Privacy Policy

1. Controller

myndfree – Luis Brummer
c/o Online-Impressum 12612, Europaring 90, 53757 Sankt Augustin, Germany
Email: info@myndfree.com

2. Principle: your data stays on your device

Myndfree stores appointments, tasks, habits, places, shopping lists and settings only locally on your iPhone (encrypted by iOS). If you back up your iPhone to iCloud or export a backup, it also contains a copy of your Myndfree data – without health and cycle data. The automatic backup to iCloud Drive (on by default, can be turned off under Settings → General → Backup) saves a backup file once a day in the "Myndfree" folder of your own iCloud Drive (the last 14 days); with "Save as file" you yourself save a file in a folder of your choice. Neither contains cycle, sick-day or health data or access credentials, and Myndfree does not encrypt them additionally; in iCloud, Apple protects them like your other files (see 6). We do not run a server on which this content is stored, and we have no access to it. An optional account (see 10d) only holds sign-in and subscription details, never calendar content.

3. Which data is processed – and why

4. AI features (Claude by Anthropic)

Only if you enable the AI features is the sentence you speak or type sent via our relay server (Cloudflare, see 5) to Anthropic PBC, 548 Market St, San Francisco, USA, so it can be understood. So that the AI understands your wish and can operate the app for you (e.g. "move the dentist to Friday"), the necessary context is sent along: titles and times of your appointments, tasks and habits for the next few days and the names of your lists and places; sensitive terms in your entries (e.g. doctor, therapy, clinic) are automatically replaced with "private" beforehand. Data from Apple Health and your cycle data are never sent. What you write in your sentence yourself (e.g. "dentist tomorrow at 10") goes to the AI as is – Myndfree replaces cycle words with placeholders beforehand.

• A data processing agreement with Anthropic is in place (Art. 28 GDPR). [check/conclude]
• Transfer to the USA on the basis of [the EU-US Data Privacy Framework, if Anthropic is certified / the EU Standard Contractual Clauses]. [check]
• According to Anthropic, data sent via the API is not used to train the models by default. Retention at Anthropic: inputs and outputs are deleted automatically no later than 30 days after receipt; only if Anthropic's automated safety review detects a breach of the usage policies, up to 2 years (as of October 2026, privacy.claude.com – check again before publication).
• You are talking to an AI: The assistant is labelled as an AI (Claude by Anthropic); entries, answers and reschedulings recognised by the AI are marked as AI results in the app (transparency obligation under Art. 50 EU AI Act). AI can be wrong – check the results.
• The AI makes no decisions with legal or similarly significant effect for you (no automated decision within the meaning of Art. 22 GDPR); it only suggests entries and reschedulings in your own calendar.
• Known sensitive terms are replaced first – not every health detail in a freely worded sentence is reliably detected.
• You can switch off the AI features at any time under Settings → About → Privacy & Permissions; the app then keeps working with a simple offline recognition.

5. Relay server (Cloudflare)

For AI requests and the Notion sign-in we use a server from Cloudflare, Inc., 101 Townsend St, San Francisco, USA. Using the subscription confirmation signed by Apple, it checks whether a subscription or the trial is active [planned in addition: Apple App Attest, to check that the request comes from the real app], counts requests (limits) and forwards the request to Anthropic. For the Notion sign-in it exchanges the one-time sign-in code with Notion for the access key and passes it directly to the app without storing it. No content is stored there; only a pseudonymous counter (requests per month) is stored, for at most [30] days after the end of the month. If you buy an AI add-on pack, the pseudonymous credit (remaining requests) and Apple's transaction number for the purchase are also stored, so that each purchase is credited exactly once – for as long as credit remains, or for the statutory retention periods. Data processing agreement and transfer basis: [check].

The pseudonymous identifier is the original transaction number of your subscription at Apple – the server knows neither your name nor your Apple ID. Old counters are deleted automatically every day (counters about 30 days after the end of the month, purchase numbers after about 13 months, used-up credit immediately). You can have the server data deleted by email (any remaining credit from add-on packs then expires).

5a. Storage on your device ("cookies", § 25 TDDDG)

Myndfree sets no cookies, uses no advertising ID (IDFA) and no tracking. Only what is strictly necessary for the features you use is stored on your iPhone (§ 25(2) No. 2 TDDDG): your app data and settings, a random device identifier in the keychain (only for the AI allowance), counters for AI requests and add-on packs, and technical caches (e.g. travel times). No consent is required for this. Anonymous analysis only takes place if you expressly switch it on (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

5b. Recipients and transfers to third countries

Depending on the feature you use, recipients of your data are Apple Distribution International (Ireland) or Apple Inc. (USA), Anthropic PBC (USA, only with AI consent), Cloudflare, Inc. (USA, relay server and website), Notion Labs, Inc. (USA, only if connected), Supabase, Inc. (USA, servers in Frankfurt; waitlist, community wishes and account), Resend, Inc. (USA, sending emails) and Google Ireland Limited or Google LLC (USA, only if you choose "Sign in with Google"). Transfers to the USA are based on the adequacy decision for the EU-US Data Privacy Framework (for certified companies) or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). [Check the certification status of Anthropic, Cloudflare, Notion, Supabase, Resend and Google before publication and enter it here.]

5c. Obligation to provide data

You are under no legal or contractual obligation to provide data. Without calendar, location or Health access, only the respective features do not work; the app remains usable.

5d. Security (Art. 32 GDPR)

Encrypted storage by iOS, access credentials only in this device's keychain, encrypted connections only (TLS), verification of Apple's signature on every subscription confirmation on the server, limits on the number and size of requests, no logging of content, automated tests before every version.

6. Apple

Purchasing and managing the subscription, speech recognition, route calculation (Apple Maps), iCloud storage and health data (Apple Health) are handled by Apple services. Apple's privacy policy also applies. We do not receive any payment data.

6a. Subscription, trial & AI allowance

The 7-day trial is part of the subscription through Apple. Without an active subscription the app is locked after the trial; your data stays stored and can be exported. To keep to the AI allowance (Myndfree Minimum and trial: 300 requests per month, Myndfree Pro: 1,000 per month, no daily limit), the number of your AI requests is counted [currently on the device; once the relay server is introduced, pseudonymously there, see 5]. If the monthly allowance is used up, you can buy an AI add-on pack (300 requests, €2.99) through Apple. Purchased requests do not expire and are only used once the monthly allowance is empty; unused requests from the subscription expire at the end of the month.

6a2. Statistics & daily review

For the statistics, Myndfree stores only on your iPhone what actually took place (appointments, journeys, completed habits and tasks and your answers in the evening daily review), for at most about 13 months. Sleep in the statistics is read from Apple Health, only displayed and not stored; it is never sent to the AI. If you ask the AI a question about your statistics, only summarised hours per category are sent along (Art. 6(1)(a) GDPR, consent to the AI features).

6b. Widgets & notifications

For widgets, your next appointments are stored in a protected app group storage on your iPhone (excluded from the iCloud backup). On the lock screen, sensitive titles are replaced with "private" by default.

6c. Not a medical device

The stress value calculated from Apple Health is a guide value for planning and not a medical diagnosis. The same applies to the estimated cycle phases (see 6d) – they are not suitable for contraception.

6d. Cycle-aware planning (voluntary, off by default)

Only if you switch the feature on yourself under Settings → Cycle-aware planning and give your explicit consent (Art. 9(2)(a) GDPR) does Myndfree process information about your cycle: the start and end of your period (entered, by voice or – only at the push of a button – read from Apple Health), your own information on cycle length, the phases in which you want more recovery, your permissions (which habit categories and task lists may be adjusted) and – only if you enter them – energy, mood and symptoms.

• Purpose: On the days you choose, Myndfree plans permitted habits shorter and moves demanding tasks to other days before their deadline. Appointments, deadlines, meals, sleep and everything you fix yourself stay unchanged. Every adjustment is explained and can be undone.
• Storage location: only on your iPhone, in a separate file encrypted by iOS that is not included in the iCloud/device backup or in Myndfree's backups. You can export it before changing devices.
• No transfer: to us, to the AI (Anthropic), to the relay server (Cloudflare), to connected calendars, Reminders, Notion or other apps. Sentences with which you enter the start or end of your period are processed by the app without AI; in all other sentences it replaces cycle words with placeholders before the AI request and only puts them back on the iPhone. Spoken sentences are converted to text by Apple's speech recognition – like any voice input – directly on the iPhone where possible (see section 3, microphone). The app's calendar only shows a neutral "Recovery day"; nothing of it appears in the widget or on the lock screen.
• Retention: until you delete it; energy, mood and symptom entries (only asked for if you switch on the matching option) are deleted automatically after 13 months. If you switch the feature off and keep the data, you can still export and delete it.
• No diagnosis: The phases are a simple estimate from your entries – not a medical statement and not suitable for contraception.
• Withdrawal, export, deletion: at any time in the cycle section (switching off = withdrawal with effect for the future, optionally deleting the data; "Delete all cycle data"; export as a file). "Delete all data" also removes the cycle data.

6e. Test phase (TestFlight)

If you test Myndfree before launch via Apple's TestFlight, you can additionally – voluntarily, with its own switch under Settings → About → Privacy & Permissions, off by default – share voice commands to help improve the app:

• What: your spoken sentence as text (no audio), what the app made of it (actions, reply, shortened AI response), whether you mark it as "misunderstood" and what you meant, the app version, the language, the time rounded to the full hour, and counters of how often you used which feature in the last 4 weeks (without titles, places or times). No location, no device, subscription or account identifier.
• Protection: known health and cycle words are replaced with "private" beforehand. Not every sensitive detail is reliably detected, and names in your sentences remain – that is why we also ask for explicit consent for health information (Art. 9(2)(a) GDPR).
• Where: the sentences stay only on your iPhone (at most 300 sentences or 90 days, not in backups), and you see them in full beforehand. They only reach us if you share the file (e.g. by email to info@myndfree.com or AirDrop). Your email provider processes that message like any other email.
• Purpose: to improve Myndfree's speech understanding and planning. For our automated speech checks we only use sentences in which names and personal details have been replaced; these anonymised sentences are processed by the AI as described in section 4. No disclosure to third parties, no sale, no training of third-party AI models.
• Retention: we store received files only locally on the Myndfree team's computer (not in a cloud) and delete them after analysis, at the latest 6 months after the end of the test phase. Anonymised test sentences without personal reference may be kept longer.
• Withdrawal: switch off = no new sentences, the stored ones are deleted from the iPhone immediately. We delete files you already shared on request to info@myndfree.com.
• TestFlight itself: Apple provides us with crash reports and the feedback you send in TestFlight (with your name/email address if you were invited by email). Apple's TestFlight terms and privacy policy apply.
• Later, not now: automatic sending without a share step will only come after a separate review (server in the EU, data processing agreement) and an update of this policy.

7. No tracking, no advertising

Myndfree uses no advertising or tracking services and does not pass on any data to third parties for advertising purposes.

8. Retention

Data on your device stays until you delete it. Deleted entries remain in the app's trash for 30 days; automatic backups on the iPhone are kept for as long as you set under Settings → General → Backup, those in iCloud Drive for the last 14 days. Test-phase sentences stay on the iPhone for at most 90 days (see 6e). Under Settings → About → Privacy & Permissions → Delete all data you remove everything immediately – including backups (also those in iCloud Drive), test-phase sentences, cycle data, AI and Notion access, widget data and scheduled notifications.

9. Your rights

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20 – export under Settings → About → Privacy & Permissions → Export my data; cycle data separately under Settings → Cycle-aware planning), objection (Art. 21) and withdrawal of consent given (Art. 7(3)) with effect for the future. Right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany. Requests about your rights to info@myndfree.com – since your content is only on your iPhone, you can exercise most rights directly in the app (export, delete). If you have an account, you export and delete the account data at https://myndfree.com/en/account or in the app.

10. Children

Myndfree is for people aged 16 and over. In the introduction you confirm that you are at least 16 – only this answer and its date are stored on your iPhone, no date of birth. Younger people may not use Myndfree.

10a. Website

For myndfree.com: no cookies except technically necessary security cookies from Cloudflare and – only if you sign in – the sign-in cookies (see 10d), no analytics services, no fonts or content embedded from third-party servers (no connection to Google unless you choose "Sign in with Google" yourself). The website is delivered via Cloudflare Pages (Cloudflare, Inc., USA). When you visit it, Cloudflare processes technically necessary connection data (IP address, time, page visited, browser) to deliver the site and fend off attacks (Art. 6(1)(f) GDPR).

10b. Waitlist and emails

If you join the waitlist on myndfree.com, we store your email address, the chosen language and the times of sign-up and confirmation – nothing else.

• Double opt-in: You receive an email with a confirmation link. Only once you confirm are you on the list. We delete unconfirmed sign-ups automatically after 7 days.
• Purpose: We inform you about the launch of Myndfree, new features and news about Myndfree (Art. 6(1)(a) GDPR, your consent). We store the times as proof of your consent (Art. 7(1) GDPR).
• Unsubscribe: at any time via the link in every email or by email to info@myndfree.com. Your address is then deleted.
• Service providers: storage at Supabase (Supabase, Inc., USA; servers in Frankfurt am Main, EU), sending via Resend (Resend, Inc., USA). A data processing agreement is in place with both (Art. 28 GDPR). [conclude] Transfers to the USA only on the basis of the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. [check certification]
• Protection against misuse: We use Cloudflare Turnstile to prevent automated sign-ups. It checks technical characteristics of your browser without cookies (Art. 6(1)(f) GDPR – legitimate interest in a waitlist free of misuse).
• Access: Only the provider has access to the list, via a secured admin area (sign-in with a one-time code).

10c. Community wishes

If you send us a wish on myndfree.com/en/community, we store your text (title, description), the chosen area, the language and the time – and, only if you provide it, your email address.

• Purpose: We evaluate wishes to develop Myndfree further and show reviewed wishes with their status publicly on the website (Art. 6(1)(f) GDPR – legitimate interest in developing the app in exchange with the community). We use the email address only to reply to your wish (Art. 6(1)(a) GDPR).
• Publication: Only the wish itself appears publicly – never your email address. Before publishing, we review the text and remove personal details.
• Retention: until you request deletion or the wish is done or rejected and we no longer need it. Deletion at any time by email to info@myndfree.com.
• Service providers and protection against misuse: as for the waitlist (Supabase, servers in Frankfurt; Cloudflare Turnstile).

10d. Account

To use Myndfree you sign in with Apple, Google or an email code – in the app (introduction or Settings → Account) or on myndfree.com. Until the encrypted backup is available, you can still skip signing in within the app. For the account we process the following (Art. 6(1)(b) GDPR – the account is part of using Myndfree):

• Stored: your email address, the sign-in method (Apple, Google or email code), the times of creation and last sign-in and a random account identifier. We never store calendar content, health or cycle data in the account.
• Sign in with Apple: Apple sends an identifier and your email address – or, if you choose "Hide My Email", a forwarding address from Apple – and, only the first time and only if you share it, your name. In the app we only request your email address. [check: whether the name is stored on the website]
• Sign in with Google: You are redirected to Google (Google Ireland Limited). Google sends an identifier, your email address and your name and profile picture address, as far as they are set in your Google account. [check: request email only]
• Signing in with an email code: We send you a 6-digit code and a sign-in button (sent via Resend). The code is valid for 10 minutes and only once.
• In the app: the sign-in (access token) is stored only in your iPhone's keychain ("this device only", not in backups).
• Security log: Supabase logs sign-ins (time, IP address, browser) to detect misuse (Art. 6(1)(f) GDPR – legitimate interest in secure accounts). [check and enter Supabase's retention period] To prevent codes from being guessed and emails from being flooded, we count code entries and sign-in emails per address; for this we only store a non-reversible check value of the address (hash), for at most 1 day. Accounts whose code was never entered are deleted after 1 day.
• Cookies: When you are signed in, myndfree.com sets two technically necessary cookies that keep you signed in (up to 30 days, or until you sign out), and during "Sign in with Apple/Google" one cookie for at most 10 minutes to protect against forged sign-ins. Scripts cannot read them and they are not used for tracking (§ 25(2) No. 2 TDDDG, no consent required).
• Link to your subscription: When you sign in in the app, our relay server (see 5) links Apple's pseudonymous subscription number to your account identifier and stores the plan, status and expiry date that Apple reports to it (App Store Server Notifications). When you buy with an account, the app passes the random account identifier to Apple so that Apple assigns the purchase to your account. A subscription always belongs to exactly one account.
• Service providers: Supabase, Inc. (account and sign-in; servers in Frankfurt am Main, EU), Resend, Inc. (sending emails), Cloudflare, Inc. (website and relay server). A data processing agreement is in place with all of them (Art. 28 GDPR). [conclude] For signing in with Apple or Google, their privacy policies also apply.
• Retention and deletion: until you delete the account – at any time in the app or at https://myndfree.com/en/account ("Delete Account"). The account and the subscription link are then deleted immediately; if you signed in with Apple, we also revoke the authorisation with Apple [in the app; on the website, additionally in your iPhone settings → Apple Account → "Sign in with Apple"]. Your Apple subscription continues and stays usable in the app; you can only cancel it in your Apple account settings.
• Export: at https://myndfree.com/en/account → "Export My Data" (a file with all account details, subscription status, waitlist entry and community wishes for your address).

11. Changes

We update this policy when the app changes. You can find the current version in the app and at https://myndfree.com/en/privacy.