Privacy Policy
version 2026-10-24
Last updated: 24 October 2026
Data controller: MINDIF AI LTD ("Mindif"), a company registered in the United Kingdom with its registered office at Unit 28-29, Nene Court, The Embankment, Wellingborough, NN8 1LD, United Kingdom. Website: www.mindif.co. Privacy contact: admin@mindif.co.
This notice is given under the Turkish Personal Data Protection Law (KVKK, Law No. 6698), the UK GDPR and, where it applies, the EU General Data Protection Regulation (GDPR). It is not legal or medical advice.
Your clean streaks, urge logs, urge intensities, trigger notes, relapse history and monetary savings are stored exclusively on your device in a local database (recovery.db WAL). This sensitive health information is never transmitted to Mindif servers and cannot be viewed by our team. Automatic operating-system cloud backups of this database are excluded. If you subscribe to Yeniden Plus, you may choose a manual backup in your own iCloud account (CloudKit); it is encrypted on your device with AES-GCM-256 before it leaves the app, and the key stays in your iCloud Keychain.
1. What we do not collect
We do not require your legal name. We do not sell or rent personal data. We do not use Apple's App Tracking Transparency prompt and we do not track you across apps or websites owned by other companies. Recovery journal entries, urges, triggers and relapse history are never written to our servers.
2. Advertising and consent
The free tier shows advertising through Google AdMob on Home, Progress, Resources and Community. Ads are non-personalized by default. In the EEA, the UK and regions covered by Google's consent framework, the app uses Google's User Messaging Platform (UMP) to ask for consent before any personalized ad request; if consent is refused, ads stay non-personalized. Apple SKAdNetwork is used for aggregate campaign attribution without identifying you. Yeniden Plus is ad-free. You can review or change your ad choice at any time in the app under Settings > Privacy options; withdrawing consent does not remove ads, it keeps them non-personalized.
3. Categories of data processed
| Category | Data fields | Storage | Legal basis |
|---|---|---|---|
| Recovery data (special category) | Clean days, urges, triggers, relapses, money saved. | Device only | Not sent to Mindif servers; included only in the optional encrypted Plus backup. |
| Account and session | Anonymous user ID, session tokens, optional verified email, signup ISO country. | Cloudflare D1 | Contract (account features); legitimate interest (security and abuse prevention). |
| Community profile | Masked display name, avatar colour, posts and replies. | Cloudflare D1 | Separate explicit consent (opt-in). |
| Purchases | Product ID, plan, entitlement and renewal status. We never receive your card details. | Apple App Store and RevenueCat | Contract (delivering Yeniden Plus). |
| Advertising | Ad request data and ad interaction handled by Google AdMob; non-personalized unless you consent. | Consent where required; otherwise legitimate interest in funding the free tier. | |
| Network and diagnostics | Session IP, Cloudflare request logs (user agent), FCM push token, signup ISO country. No GPS. | Server logs / D1 | Legitimate interest (security, routing official helplines). |
| Device permissions | Contacts (one SOS support person you pick) and photo library (one reason photo you attach). | Device only | Your OS-level consent; never uploaded to Mindif servers. |
4. Community — separate explicit consent
Joining the Community is optional: crisis helplines, the breathing flow and your on-device journal work without it. If you give separate explicit consent, we store your verified email, a masked display name, and your posts and replies. We do not store which habit room you joined or which habit you selected; the room is chosen on your device. A post is stored with the room category it was published in; that is content metadata, not a profile attribute. We do not store the recovery journal or urge logs there. Helplines stay usable without email verification. You can withdraw this consent at any time by deleting your account in Settings or by writing to admin@mindif.co.
5. Sub-processors
We do not sell data. The following providers process the minimum needed to run the service:
- Cloudflare Inc. (Workers, D1, request logs): hosting, encrypted database, network security, abuse prevention.
- Resend: transactional email for verification and password resets.
- Google Firebase (FCM): delivery of community moderation alerts; no marketing pushes.
- Google AdMob: advertising in the free tier, as described in section 2.
- RevenueCat: subscription entitlement checks for Yeniden Plus. It receives an app user ID and purchase state, never card data.
- OpenRouter (openrouter.ai): community posts and replies are screened and translated by a third-party AI model through OpenRouter before publication. Only the post title and text, the room habit and your language are sent. Your journal, urges and reasons are never sent, and nothing is used to train models. This happens only after you give separate Community consent.
6. International transfers
Some providers process data outside Turkey and the EEA, mainly in the United States. Transfers rely on the providers' standard contractual clauses and applicable adequacy decisions, and, where KVKK article 9 or GDPR Chapter V requires it, on your explicit consent given at signup or when you join the Community. You may withdraw that consent by deleting your account.
7. Refund requests
If you ask Apple for a refund, Apple may ask us for limited consumption information (for example account age, last activity and whether the purchased features were delivered) through the App Store Server API. We answer as Apple requires. We do not receive or store your payment card details.
8. Retention and deletion
Sessions are kept for at most one year. Anonymous accounts inactive for 90 days and push tokens not refreshed for 90 days are removed. Cloudflare request logs (IP address, user agent) are kept under Cloudflare's log retention settings for security and abuse prevention and are not used for profiling. Choosing Settings > Delete Account immediately and permanently wipes your user record, email, community profile, posts, sessions and device tokens from Cloudflare D1. Local device data is cleared separately through the app.
9. Security
Data is encrypted in transit with TLS. Cloudflare D1 is encrypted at rest. The optional Plus backup is encrypted on your device with AES-GCM-256 before upload, and the local PIN is derived with PBKDF2 and verified in the Secure Enclave or Android Keystore. We never hold payment card data.
10. Your rights
Under KVKK article 11 and the GDPR you may ask whether we process your data, and request access, rectification, erasure, restriction, portability or object to processing. Write to admin@mindif.co; we answer verified requests within 30 days. You may also complain to the Turkish Personal Data Protection Board (KVKK), the UK Information Commissioner's Office (ICO), or the supervisory authority in your country.
11. Children and changes
Yeniden is for adults aged 18 and over and we do not knowingly collect data from children. If we make a material change to this policy we publish the new version here and in the app, and update the version number above.
12. Cookies and tracking technologies
The app does not use browser cookies; it stores settings and session data locally on your device. The public website uses only essential cookies needed to serve the page. We do not run third-party advertising or analytics cookies on the website. We honour "Do Not Track" signals; because we do not track you across sites, no separate opt-out is needed beyond the ad consent described in section 2.
13. California privacy rights
If you are a California resident, the CCPA/CPRA gives you the right to know, delete, correct, opt out of the sale or sharing of personal information, limit the use of sensitive personal information, and not be discriminated against for exercising these rights. We do not sell personal information. We share data only with the service providers listed in section 5 under contract, and not for cross-context behavioural advertising; personalised ads run only with your consent. To exercise a right, email admin@mindif.co or use Settings. An authorised agent may submit a request with proof of authority; we verify requests before acting.
14. Business transfers and third-party links
If Mindif is merged, acquired or sells assets, personal data may transfer to the successor under this policy, and we will notify you before a new controller applies a materially different policy. The app links to official third-party resources (for example WHO, CDC or NHS). We do not control those sites and are not responsible for their content or privacy practices.
15. Exercising rights, EU representative and breaches
KVKK applications must state your name, address, email, telephone and the subject of your request, and may be sent from your registered email to admin@mindif.co; we answer within 30 days. If Article 27 GDPR applies to us, our EU representative's details are available on request at the same address. If a personal data breach is likely to result in a high risk to you, we notify you and the competent authority without undue delay where the law requires it.