Privacy Policy

Who is responsible

MindomaxHannover area, GermanyEmail: narcilium@gmail.comMindomax is a personal project, not a company. Write to the address above with any question about your data.

Account data

You sign in with Google or Apple, so we never see a password. From the sign-in we receive your email address and, if it is shared with us, your name. We need this to create your account and let you back in. Legal basis: Article 6(1)(b) GDPR — providing the service you asked for.

• Email address, which is what identifies your account
• Your name, if Google or Apple passes it on
• An internal user ID and the date you joined
• Your approximate location (country or region), which we determine from the IP address of your last sign-in. We use it to run the service in a suitable region and for usage statistics. Legal basis: Article 6(1)(f) GDPR. The IP address of your last sign-in is kept with your account and replaced at your next sign-in.

What you create and upload

Everything you make in Mindomax is stored so that you can come back to it. We use it to run the features you use and to show you your progress. Legal basis: Article 6(1)(b) GDPR.

• Flashcards, decks, notes and folders, with their text and images
• Files you upload, such as PDFs, images and audio
• Review results, streaks, medals and learning statistics
• Timers, to-do items and your app settings
• Your conversations with the AI tutor, and text you select and send for an explanation, a translation or cards (on the website, in the app, from the browser extension or with right-click on Mac)

Device and log data

To keep you signed in, show you your own devices and protect the service from misuse, we store technical data about each sign-in and keep short server logs. Legal basis: Article 6(1)(b) GDPR for the sessions and Article 6(1)(f) GDPR for security and abuse prevention.

• Device ID, device name and the app or browser version
• IP address, the time you signed in and the time you were last active
• Error and request logs, used to find faults and to apply fair-use limits

AI features and the providers behind them

Nothing is sent to an AI provider until you start an AI action. When you do, only what that feature needs is sent, and the provider processes it on our behalf as a processor. These are the providers:

• Google (Gemini): the text or file you give it, to generate cards, notes and explanations
• Runware: your prompt, to generate an image

Where your data is stored

Mindomax runs on servers rented from Hetzner in Germany. Files you upload are kept in Hetzner Object Storage in Germany.

Website, cookies and statistics

The website stores a small amount of data in your browser and measures how the pages are used.

• Sign-in and preference storage: needed for the site to work at all, for example to keep you signed in and to remember your language. Legal basis: Article 6(1)(b) GDPR.
• Google Analytics and Ahrefs Analytics: visit statistics, so that we can see which pages are used. Legal basis: your consent, Article 6(1)(a) GDPR — you can refuse it in the cookie banner and withdraw it at any time with “Cookie settings” at the bottom of this page.
• Cloudflare passes requests to our server and sees the IP address of each request. Legal basis: Article 6(1)(f) GDPR — keeping the site available and protected.

Who else sees your data

Apart from you, your data reaches only these parties, and only as far as they need it:

• Hetzner Online GmbH, Germany — servers and file storage
• Google and Runware — the AI features described above
• Google and Apple — the sign-in you choose; YouTube (Google) when you add a YouTube link
• Cloudflare — traffic to our website and to the servers our apps connect to
• Google Analytics and Ahrefs Analytics — the website statistics, only with your consent
• Other users — sets you publish in the library or share with them; and, for signed-in users, your display name and stars on the leaderboard if you are among the top learners. You can change the name at any time in the app settings or on your account page. Legal basis: Article 6(1)(b) GDPR.

Data outside the EU

Some recipients are based outside the EU/EEA, so your data can also be processed there. In the United States: Google (Gemini for the AI features, Google Analytics after your consent, Google sign-in, and YouTube when you add a YouTube link), Apple (Apple sign-in), Cloudflare (carries traffic to our website and to the servers our apps connect to) and Runware (image generation). In Singapore: Ahrefs (Ahrefs Analytics after your consent). Where a recipient is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Article 45 GDPR); otherwise it is based on the EU Standard Contractual Clauses (Article 46(2)(c) GDPR). You can request a copy of these safeguards at narcilium@gmail.com.

How long we keep things

We keep your data for as long as your account exists and delete it when you delete the account.

• Account, cards, notes and files: until you delete them or delete your account
• Sessions and devices: until you sign that device out or the session expires
• Logs: only as long as we need them to find faults and stop misuse, then deleted
• Backups: kept for a limited time and then overwritten; deleted data disappears from them when they are overwritten

Legal bases at a glance

We process your data on these grounds:

• Article 6(1)(b) GDPR — to provide your account and the features you use
• Article 6(1)(a) GDPR — your consent, for the website statistics; you can withdraw it at any time
• Article 6(1)(f) GDPR — our legitimate interest in keeping the service secure, available and free of abuse, in running it in a suitable region and in usage statistics

Required data and automated decisions

To have an account, you sign in with Google or Apple, which gives us your email address. Without it we cannot provide an account. Everything else you enter is optional and only needed for the feature that uses it; technical data such as your IP address is processed automatically when you use the service. We do not make decisions based solely on automated processing within the meaning of Article 22 GDPR.

Your rights

You can exercise any of these by writing to narcilium@gmail.com. We answer within the time limits set by the GDPR.

• Ask what data we hold about you (Article 15 GDPR)
• Have incorrect data corrected (Article 16 GDPR)
• Have your data deleted (Article 17 GDPR)
• Have the processing restricted (Article 18 GDPR)
• Receive your data in a portable format (Article 20 GDPR)
• Object to processing based on our legitimate interest (Article 21 GDPR)
• Withdraw a consent you have given, with effect from that moment on (Article 7(3) GDPR)
• Complain to a data protection supervisory authority, for example the one where you live, or the one responsible for us: the State Commissioner for Data Protection of Lower Saxony (LfD Niedersachsen) in Hanover (Article 77 GDPR)

Deleting your account

You can delete your account yourself in the app. Deletion removes both your database entries and the files you stored with us — cards, notes, uploads, annotations, statistics and sessions — and cannot be undone. Backups are kept for a limited time and then overwritten; the deleted data disappears from them when they are overwritten.

Children

Mindomax is not meant for children under 13. If you are under 16, please use it only with the agreement of a parent or guardian.

Changes to this policy

If we change the way we handle data, we update this page and the date at the top.

Contact

For any question about your data, write to narcilium@gmail.com.