Privacy Policy

Who we are

This privacy policy is issued by MindShield (“we”, “us”, “our”), the service available at mindshield.app and related MindShield apps and pages (together, the “Services”).

You can contact us about privacy at hello@mindshield.app. Under applicable data-protection law we are the controller of personal data processed through the Services.

You may also lodge a complaint with your local data-protection authority. We ask that you contact us first so we can try to resolve your concern.

What this policy covers

This policy explains how we collect, use, share, and protect personal data when you use our website, complete the assessment, create an account, subscribe, install the iPhone configuration profile, or otherwise interact with MindShield.

MindShield is designed to block gambling, pornography, and shopping websites through protected DNS — not to monitor your personal life. The configuration profile does not grant us access to your photos, messages, passwords, or personal files.

Information we collect

Account and identity data: email address and authentication details when you sign in with email (magic link) or Google via our authentication provider.

Onboarding and recovery profile data: information you choose to provide during setup, such as selected categories (gambling, adult/pornography, shopping), estimated monthly spend, weekly hours, last use date (including whether it is approximate), currency, and selected plan. We store this to personalize your experience and may also attach limited setup metadata to your Paddle customer or subscription records.

Billing and transaction data: subscription status, plan, Paddle customer and subscription identifiers, and payment-related details processed by Paddle. We do not store full card numbers on our servers.

Technical and usage data: IP address (for security, locale routing, and rate limiting), device/browser information, cookies and similar technologies needed for sessions and preferences, and product usage events.

DNS lookup data: when protection is active, our encrypted DNS resolver receives domain-name lookups needed to answer DNS queries and apply your category blocklists. This is not full page content or Safari browsing history.

Domain reports: if you report a missed site, we store the hostname and the raw URL you submitted (without linking it to your account where possible).

Support communications: content you send to hello@mindshield.app if you contact us.

We may also process aggregated or anonymized statistics that do not identify you.

How and why we use your data

We process personal data to create and manage your account, provide the Services (including assessment, checkout, subscription access, and profile download), send service messages about billing and installation, improve reliability and security, analyze product usage, and comply with legal obligations.

Where the GDPR or similar laws apply, our legal bases include: performance of a contract (account, subscription, and delivery of blocking); legitimate interests (security, fraud prevention, product improvement, service communications); legal obligation where applicable; and consent where we rely on it (for example, optional marketing if you later opt in). You may withdraw consent at any time without affecting prior lawful processing.

Who we share data with

We use trusted processors and service providers to operate MindShield, including: Paddle (payments and customer portal), Supabase (authentication and database), Vercel (hosting), and our DNS/blocklist infrastructure (including NextDNS where used).

We may also share data with professional advisers, or with authorities when required by law, or in connection with a merger, acquisition, or transfer of our business, subject to appropriate safeguards.

We do not sell your personal data.

International transfers

Some providers process data outside your country of residence (for example in the United States or the European Economic Area). Where we transfer personal data internationally, we use appropriate safeguards recognized under applicable law, such as adequacy decisions or standard contractual clauses, as applicable.

Retention

We keep account, subscription, and recovery-profile data for as long as your account or subscription is active and for a reasonable period afterward as needed for billing records, dispute handling, security, and legal compliance (typically up to 12 months after your subscription ends, unless a longer period is required by law).

DNS resolver operational logs, if retained by our infrastructure, are kept only as long as needed for security, abuse prevention, and service reliability.

Domain submissions are retained while useful for blocklist review. Support emails are retained as long as needed to handle your request and related follow-up.

Security

We use appropriate technical and organizational measures to protect personal data, including encrypted transport (HTTPS / DNS-over-HTTPS), access controls, and limiting access to people who need it to operate the Services. No method of transmission or storage is completely secure.

Cookies and similar technologies

We use cookies and similar technologies for essential functions such as authentication sessions, preferences, and subscription access checks. These essential cookies do not require consent.

You can control cookies through your browser settings. Blocking essential cookies may prevent sign-in or other core features from working.

Your rights

Subject to applicable law (including the GDPR where it applies), you may have the right to access, correct, erase, restrict, or object to certain processing of your personal data, and the right to data portability. Where processing is based on consent, you may withdraw consent at any time.

To exercise these rights, email hello@mindshield.app. We may need to verify your identity before responding. We aim to respond within one month.

Children

MindShield is intended for adults. The Services are not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

Changes

We may update this privacy policy from time to time. The “Last updated” date at the top of this page will change when we do. Continued use of the Services after an update means you acknowledge the revised policy.

Questions: hello@mindshield.app