slowmind

Privacy Policy

Last updated: 22 July 2026

The short version. We collect what we need to run SlowMind for you: your account details, your test answers and results, and basic technical data. Your answers are used to generate your personal readings — including through AI providers acting under contract for us. We don't sell your data, we don't show ads, and you can delete your account and its data from inside the app at any time.

1. Who is responsible for your data

This Privacy Policy explains how Slow Mind, MB ("SlowMind", "we", "us"), the data controller, handles your personal data when you use the SlowMind mobile app, the web app at app.slowmind.app, the website slowmind.app, or contact us.

Controller: Slow Mind, MB
Registered address: Burbiškių g. 6-59, LT-03164 Vilnius, Lithuania
Company code: 307673657
Privacy contact: privacy@slowmind.app (general support: info@slowmind.app)

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data-protection laws. If you do not agree with this Policy, please do not use the Service.

2. What we collect, why, and for how long

2.1 Your account

Data	Email address; name (as you enter it, or as provided by Google or Apple sign-in); authentication identifiers; account creation date.
Purpose	Creating and securing your account, signing you in, syncing your content across your devices.
Legal basis	Contract (GDPR Art. 6(1)(b)).
Retention	Until you delete your account. Deletion removes your profile and personal content from our production systems; residual copies in encrypted backups expire on the backup cycle.

2.2 Onboarding, tests, and results

Data	Your onboarding questionnaire choices; your test answers; the trait scores computed from them (for example five-factor percentiles, emotional-intelligence dimensions, Enneagram type, attachment pattern, values ranking); which test was recommended to you.
Purpose	Scoring your tests, generating your personal readings and insights, recommending courses, remembering your progress so it survives logging out and switching devices.
Legal basis	Contract (Art. 6(1)(b)) — this processing is the core of the Service you sign up for. To the extent test answers may reveal information about your psychological characteristics, we process them on the basis of your explicit consent given when you choose to take a test (Art. 9(2)(a)); you can delete your results and account at any time.
Retention	Until you retake the test (which replaces earlier answers) or delete your account.

2.3 AI-generated readings and insights

Your readings and insights are generated by large-language-model providers processing data on our behalf. Here is exactly how that works:

We send the AI provider your computed trait scores (numbers and category labels) — not your name, email address, or account identifiers.
The generated reading is stored in your account so you can revisit it.
To keep the Service fast and efficient, a generated reading may be reused for another user whose computed scores are materially identical. What is reused contains only the text generated from those scores — never any information identifying you.
Our AI providers are bound by data-processing agreements and do not use the data we send to train their models.

Readings are reflective content, not decisions about you: no automated decision-making with legal or similarly significant effects (GDPR Art. 22) takes place in the Service.

2.4 Courses, saved content, and downloads

Data	Course and session progress; insights and result cards you like or save; sessions you download (the audio itself is stored on your device).
Purpose	Playing your courses, remembering where you left off, keeping your library in sync.
Legal basis	Contract (Art. 6(1)(b)).
Retention	Until you remove the item or delete your account. Downloads live on your device and disappear when you remove them or uninstall the App.

2.5 Purchases and subscription status

Data	Your subscription/entitlement status, product identifiers, purchase and expiry dates, store (Apple/Google), and a pseudonymous app-user identifier. We never receive your card number or full payment details — payments are processed entirely by Apple or Google.
Purpose	Unlocking the content you paid for, restoring purchases, handling entitlement changes.
Legal basis	Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for accounting records where applicable.
Retention	While your account exists; transaction records as required by tax and accounting law (typically up to 10 years).

2.6 Technical and usage data

Data	Device type and operating system, app version, language, IP address (transiently, for connections), crash and performance logs, and aggregated usage events (for example which screens are used) via Firebase Analytics.
Purpose	Keeping the Service secure and working, fixing bugs, understanding — in aggregate — how the app is used so we can improve it.
Legal basis	Legitimate interests (Art. 6(1)(f)) in operating, securing, and improving the Service; consent where required for analytics identifiers by local law.
Retention	Logs and analytics data are retained for limited periods (typically 1–14 months depending on the log type) and then deleted or aggregated.

2.7 Support and correspondence

Data	Your email address, the content of your messages, and related account context needed to help you.
Purpose	Answering questions, resolving complaints, exercising your rights.
Legal basis	Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) for keeping records of how issues were resolved.
Retention	Up to 3 years after the matter is closed, unless a longer period is required for legal claims.

3. Where your data comes from

We collect data directly from you (account creation, answers, saved content, messages), automatically from your use of the Service (technical and usage data), and from the app stores and our billing provider (purchase and entitlement events). We do not buy data about you, and we do not collect data about you from data brokers or public profiles.

4. Who we share data with

We never sell your personal data, and we do not share it with advertisers. We share data only with service providers who process it on our behalf under data-processing agreements, or with independent controllers where the law provides for it:

Recipient	Role	What and why
Google Cloud / Firebase (Authentication, Realtime Database, Cloud Storage, Cloud Functions, Hosting, Analytics)	Processor	Hosting and running the Service: accounts, your content, audio delivery, server logic, crash/usage analytics. Primary data storage is in the EU (europe-west1, Belgium); some processing (server functions, analytics) occurs in the United States.
AI providers — Anthropic (Claude) and Google (Gemini)	Processor	Generating your readings and insights from computed trait scores, as described in Section 2.3. No name or contact data is included in requests.
RevenueCat, Inc.	Processor	Managing subscription entitlements across platforms (pseudonymous user ID and purchase status; no payment card data).
Apple / Google	Independent controllers	App distribution, payment processing, and refunds under their own terms and privacy policies.
Authorities, courts, advisers	Independent controllers	Only where required by law, to defend legal claims, or to prevent fraud or abuse.

In the event of a merger, acquisition, or asset sale, personal data may be transferred as part of the transaction; we will notify you before your data becomes subject to a different privacy policy.

5. International transfers

Your data is primarily stored in the European Economic Area. Where processing takes place outside the EEA (for example US-based cloud functions, AI providers, or RevenueCat), we ensure an adequate level of protection through: European Commission adequacy decisions (including the EU–US Data Privacy Framework for certified US providers), the European Commission's Standard Contractual Clauses supplemented by transfer impact assessments, and technical safeguards such as encryption in transit and at rest.

6. How we protect your data

Encryption in transit (TLS) and at rest on our cloud infrastructure;
Per-user access rules on the database — your content is readable only by your authenticated account;
Server-side security rules validated and reviewed; internal access to production data limited to what operating the Service requires;
No payment card data ever touches our systems;
Regular review of dependencies, security rules, and logs. Prompts sent to AI providers exclude identifying data by design.

No system is perfectly secure. Please use a strong, unique password and keep your device protected. If a data breach affecting your rights occurs, we will notify you and the supervisory authority as required by GDPR Articles 33–34.

7. Your rights

Under the GDPR (and equivalent laws), you have the right to:

Access — obtain a copy of the personal data we hold about you (Art. 15);
Rectification — correct inaccurate or incomplete data (Art. 16);
Erasure — delete your data ("right to be forgotten", Art. 17). The fastest way is deleting your account in the App (Profile → My account); you can also email us;
Restriction of processing in the situations set out in Art. 18;
Portability — receive your data in a structured, machine-readable format (Art. 20);
Objection — object to processing based on legitimate interests (Art. 21);
Withdraw consent at any time, without affecting prior processing (Art. 7(3));
Complain — to your local supervisory authority or to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).

To exercise any right, email privacy@slowmind.app from the address linked to your account (we may ask you to verify your identity). We respond within one month; for complex requests we may extend by a further two months with an explanation. Exercising your rights is free of charge unless requests are manifestly unfounded or excessive.

8. Children

The Service is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it promptly.

9. Cookies and the website

The slowmind.app website is a static informational site. It sets no advertising or cross-site tracking cookies. The web app at app.slowmind.app uses only the technical storage required for you to stay signed in and for the app to function (authentication tokens, local caches). Fonts on the website are served by Google Fonts, which involves a technical request (your IP address) to Google's servers.

10. Regional notes

United Kingdom

If you are in the UK, the rights above apply under the UK GDPR and the Data Protection Act 2018. Transfers from the UK are safeguarded by adequacy regulations, the UK IDTA, or the UK Addendum to the EU SCCs. You may complain to the Information Commissioner's Office (ico.org.uk).

United States

Depending on your state (for example under the CCPA/CPRA in California), you may have rights to know, access, correct, delete, and port your personal information, and to opt out of "sales" or "sharing" of personal information. We do not sell or share your personal information for cross-context behavioural advertising, and we do not use it for targeted advertising or profiling with significant effects. You may exercise your rights via privacy@slowmind.app; we do not discriminate against you for doing so.

Other jurisdictions

Where local law grants you additional rights (for example in Australia, Canada, or Brazil), we honour them on request through the same contact.

11. Changes to this Policy

We may update this Policy from time to time. The current version, with its "Last updated" date, is always available at slowmind.app/privacy.html. For material changes we will give notice in the App or by email before they take effect.

12. Contact

Privacy requests: privacy@slowmind.app
General support: info@slowmind.app
Controller: Slow Mind, MB, Burbiškių g. 6-59, LT-03164 Vilnius, Lithuania, company code 307673657