Privacy Policy
Last updated: 2026-07-18.
This is the privacy policy for MindMove, a brain-training mobile app. We'll refer to it as "the app" throughout.
Who we are
The app is operated by Joseph Ernst, an individual developer (the enrolled Apple Developer for this app). We may form a company before public launch; if so, this page will be updated to name the operating entity. Either way, the practices below apply.
Contact: vikicorehq@gmail.com.
What we collect
The app is designed around a small, honest amount of user data. Here's what we collect, when, and why.
When you use the app as a guest
- A random, anonymous user ID generated on device by Supabase (our backend provider).
- Your age, as you type it at setup. We keep only your birth year derived from it (never a full date of birth) plus a coarse age group — these size touch targets, set the text-size default (55+ users are offered bigger text), and may later power fair, age-grouped leaderboards. If you enter an age under 13, nothing is saved and no profile is created (see "Children" below).
- Your display name, if you enter one.
- Your gameplay activity: for each session, which modules you played and your composite Mind Score. For each individual trial within a module: what was shown, how you responded, whether it was correct, and how long you took in milliseconds.
- Your streak state (current length, longest length, freezes remaining).
- Your accessibility preferences (haptics, audio cues, reduced motion, larger text, high contrast).
- Your focus-area preferences — which cognitive domains you chose to highlight in the optional questionnaire. If you have an account, these sync to it so your highlights follow you to a new device.
- Product-analytics events (see "Product analytics" below): which screens you visit and which games you start and finish, tied to the same random user ID — never your name, email, or anything you type. You can turn this off in Settings → Privacy.
When you create an account or sign in
You can save your progress by signing in with Apple, Google, or an email link. Depending on the method, this adds:
- Your email address (all methods).
- Your name, when your sign-in provider shares it. If you sign in with Apple, Apple may pass us your full name the first time (you can choose to hide or relay it); if you sign in with Google, your Google account name and email are shared with us. We store the name on your account so we can show it to you. (You can choose "Hide My Email" with Apple — we then only ever see a private relay address.)
- Authentication state (access tokens, refresh tokens) — stored securely on your device by Supabase.
We do not receive your password — sign-in is handled by Apple, Google, or the one-tap email link.
What we do NOT collect
- Your address, phone number, or government ID.
- Your payment information. The app is currently free with no in-app purchases.
- Health, fitness, or medical data. The app is not HIPAA-covered.
- Your precise location.
- Photos, contacts, or other phone data.
- Advertising identifiers.
- Any information from other apps on your phone.
Why we collect it
- Core app functionality. Your streak, scores, and progress would not exist without storing them somewhere.
- Within-user improvement signals. We show you honest trend lines over time on your own performance (e.g. reaction-time curves on Double Decision). This requires storing each trial.
- Leaderboards. If you opt into social features, your display name and daily best score are visible on a shared leaderboard; no other data is exposed.
- Product improvement. In aggregate, we look at how long sessions take, which modules users complete, and retention. We do not use or sell individual user data for advertising or third-party marketing.
- Improving the app. When we offer to save your progress by signing in, we note whether that prompt was shown, dismissed, or acted on (tied to your user ID). This low-sensitivity record adds no new personal information; it only helps us tune when and how often we offer to save your progress.
How we store it
- Backend: Supabase (Postgres database, row-level security enforced).
- Email/auth: Supabase Auth.
- Local on-device: Expo's secure storage and AsyncStorage for session tokens and reminder preferences.
Product analytics
We use PostHog to understand how the app is used so we can improve it — which screens people visit, where they stop, and which games get played. Here's exactly what that means:
- Events are tied to the same random user ID as the rest of your data — never your name or email. We don't send either to PostHog.
- Event properties are coarse: screen names, game names, counts, and app-level settings (like text size or theme). No answers you give in games, nothing you type, no precise location (we also configure PostHog to discard IP addresses).
- No session recording or screen replay — that PostHog feature is off.
- No cross-site tracking, no advertising pixels, and nothing is shared with data brokers or ad networks.
- You can turn it off any time in Settings → Privacy → Share anonymous usage data. The app works identically with it off.
- Under-13 devices send nothing — analytics is disabled entirely by the age gate (see "Children").
All data is stored in Supabase's hosted infrastructure. Rows are protected by row-level security policies such that your data is readable and writable only by you (exceptions: aggregated leaderboard scores visible to other users if you opt in).
How long we keep it
- Active users: as long as your account exists.
- Account deletion: you can delete your account at any time in the app (Settings → Account → Delete my account). This is immediate and permanent: it removes your account and everything attached to it — your profile, display name, name and email from sign-in, sessions, individual trials, streak, XP/coins/levels, word-pack progress, and leaderboard standings — with no recovery. (Residual copies in encrypted database backups roll off on the schedule below.) After deletion the app drops back to a fresh guest so you can keep playing if you like.
- Backups: database backups roll off on a 30-day window; deleted data may persist in backup snapshots for up to 30 days.
Your rights
Depending on where you live, you may have the right to:
- Access the data we hold about you. Email us and we'll provide an export of your data (a built-in in-app export isn't available yet).
- Correct inaccurate data. Most settings are editable in-app; for anything that isn't, email us.
- Delete your account and associated data. Available in-app in Settings → Account → Delete my account (immediate and permanent).
- Withdraw consent for non-essential data collection (you can turn off analytics; essential gameplay data cannot be disabled while continuing to use the app).
- Port your data — email us and we'll provide an export on request.
- Lodge a complaint with your data protection authority (e.g. ICO in the UK, your state AG in the US).
To exercise these rights, email us at the contact address above. We aim to respond within 30 days.
Children
The app is for users 13 and older. Setup asks your age; if you enter an age under 13, the app does not create a profile, deletes the anonymous ID that was provisioned on first launch, stores nothing you entered, and sends no analytics events — a device flag simply keeps the app closed on that device (email us if it was entered by mistake). We do not knowingly collect personal information from children under 13. A younger "Kids" audience is planned for a future release with COPPA-compliant parental consent flows; this policy will be updated at that time.
Changes to this policy
If we change this policy in a material way, we'll notify you in the app and by email (if you've signed up). The "Last updated" date at the top always reflects the latest revision.
Third-party processors
We rely on these third parties to operate the app. Each has its own privacy practices:
Cookies and tracking
The app itself does not use cookies (it's not a website). Our marketing website, when we have one, uses only essential cookies; there is no cross-site tracking, no advertising pixels, and no third-party trackers.
Simple summary (not legally binding but useful)
- We store your gameplay so your streak and scores work.
- We don't sell your data. We don't use it for advertising.
- You can delete your account and your data anytime.
- Email us if anything is unclear.