Privacy Policy

Effective date: October 12, 2026

MindMaven (the "Service") is a personal development app for setting goals, journaling, and getting AI coaching. It is operated by Thordin AI LLC ("Thordin AI," "we," "us," or "our"), a U.S. company. This Privacy Policy explains what personal information we collect through the Service, how we use and share it, and the choices and rights you have.

Users in the EEA, UK, and Switzerland: see the section "Notice to users in Europe" below for additional information, including the legal bases we rely on and your rights.

U.S. state residents: see "U.S. state privacy rights" below.

Personal information we collect

Information you give us

• Account data: your name and email address from sign-up, and your account password or the sign-in method you choose. Sign-in is handled by our platform provider (see "How we share your information").
• Profile data: your profile picture (if you upload one) and time zone.
• Goals and progress: goals, descriptions, categories, target dates, milestones, progress, and check-in schedules.
• Journal entries: what you write in your journal, including text you dictate by voice.
• AI conversations: what you send to the AI Coach and Goal Coach, and the responses generated for you.
• Study material: text or audio you add to Study Hub, and the summaries and lectures generated from it.
• Profile and community content: your @username, posts, images, comments, likes, challenges you create or join and your daily check-ins, cheers and nudges, and friend requests.
• Messages: direct messages and message requests you send to other members.
• Notifications: records of activity involving you, such as friend requests, message requests, likes on your posts, and challenge invites.
• Payment data: if you subscribe to Premium, your payment card details are collected and processed directly by Stripe. We do not see or store your full card number. We receive your subscription status and Stripe customer and subscription identifiers.
• Communications: what you send us when you contact us.
• Reports: if you report content or another member, the report and anything you write in it.

Sensitive information. Journals, goals, and AI conversations are personal by nature, and you may choose to write about things like your health, mood, relationships, or beliefs. We use that information only to provide the Service to you as described below, and we do not use it for advertising. Please only include what you are comfortable storing in the Service.

Information from connected services

• Google Calendar (optional). If you connect Google Calendar, we receive an access token from Google that lets us add events to your primary calendar and read your events for the next seven days (start and end times and event titles) to suggest focus times. You can disconnect at any time from your Google account settings.

Information collected automatically

• Usage data: which pages of the Service you visit and when, used to operate and improve the Service.
• Device and log data: your IP address, browser type, and similar technical information recorded by our hosting provider when you use the Service.
• Local storage: the Service stores your sign-in session and your language choice in your browser so you stay signed in and see the right language. We do not use advertising cookies or cross-site tracking.

How we use your personal information

• Provide the Service: create and secure your account, store and show your goals, journal, and messages, run the community features, send the check-in emails you schedule, and sync with Google Calendar when you ask.
• AI features: generate coaching replies, progress analyses, goal ideas, journal prompts, focus-time suggestions, Study Hub material, and check-in messages. To do this we send the relevant information (for example your message, goals, milestones, recent journal entries, recent posts, or calendar events) to AI model providers.
• Points and streaks: calculate your points, level, streak, and badges, and keep a history of the points you earn. We may adjust points to prevent abuse.
• Payments: process subscriptions and manage your plan.
• Communicate with you: send service messages, security notices, and the check-in emails you turn on. We do not currently send marketing emails.
• Improve and protect the Service: understand how the Service is used (including aggregate statistics such as sign-ups and active users), fix problems, prevent abuse and fraud, and enforce our Terms of Service.
• Moderation and account administration: review reports, remove content that breaks our Terms, suspend or close accounts, and manage plans. When content is reported, our administrators can see the reported post, comment, or direct message and the account details of the people involved. Administrators do not otherwise read your private goals, journal entries, AI conversations, or messages through our admin tools. We keep a log of administrative actions.
• Comply with law: respond to lawful requests and protect our and others' rights and safety.

AI training. We do not use your content to train AI models. AI model providers process the information we send them to generate a response for you.

De-identified data. We may create aggregated or de-identified data that cannot reasonably identify you, and use it to understand and improve the Service. We will not try to re-identify it.

How we share your personal information

We do not sell your personal information, and we do not share it for targeted advertising. We share it only as follows:

• Our platform provider (Base44). The Service is built and hosted on Base44, which stores our database and files and provides sign-in, email delivery, and access to AI models on our behalf.

• AI model providers. Information needed for AI features is sent, through our platform provider, to the companies whose AI models generate the responses.

• Stripe, our payment processor, which processes payments under its own privacy policy at https://stripe.com/privacy.

• Google, if you connect Google Calendar, to create and read calendar events on your behalf.

• Other members of the Service. Some information is visible to other signed-in members:

  • Your public profile: display name, @username, profile picture, points, level, recent badges, and streak. Anyone signed in can look you up by your exact @username.
  • Your community posts, images, comments, and likes, and community challenges you create or join (including your check-in progress). Other members may also be able to see the email address associated with community content you create.
  • Friends-only challenges: visible to the people invited, who see your progress in them.
  • Friend requests and friendships: the other person sees your name, @username, and email address.
  • Direct messages and message requests: visible to you and the person you message. Someone you message sees your email address.

  Your goals, milestones, journal entries, and AI conversations are not shared with other members.

• Our administrators, the Thordin AI staff who run the Service, as described under "Moderation and account administration." Reporting content shares it with them; the person you report is not told who reported them.

• Professional advisors, such as lawyers and accountants, when needed for their services.

• Authorities and others, when we believe in good faith it is required by law or necessary to protect the rights, property, or safety of us, our users, or others.

• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this Privacy Policy.

Retention

We keep your personal information for as long as your account is active and as needed to provide the Service. When you delete content, we delete it from the Service. You can delete your goals, milestones, journal entries, AI Coach chats, posts, and comments at any time from Settings ("Delete my data"). If you ask us to close your account, we will delete or de-identify your personal information within a reasonable time, except where we must keep certain records (for example payment records) to meet legal, tax, or accounting obligations, resolve disputes, or enforce our agreements. Deleted information may remain in backups for a limited time before it is overwritten.

Your choices

• Access and update. You can view and update your profile picture and time zone in Settings.
• Delete your data. Use "Delete my data" in Settings, or email legal@thordinai.com to close your account.
• Email check-ins. You can turn check-in emails off for any goal.
• Google Calendar. You can disconnect MindMaven from your Google account at any time.
• Do Not Track. The Service does not respond to "Do Not Track" signals. We do not engage in cross-site tracking.

Security

We use technical and organizational safeguards designed to protect your personal information, including access controls that keep private content limited to its owner. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

International transfers

We are based in the United States, and our service providers may process information in the United States and other countries. Privacy laws there may differ from those where you live. See "Notice to users in Europe" for how we handle transfers of information from Europe.

Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact legal@thordinai.com and we will delete it.

Changes to this Privacy Policy

We may update this Privacy Policy. If we make material changes, we will update the effective date and notify you by email or in the Service before the changes take effect.

How to contact us

Thordin AI LLC Email: legal@thordinai.com

U.S. state privacy rights

This section applies to residents of U.S. states with privacy laws that apply to us, such as California, Colorado, Connecticut, Virginia, Texas, and Oregon.

Your rights. Depending on where you live, you may have the right to: know what personal information we have collected about you, its sources, the purposes we use it for, and who we share it with; get a copy of your personal information; correct it; delete it; and appeal our decision on your request. You will not be discriminated against for exercising these rights.

Sales, sharing, and targeted advertising. We do not sell personal information, share it for cross-context behavioral advertising, or process it for targeted advertising. We do not knowingly sell or share the personal information of consumers under 16.

Profiling. We do not use personal information for profiling or automated decision-making that produces legal or similarly significant effects.

Sensitive personal information. Content you write may include sensitive information. We use it only to provide the Service to you and not to infer characteristics about you.

Categories of information. In the past 12 months we have collected: identifiers (name, email address, IP address); customer records (payment and subscription information); internet activity (usage data); and other information you provide (goals, journal entries, messages, AI conversations, community content, photos, and, if connected, calendar events). We collect it from you, from your device, and from Google if you connect Google Calendar, for the purposes described in "How we use your personal information." We disclose it for business purposes to the service providers and others listed in "How we share your personal information."

Making a request. Email legal@thordinai.com from the address on your account. We may need to verify your identity before acting on a request, usually by confirming your control of that email address. You may use an authorized agent; we may ask for proof that the agent is authorized and may still need to verify your identity. If we deny your request, you may appeal by replying to our decision.

California "Shine the Light." We do not disclose personal information to third parties for their own direct marketing purposes.

Notice to users in Europe

This section applies to individuals in the European Economic Area, the United Kingdom, and Switzerland ("Europe"). References to "personal information" include "personal data" as defined in the EU General Data Protection Regulation and the UK GDPR (together, the "GDPR").

Controller. Thordin AI LLC is the controller of the personal information described in this Privacy Policy. You can reach us at legal@thordinai.com.

Legal bases. We rely on these legal bases:

• Providing the Service (your account, goals, journal, messages, community features, check-in emails, AI features, and Google Calendar sync): performance of our contract with you.
• Sensitive information you choose to include in your content: your explicit consent, given by choosing to include it. You can withdraw it by deleting the content.
• Payments and subscriptions: performance of our contract with you, and compliance with legal obligations such as tax and accounting rules.
• Security, fraud prevention, moderation, and enforcing our Terms: our legitimate interest in keeping the Service and its users safe.
• Understanding usage and improving the Service: our legitimate interest in maintaining and improving the Service.
• Complying with law and responding to lawful requests: compliance with legal obligations.

Your rights. You have the right to access, correct, or delete your personal information; to receive a copy in a portable format; to restrict or object to our processing (including processing based on legitimate interests); and to withdraw consent at any time, without affecting processing that happened before. To exercise these rights, email legal@thordinai.com. We may need to verify your identity. If we decline a request, we will explain why.

Complaints. You may complain to the data protection authority where you live or work. In the UK, that is the Information Commissioner's Office (ico.org.uk). In Norway, it is Datatilsynet (datatilsynet.no). We would appreciate the chance to address your concerns first.

International transfers. Because we are based in the United States, your personal information will be processed in the United States and possibly other countries outside Europe. When we transfer personal information out of Europe to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK equivalent) or the EU-U.S. Data Privacy Framework where the recipient participates. Contact us for more information about these safeguards.

Automated decisions. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.