Legal

Privacy Policy

Effective date: August 9, 2026

This Privacy Policy explains how MindQot ("MindQot", "we", "us", or "our") collects, uses, and shares information when you use the MindQot mobile application (the "App") and the website at https://mindqot.com. Please read it with our Terms of Service.

MindQot is operated by Anirudh Verma, an individual developer based in India. MindQot is intended for adults aged 18 and over (see section 12). It is offered worldwide, subject to app-store availability and any country-specific restrictions.

This policy has two parts: (1) global disclosures that apply to everyone, and (2) regional supplements (section 16) that add rights and information for people in certain regions.

Part 1 — Global disclosures

1. Who we are

The controller responsible for your personal data is Anirudh Verma. Contact: see section 2.

2. How to contact us about privacy

For any privacy question or request, contact mindqot.support@gmail.com. This is our privacy point of contact. Where a region requires an additional local contact or representative, it is listed in the relevant regional supplement (section 16).

3. Information you provide to us

Email address — to create and secure your account.
Display name — optional, shown in the App where applicable.
Account information — the credentials and profile record for your MindQot account.
Onboarding goals and preferences — the learning goals you select and your chosen reading depth.
Notification preferences — whether notifications are enabled, your preferred daily delivery time, and frequency.

4. Information generated through your use of the App

Learning progress — active path, current day, completed days.
Daily briefing activity — the daily card assigned to you and its status (scheduled, opened, completed).
Card interactions — when you open a card, the depth selected, and when you complete an "Apply Today" action.
Streak and progress state — streak count and total completed briefings.
Timezone — your device timezone (e.g. Asia/Kolkata), to schedule your briefing at your chosen local time.

5. Device and notification information

Push notification token (FCM registration token) — lets us deliver your daily briefing.
Platform and device registration data — device platform, whether notifications are enabled on that device, and last token-refresh/last-seen times.

Your push token is stored only in your own device records, is never shared publicly, and is removed automatically if it becomes invalid.

6. Service providers we use

MindQot is built on Google Firebase. The Firebase services active in the current production App are below. Google provides these Firebase services and processes data in connection with them under Google's own applicable terms and privacy documentation (including Firebase Privacy and Security). Google's role can vary by service and region.

Firebase Authentication — manages sign-in; stores your email and a secure credential; may process technical data (e.g. IP address, user agent) to secure sign-in and prevent abuse.
Firestore — stores the account, preference, and activity data in sections 3–5 in Google's cloud.
Firebase Cloud Messaging — delivers push notifications using the token in section 5.
Firebase Crashlytics — collects crash and diagnostic data (stack traces, error state) and device/app information required for diagnostics (device model, OS version, app version, memory/storage, a Crashlytics installation identifier). Per Google's current documentation, Crashlytics keeps this data for 90 days, after which Google begins removing it from its live and backup systems.
Firebase App Check (Google Play Integrity) — protects our backend from abuse; on supported Android release builds it uses the Google Play Integrity API, which evaluates app/device integrity signals through Google.
Firebase Remote Config — manages feature configuration; may process a Firebase installation identifier.

We do not use Firebase Analytics (auto-collection is disabled) and do not use any other third-party analytics or crash-reporting service beyond Firebase Crashlytics. We do not sell your personal data, do not share it for cross-context behavioural advertising, and do not use it for targeted advertising.

7. Payments and subscriptions (not currently active)

MindQot may offer paid subscriptions in the future. The App contains integration groundwork for the subscription providers RevenueCat and Superwall, but these are not enabled in the current production configuration and do not currently process user data. If paid subscriptions become available, we will update this policy first, and purchases will be handled through your app store (e.g. Google Play), whose terms and privacy practices will apply.

8. Why we process your information

To create/secure/operate your account; deliver your daily briefing at your chosen time and depth; track and display progress and streaks; send notifications you enable; keep the App stable and secure (crash diagnostics, abuse prevention); and respond to support and privacy requests. The legal bases that apply in the EEA/UK are described in section 16.

9. Data security

We use technical and organisational safeguards appropriate to the nature of the information we process, relying on the security features of the Google Firebase platform. Data in transit between the App and our backend is protected using encryption supported by that platform, and account credentials are handled by Firebase Authentication and are not stored by us in plain text. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Data retention

We retain your account and activity data for as long as your account exists. When you delete your account (section 11), we delete the associated data listed in 11.1. Some data processed through the Firebase services is retained and removed on Google's own schedules, which we do not control (for example, Crashlytics data is kept for 90 days as described in section 6). Except where an official service-provider source states a specific period, we do not state fixed retention periods in this policy.

11. Account deletion

Delete your account and its data any time:

In the App: Settings → Delete Account.
From the web: follow https://mindqot.com/delete-account (no need to reinstall or open the App).

11.1 What deleting your account removes

The current implementation removes: your Firebase Authentication account; your user profile and all subcollections, including device and push-token records; your daily briefing records; your learning-path progress; your card interactions; your notification logs; and any subscription mirror / subscription-webhook records, where present. Shared, non-personal content (wisdom cards, learning-path definitions) is not deleted, as it is not your personal data.

11.2 What may remain after deletion

Crash/diagnostic data already collected by Crashlytics is kept by Google for 90 days before Google begins removing it (section 6).
Records held by Google as part of the Firebase services (e.g. authentication and messaging records) are retained and removed on Google's own schedules; we do not control those schedules and do not represent that all such records are removed on a fixed timeline following your deletion.
Operational and security logs may be kept for a period to run the Service reliably and prevent abuse; some entries may include identifiers such as your account identifier. These are separate from the account record deleted above.

12. Children and intended audience

MindQot is intended for users aged 18 and over, is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe someone under 18 provided us data, contact mindqot.support@gmail.com.

13. Automated decision-making and personalization

MindQot selects and personalizes the learning content you see (for example, based on the goals you choose). This is a straightforward content-recommendation feature. We do not make decisions producing legal or similarly significant effects about you solely by automated means (no automated decision-making of the kind addressed by GDPR Article 22).

14. Your choices

You can edit many details in the App, delete your account (section 11), and control notifications through your device settings. Region-specific rights are in section 16. Contact mindqot.support@gmail.com to make a request; we may need to verify your identity first.

15. Changes to this policy

We may update this policy. We will revise the "Effective date" and, for material changes, provide notice through the App or by other appropriate means. Where applicable law requires your consent for a change, we will seek it before that change applies to you, and we will not treat your continued use of the App, by itself, as acceptance of a materially changed privacy practice where the law requires consent.

Part 2 — Regional supplements (section 16)

These apply in addition to Part 1 for people in the regions named. Where MindQot is not actually made available in a region, that supplement may not be relevant.

16.1 EEA / European Union

Controller: Anirudh Verma.
Legal bases (GDPR Art. 6): performance of your contract (providing the account, progress, briefings, notifications); our legitimate interests (security, stability, abuse prevention, crash diagnostics); legal obligation (handling rights requests); and your consent where required (e.g. device-notification permission).
Your rights: access, rectification, erasure, restriction, objection, data portability, and to withdraw consent where processing is based on consent. You may lodge a complaint with your local supervisory authority (the data-protection authority in your EU/EEA country).
International transfers: your data may be processed by Google and accessed by the operator in India, which does not have an EU adequacy decision. Transfers of this kind require an appropriate safeguard (such as the European Commission's Standard Contractual Clauses); we will put the applicable transfer mechanism in place and confirm it before MindQot is offered in the EEA.
To exercise rights: mindqot.support@gmail.com.

16.2 United Kingdom

Same rights and bases as 16.1 under the UK GDPR and Data Protection Act 2018.
You may complain to the Information Commissioner's Office (ICO). Transfers to India require an appropriate UK transfer mechanism (such as the UK IDTA or Addendum); we will confirm the applicable mechanism before MindQot is offered in the UK.

16.3 United States

We do not sell or share your personal information, and do not use it for targeted advertising. Where a US state privacy law grants you rights (such as access, deletion, or correction) and applies to us, we will honor those rights. Contact mindqot.support@gmail.com.

16.4 Canada

We handle personal information under applicable Canadian privacy law (including PIPEDA and, for Quebec residents, Law 25). You may request access or correction and may contact our privacy contact; Quebec residents may contact the person responsible for privacy at mindqot.support@gmail.com.

16.5 Australia / New Zealand

We handle personal information consistent with the Australian Privacy Principles / the New Zealand Privacy Act 2020 where they apply, including limits on overseas disclosure. You may request access/correction via mindqot.support@gmail.com and complain to the OAIC (Australia) or the Office of the Privacy Commissioner (New Zealand).

16.6 Brazil

We process personal data consistent with the LGPD where it applies, on an applicable legal basis, and honor data-subject rights. Contact: mindqot.support@gmail.com.

16.7 India

We process personal data consistent with the Digital Personal Data Protection Act, 2023 and its Rules as their provisions come into force. You may contact mindqot.support@gmail.com regarding your personal data.

16.8 Other regions

Where another region's law applies to MindQot, we will honor the rights it grants. Contact mindqot.support@gmail.com.