Mindora is a personal journaling application with AI-assisted features. This policy explains what information we collect, why, who it is shared with, and the choices you have. It covers both the Mindora Android app and the Mindora website at mindorajournal.com, which share the same account and backend.
| Data | Why |
|---|---|
| Username, email address, full name | To create and identify your account, and to send account-related email. |
| Password | To authenticate you. Stored only as a bcrypt hash — never in plain text, and not recoverable by us. |
| Journal entries (title, body, mood, tags) | The core function of the app: to store and display your journal. |
| Optional profile details (bio, profile picture, phone number, country, city) | To personalize your profile. All optional; leaving them blank does not limit the app. |
| Preferences (theme, notification settings, reminder time) | To keep your settings consistent across devices. |
| Data | Why |
|---|---|
| Login history: IP address, browser/device user agent, success or failure, timestamp | Security. It lets you review account access and helps detect unauthorized sign-in attempts. Visible to you in Settings. |
| Push notification token and platform | Only if you enable notifications, so reminders can reach your device. |
| Derived mood and sentiment data | Generated from your entries to power mood tracking and analytics. |
| Two-factor authentication data | If you enable 2FA: an encrypted authenticator secret and hashed recovery codes. |
We do not collect your precise location, contacts, photos beyond a profile picture you deliberately choose, or advertising identifiers. The app contains no third-party advertising or analytics SDKs.
Dictation. The microphone is used only while you have dictation switched on. While you speak, your device's own speech recognition service (on most Android phones, Google's; in a web browser, the browser's) shows the words live, and may process the audio on its own servers under its own terms. In the Android app on Android 13 or later, and in the iOS app, the recording is then sent through our servers to our AI provider (below) for a more accurate transcript, which is what goes into your entry. We do not store the recording: it is deleted from your phone once sent, and our servers pass it on without saving it. Only the resulting text is kept, as part of your entry.
We do not sell your personal information or share it for advertising. We share the minimum necessary with the following providers so specific features can work:
| Provider | What is sent | When |
|---|---|---|
| A third-party AI provider | The journal text or chat message relevant to the request, and dictation recordings | Mood detection runs automatically while you write an entry, unless you set the mood yourself. The other AI features — summarize, rephrase, fix grammar, continue writing, auto-tags and AI chat — send text only when you use them. Dictation recordings are sent only when you dictate. On the plan Mindora currently uses, the provider's terms allow it to use this text and audio to improve its own products, so this is sharing, not only processing on our behalf. |
| A bot-protection provider | IP address and bot-detection signals | On sign-in and registration, to block automated abuse. |
| A push delivery service | Your device push token and the notification text | Only if you enable push notifications. |
| An email delivery provider | Your email address and the message | For account email only: welcome, email verification, password reset, and security alerts. No marketing email. |
The bot-protection, push and email providers process the data only to deliver their service to us. All providers are subject to their own privacy terms. We may also disclose information where required by law, or to protect the rights and safety of our users.
For transparency: to make search work, journal titles and content are also held in a search index in unencrypted form on our own infrastructure. That index is not exposed publicly and is access-controlled, but it is not covered by the at-rest encryption described above. No security measure is perfect, and we cannot guarantee absolute security.
We keep your account data for as long as your account exists. Deleting your account removes your profile and preferences and revokes your active sessions. Short-lived security records — password reset codes, email verification codes, and sign-in tokens — expire automatically. Backups and logs may persist for a limited period before being overwritten.
Depending on where you live, you may have additional rights over your personal data, including portability and the right to object to certain processing. Contact us to make a request.
Mindora is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.
If we make material changes, we will update the effective date above and, where appropriate, notify you in the app. Continued use after an update means you accept the revised policy.
Questions or requests about this policy or your data: info@aqvionlabs.com