KALIMAH ARABIC

MINDSTACK — PRIVACY POLICY

Effective date: 5 May 2026

MindStack is a flashcard study app. There is no sign-in. Your decks, cards, review history, settings, and media stay on your device and (if iCloud is enabled) sync to your own iCloud account via Apple's CloudKit private database. We have no server holding this data and cannot access it.

DATA WE PROCESS

1. Card content you submit to AI features (text, PDFs, photos)
   Purpose:    Generate, hint, explain, or audit cards
   Recipient:  OpenAI, via the AIProxy relay
   Retention:  Not retained by us. OpenAI follows their API Data Usage
               Policy (no training on inputs):
               https://openai.com/policies/api-data-usage-policies

2. Anonymous DeviceCheck token
   Purpose:    Anti-abuse — confirms requests come from a legitimate
               Apple device
   Recipient:  Apple + AIProxy
   Retention:  Short-lived; not retained.

3. Anonymous app usage events
   Purpose:    Understand how the app is used so we can fix issues
               and prioritise improvements
   Recipient:  TelemetryDeck (Switzerland) — privacy-first analytics
               with no IP storage and no cross-app tracking
   Retention:  Per TelemetryDeck retention.

4. Subscription state
   Purpose:    Confirm Pro entitlement
   Recipient:  Apple StoreKit
   Retention:  Per Apple. We never see payment details.

We do not collect your name, email, location, contacts, photos library,
microphone, advertising IDs, or any profile data. We do not sell or
share personal information (CPRA).

LEGAL BASIS (UK / EU GDPR)

- AI features, DeviceCheck, StoreKit: Article 6(1)(b) — contractual
  necessity.
- Analytics: Article 6(1)(f) — legitimate interest. You can opt out
  any time inside the app.

YOUR RIGHTS

You have the right to access, rectify, erase, restrict, object to,
and port your personal data (UK / EU GDPR) and to know, delete, and
opt out (CCPA / CPRA). Most of your data lives in your own iCloud,
not on our infrastructure — to delete it, delete the app or sign out
of iCloud. To request what we hold, email the address below; we will
respond within 30 days.

To delete AI request logs OpenAI may hold, contact OpenAI directly
via the link above — we have no access.

CHILDREN

MindStack is rated 4+. No sign-in, no ads, no profiling. We do not
knowingly collect data from children.

SECURITY

All network traffic uses HTTPS / TLS. The AIProxy split-key model
means your device never holds the raw OpenAI key. iCloud sync uses
Apple's encrypted private database. No system is perfectly secure.

CHANGES

Material changes are announced in-app and reflected in the effective
date above.

CONTACT

Use the form below