Last updated: October 23, 2026
The short version: MindSync is a private space for your therapy. Your journal, notes, recordings, and mood data belong to you. We store them encrypted, we do not read them, and we never sell them or use them for advertising. We use AI (OpenAI) to turn your entries into insights, because that is what the app is for. You can delete everything inside the app at any time, and you can ask us for a copy of your data by email.
MindSync is operated by ToTalkTo Dariusz Wiśniewski, registered in Gdańsk, Poland (NIP: 5922231851, REGON: 363389287). Under EU data protection law (GDPR), this is the "data controller" of your personal data. For anything privacy related, write to hello@mindsync.app.
Account data: your name or a pseudonym, your email address, and a password when you create an account.
Your therapy content: everything you put into MindSync so it can work for you. That means journal entries and notes, voice notes, recordings of therapy sessions, conversations in Reflect with Orca, MindSync's therapy assistant, the notes Orca keeps so it can remember you (see section 5), mood and symptom check-ins, therapy goals and session dates, homework, and check-ins about your relationship with your therapist. This is sensitive wellbeing data, and we treat it with more care than anything else we hold. Voice notes and session recordings are transcribed, and the audio file is deleted once the transcript exists.
Usage data: how the app and the website are used. Device type, operating system, app version, screens visited, features used, crash reports, your IP address, and the rough city-level location it points to. We do not read your precise GPS location, your contacts, or your photos.
Support data: emails and messages you send us.
Website signups: if you leave your email on our website, for example to download a guide, we store it to send you what you asked for and, if you agreed to it, occasional emails about MindSync.
We never sell your personal data. We never use your therapy content for marketing or advertising. There are no ads in MindSync.
MindSync is built around AI. To create transcripts and insights, your entries travel to OpenAI in the United States through its business API: text, voice audio for transcription, mood scores, and the context needed to make sense of them. Our agreement with OpenAI means your data is not used to train its models, and audio is deleted after transcription. AI insights exist to support your own reflection. They are not medical advice, and MindSync makes no automated decisions about you that would have legal or similarly serious effects.
Since October 5, 2026, Orca, MindSync's therapy assistant, can remember things from your conversations and entries, so you don't have to repeat yourself every time. Orca keeps these as short notes, grouped into what's on your mind, what helps, your goals, your routines, and the people in your life.
You can see every note in Settings, on the page that shows what Orca remembers. You can delete any single note, or tap Forget everything to delete all of them. Deleted notes are removed permanently, not hidden. When you delete a conversation, the notes that came from it are deleted too.
Orca does not keep memory notes from conversations where you are in crisis. Memory notes are part of your therapy content and are handled under this policy like the rest of it: they are created with AI as described in section 4, never used for marketing or advertising, and erased when you delete your account.
A short list of providers keeps MindSync running. Each one is bound by a data processing agreement and only does its own job:
Beyond that, your data leaves MindSync in three cases: you share it yourself (for example, you send a weekly summary to your therapist by email or WhatsApp, or share a card as an image, and you decide what goes in it), the law requires it, or MindSync changes owners, in which case this policy still applies and we will tell you.
There is no therapist account or portal in MindSync, so therapists have no access to your data in the app. Sharing always starts with you. Participants in our beta and pilot programs receive separate information and give separate consent.
Your data sits on cloud servers run by Heroku, a Salesforce company. Some of our providers are American companies (OpenAI, Google, Salesforce, Loops), so some processing happens in the United States. Every transfer outside the EU is covered by EU-approved safeguards: the EU-US Data Privacy Framework and Standard Contractual Clauses.
Your data is encrypted in transit (TLS) and at rest (AES-256). Entries stay encrypted in storage and are decrypted only to show them to you and to run the analysis you asked for. We do not read your entries. Access to production systems is restricted and logged. No system is perfectly secure, though. If a breach ever affects you, we will notify you and the supervisory authority within 72 hours, as GDPR requires.
Your account and content stay as long as your account exists. When you delete your account in Settings, your personal data is permanently erased within 30 days, backups included. If you want a copy of your data, email hello@mindsync.app before you delete your account and we will send it to you. Support emails are kept for up to 2 years. Billing records stay as long as tax law says they must.
You can access your data, take a copy with you, correct it, delete it, restrict or object to processing, and withdraw any consent. Withdrawing consent for AI analysis has a real consequence: MindSync loses the ability to produce your insights. If that happens, we will explain your options, including deleting your account.
You can correct or delete your content and delete your account yourself, inside the app. To get a copy of your data, or to use any other right, email hello@mindsync.app. We answer within 30 days and never charge for it. We may ask you to confirm your identity first, so nobody else can pretend to be you. If you are in the UK, the same rights apply under UK data protection law.
If you think we handled something badly, you can complain to a data protection authority. In Poland that is the President of the Personal Data Protection Office (UODO, uodo.gov.pl); in other countries, your local authority.
Privacy laws in California, Colorado, Connecticut, Texas, Virginia, Oregon, Montana, and a growing number of other states give you rights to know, access, correct, delete, and receive a portable copy of your personal information, and to opt out of "sales", "sharing", and targeted advertising.
We do not sell personal information. The only "sharing" we do happens through advertising cookies on our website (Google, Meta). You can opt out through your cookie settings or by browsing with Global Privacy Control turned on; we honor that signal. Data from the app itself is never used for advertising.
Your journal and check-ins count as "consumer health data" under laws such as Washington's My Health My Data Act. We process this data only with your consent and only to provide MindSync. You can withdraw that consent and have the data deleted whenever you choose.
Exercising these rights will never cost you features, prices, or service quality. Email hello@mindsync.app; an authorized agent may act for you, and we may verify your identity before acting. If we deny a request, reply to our decision to appeal. If the appeal fails, your state Attorney General can hear the complaint.
The app contains no advertising trackers. The website (mindsync.app) uses three kinds of cookies. Essential cookies keep the site working. Analytics tools (PostHog on EU servers, Contentsquare, and Google) show us how the site is used. Advertising tags from Google Ads and Meta measure our campaigns and may share website visit data with those platforms.
Where consent is required, non-essential cookies wait until you agree. You can change your choice at any time in the cookie settings on the site or in your browser, and Global Privacy Control works as an opt-out of advertising sharing.
Your entries and recordings sometimes involve other people, most often your therapist. You are responsible for making sure you may record or describe them, and we process that information only as part of your content, under your instructions.
MindSync is for people aged 16 and older. We do not knowingly collect data from anyone younger. If we learn that we have, we delete it.
When something significant changes, we tell you in the app or by email before it takes effect. The date at the top always shows the current version.
ToTalkTo Dariusz Wiśniewski (MindSync), Gdańsk, Poland
NIP: 5922231851, REGON: 363389287
hello@mindsync.app
