, and we do not collect or store push notification tokens. Your notification preferences are stored on your device.
Information we do NOT collect
MindfulHand does not collect, request, or transmit:
Your real-time location
Your contacts list, calendar, photos, microphone, or camera (we don't request these permissions)
Tracking data from other apps or websites you use
Advertising identifiers (we don't run ads)
Health data from Apple Health or Google Fit
How We Use Your Information
We use the information described above to:
Provide the core MindfulHand experience — sign you in, save your journal entries, deliver Ollie's responses, and track your mood and goals.
Personalize Ollie's responses using the wellness notes, recent conversation history, and stored memories you've allowed.
Send notifications you have explicitly enabled (such as Daily Affirmations).
Keep MindfulHand secure — for example, by detecting suspicious sign-in activity.
Diagnose and fix bugs using error logs.
Improve MindfulHand over time — for example, by reviewing aggregate, anonymized usage to understand which features people find helpful.
We do not use your wellness content (journal entries, mood data, or chats with Ollie) for advertising or analytics. We do not sell your information. Ever.
Third Parties That Help Us Run MindfulHand
We rely on a small number of third-party services to make MindfulHand work. We share only the data each service needs, and only for the purposes described below:
Google (Gemini API)
When you chat with Ollie, your messages and a small amount of conversation history are sent to Google's Gemini AI service so Ollie can generate a response. Google processes this data to fulfill our request and does not use it to train its general models. See Google's Generative AI privacy notice for details.
Apple (Sign in with Apple)
If you sign in with Apple, Apple confirms your identity to us and shares a unique identifier and an email address (real or relay). Apple's privacy policy applies to that interaction.
Google (Sign in with Google)
If you sign in with Google, Google confirms your identity to us and shares a unique identifier, your email, and (if you grant permission) your name. Google's privacy policy applies to that interaction.
Operating system notification scheduler
If you opt in to Daily Affirmations, MindfulHand schedules notifications locally on your device. The operating system (iOS or Android) delivers them at the scheduled time without contacting our servers. We do not transmit notification content over Apple Push Notification service or Firebase Cloud Messaging.
Hosting infrastructure
We host MindfulHand on cPanel-managed servers operated by our hosting provider. The hosting provider stores our database and application files but does not access them as part of the service.
Data Retention
We keep your account data for as long as your account exists. If you delete your account using the "Delete Account" button in the Profile screen, we permanently remove:
Your account record, password hash, and sign-in identifiers
Your profile information and wellness notes
All journal entries, mood entries, and to-do items
All conversations with Ollie and stored memories
Any feedback you've submitted
Server logs that record general access (IP, request time) may be retained for up to 90 days for security and debugging, then are automatically discarded. These logs are not linked to your account after deletion.
Your Rights and Choices
You have control over your information at any time:
Access and edit: view and update your profile, wellness notes, and other content from the Profile screen in the app.
Delete your account: permanently remove your account and all associated data using "Delete Account" in the Profile screen. This is immediate and cannot be undone.
Disable notifications: toggle Daily Affirmations off in the Profile screen, or revoke notification permission from your iPhone's Settings.
Export your data: if you'd like a copy of your data before deleting your account, contact us at the email below and we will provide an export within 30 days.
If you live in the European Economic Area, the United Kingdom, or California, you have additional rights under the GDPR or CCPA, including the right to request a copy of your data and the right to object to certain processing. Contact us to exercise these rights.
Children's Privacy
MindfulHand is not intended for children under 13. To enforce this:
We collect your date of birth when you create an account using email and password, and we block account creation entirely for anyone under 13.
Users aged 13 to 17 must provide a parent or guardian's email address. We send the parent or guardian a one-time confirmation link, and the account stays inactive until the parent or guardian clicks that link to grant consent.
Consent links expire after 14 days. If a link expires, the user can request a fresh one from the app.
Parents or guardians may withdraw consent at any time by emailing admin@mindfulhand.com. We will immediately delete the account and all associated data when consent is withdrawn.
If you sign in using Apple or Google, our age-verification flow may not initially apply because we receive only the information those providers share. In those cases we will ask you for your date of birth shortly after sign-in to confirm eligibility. Until you provide a valid date of birth that meets our minimum age requirement, full app features may be limited.
If you believe a child under 13 has created an account through any method, please contact us and we will promptly delete the account and all associated data.
Security
We take reasonable measures to protect your information, including:
All connections between your device and our servers use HTTPS/TLS encryption.
Passwords are stored using one-way bcrypt hashing — even we cannot read them.
Sign-in tokens (Apple/Google) are verified against the providers' public keys, not by trusting client claims.
Cross-Site Request Forgery (CSRF) tokens protect every authenticated request.
Database access is restricted to the application service account.
No method of transmission or storage is 100% secure. While we work to protect your information, we cannot guarantee absolute security.
International Users
MindfulHand is operated from the United States. If you use MindfulHand from outside the U.S., your information will be transferred to and processed on servers located in the United States. By using MindfulHand, you consent to that transfer.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you in the app and update the "Effective" date at the top of this document. Continued use of MindfulHand after a change constitutes acceptance of the updated policy.
Contact Us
If you have questions, concerns, or requests about this Privacy Policy or your data, contact us at:
Email: admin@mindfulhand.com
Web: https://mindfulhand.com
We aim to respond to all requests within 7 business days.