Privacy Policy

Last updated September 21, 2026

This Privacy Policy for Mental Download App Inc. ("we", "us", or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://mentaldownloadapp.com or any website of ours that links to this Privacy Policy
• Download and use our mobile application (Mental Download App), or any other application of ours that links to this Privacy Policy
• Use Mental Download App. Mental Download (MDL) is a mobile application that helps a household's primary organiser manage shared responsibilities — including tasks, schedules, appointments, and information about family members, dependents, and service providers — in one place. Additional household members can be invited to view and contribute to shared information. The App uses on-device speech recognition to help users enter information by voice, and uses artificial intelligence to help organise and categorise the information you provide.
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at privacy@mentaldownloadapp.com.

Summary of key points

This summary provides key points from our Privacy Policy. You can find more details by clicking the link following each key point or by using the table of contents below.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? Some of the information may be considered "special" or "sensitive" in certain jurisdictions. We may process sensitive personal information when necessary with your consent or as otherwise permitted by applicable law. Learn more about sensitive information we process.

Do we collect any information from third parties? We do not collect any information from third parties.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. Learn more about how we process your information.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties. Learn more about when and with whom we share your personal information.

How do we keep your information safe? We have adequate organisational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet can be guaranteed to be 100% secure. Learn more about how we keep your information safe.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.

How do you exercise your rights? The easiest way to exercise your rights is by submitting a data subject access request, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the Privacy Policy in full.

Table of contents

1. What information do we collect?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal information provided by you. The personal information we collect may include the following:

• Names
• Email addresses
• Contact or authentication data

Sensitive information. When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information:

• Information about household members (such as children or other dependents) and the tasks, schedules, items to buy and appointments involved in managing a household, which may incidentally include sensitive personal information — for example, a medical appointment or a known allergy — when entered by a user.

Payment data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number and the security code associated with your payment instrument. All payment data is handled and stored by RevenueCat and Apple (App Store / In-App Purchase). You may find their privacy notices here: https://www.revenuecat.com/privacy and https://www.apple.com/legal/privacy/en-ww/.

Social media login data. We may provide you with the option to register with us using your existing social media account details. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section How do we handle your social logins? below.

Application data. If you use our application(s), we also may collect the following information if you choose to provide us with access or permission:

• Mobile device access. We may request access or permission to certain features from your mobile device, including your mobile device's camera, microphone, photo library, and other features. If you wish to change our access or permissions, you may do so in your device's settings.
• Mobile device data. We automatically collect device information (such as your mobile device ID, model, and manufacturer), operating system, version information and system configuration information, device and application identification numbers, browser type and version, hardware model, Internet service provider and/or mobile carrier, and Internet Protocol (IP) address (or proxy server).

This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information.

The information we collect includes:

• Log and usage data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files.
• Device data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services.

Google API

Our use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

2. How do we process your information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes only with your prior explicit consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order. (Retention period: For as long as the user maintains an account with us. If an account is deleted, associated account data is permanently deleted within 30 days.)
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service. (Retention period: For as long as the user's account or household remains active. If a household member is removed, their content remains part of the household but their identifying information is anonymised. If a household is deleted, its content is permanently deleted within 30 days.)
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service. (Retention period: For as long as necessary to resolve the inquiry, and for a reasonable period afterward to handle any follow-up.)
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information. (Retention period: Until the user unsubscribes or deletes their account.)
• To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services. (Retention period: For as long as necessary to review and act on the feedback, and for a reasonable period afterward.)
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention. (Retention period: For up to 12 months from the date of collection, or longer if needed to investigate a specific security incident.)
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them. (Retention period: For up to 12 months from the date of collection.)
• To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.
• To send onboarding guidance and feature updates. We send new users a short series of emails after signup to help them learn how to use the App, and occasionally notify existing users about significant new features. (Retention period: Until the user unsubscribes or deletes their account.)

3. What legal bases do we rely on to process your information?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfil our contractual obligations, to protect your rights, or to fulfil our legitimate business interests.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases:

• Consent. We may process your information if you have given us permission to use your personal information for a specific purpose. You can withdraw your consent at any time. Learn more about withdrawing your consent.
• Performance of a contract. We may process your personal information when we believe it is necessary to fulfil our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
• Legitimate interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests, including to:
  • Analyse how our Services are used so we can improve them to engage and retain users
  • Diagnose problems and/or prevent fraudulent activities
  • Understand how our users use our products and services so we can improve user experience
  • Help users successfully learn and use the App's features after signing up, and to keep them informed of meaningful updates to the App
• Legal obligations. We may process your information where we believe it is necessary for compliance with our legal obligations.
• Vital interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
• If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations
• We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments

4. When and with whom do we share your personal information?

In Short: We may share information in specific situations described in this section and/or with the following third parties.

Vendors, consultants, and other third-party service providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work.

The third parties we may share personal information with are as follows:

• AI service providers — Anthropic
• User account registration and authentication — Google Sign-In
• Website testing — TestFlight
• Invoicing & billing — RevenueCat
• Cloud computing services — Supabase
• User account registration & authentication — Apple (Sign in with Apple)
• Web & mobile analytics — PostHog
• Email delivery — Loops.so

We also may need to share your personal information in the following situations:

• Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

5. Do we offer artificial intelligence-based products?

In Short: We offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies.

As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). These tools are designed to enhance your experience and provide you with innovative solutions. The terms in this Privacy Policy govern your use of the AI Products within our Services.

Use of AI technologies

We provide the AI Products through third-party service providers ("AI Service Providers"), including Anthropic. As outlined in this Privacy Policy, your input, output, and personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products for purposes outlined in What legal bases do we rely on to process your personal information?. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

Our AI products

Our AI Products are designed for the following functions:

• Natural language processing

How we process your data using AI

All personal information processed using our AI Products is handled in line with our Privacy Policy and our agreement with third parties. This ensures high security and safeguards your personal information throughout the process.

6. How do we handle your social logins?

In Short: If you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services offer you the ability to register and log in using your third-party social media account details. Where you choose to do this, we will receive certain profile information about you from your social media provider, which may include your name, email address, friends list, and profile picture, as well as other information you choose to make public on such a social media platform.

We will use the information we receive only for the purposes that are described in this Privacy Policy or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal information by your third-party social media provider.

7. Is your information transferred internationally?

In Short: We may transfer, store, and process your information in countries other than your own.

Our servers are located in the United States. Please be aware that your information may be transferred to, stored by, and processed by us in our facilities and in the facilities of the third parties with whom we may share your personal information (see When and with whom do we share your personal information? above), including facilities in the United States and other countries.

If you are a resident in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, then these countries may not necessarily have data protection laws or other similar laws as comprehensive as those in your country. However, we will take all necessary measures to protect your personal information in accordance with this Privacy Policy and applicable law.

We have implemented measures to protect your personal information, including by using the European Commission's Standard Contractual Clauses for transfers of personal information. These clauses require all recipients to protect all personal information that they process originating from the EEA or UK in accordance with European data protection laws and regulations. Our Standard Contractual Clauses can be provided upon request.

8. How long do we keep your information?

In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Policy unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). If you are located in the EU or UK, see section How do we process your information? for our retention periods by purpose.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

9. How do we keep your information safe?

In Short: We aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

10. Do we collect information from minors?

In Short: We do not knowingly collect data from or market to minors.

Mental Download is not directed to children and is not intended for use by anyone under the age of 13. The person who creates a Mental Download account and subscribes to the service (the "Subscribed User") must be at least 18 years old.

A Subscribed User may invite other members of their household to join as "Invited Users." Invited Users must be at least 13 years old. By adding an Invited User between the ages of 13 and 17, the Subscribed User represents that they have the authority — as a parent, guardian, or otherwise — to add that person to the household and to authorise their use of the App.

We do not knowingly allow anyone under the age of 13 to create an account or use the App. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information.

11. What are your privacy rights?

In Short: Depending on your state of residence in the US or in some regions, such as the European Economic Area (EEA), United Kingdom (UK), Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. If a decision that produces legal or similarly significant effects is made solely by automated means, we will inform you, explain the main factors, and offer a simple way to request human review. In certain circumstances, you may also have the right to object to the processing of your personal information.

We will consider and act upon any request in accordance with applicable data protection laws.

If you are located in the UK and are unhappy with how we have handled your personal information, you can make a complaint directly to us. This is in addition to the rights you have under the UK General Data Protection Regulation and the Data Protection Act 2018.

How to contact us:

• Email: privacy@mentaldownloadapp.com

What happens after you complain:

• We will acknowledge your complaint within 30 days of receiving it.
• We will investigate without unjustifiable or excessive delay.
• We will keep you informed of progress and explain the outcome.

If you are not happy with our final response, you can refer your complaint to the Information Commissioner's Office, the UK supervisory authority:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.

If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

If you are located in Quebec, you may also contact the Commission d'accès à l'information regarding how we handle your personal information.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time by contacting us using the details provided in the section How can you contact us about this policy? below.

However, please note that this will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, or by contacting us using the details provided in the section How can you contact us about this policy? below.

Account information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Contact us using the contact information provided.
• Log in to your account settings and update your user account.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

If you have questions or comments about your privacy rights, you may email us at privacy@mentaldownloadapp.com.

12. Controls for do-not-track features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Policy.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognising or honouring DNT signals, we do not respond to them at this time.

13. Do United States residents have specific privacy rights?

In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information.

Categories of personal information we collect

The table below shows the categories of personal information we have collected in the past twelve (12) months.

Category	Examples	Collected
A. Identifiers	Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name	YES
B. Personal information as defined in the California Customer Records statute	Name, contact information, education, employment, employment history, and financial information	YES
C. Protected classification characteristics under state or federal law	Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data	NO
D. Commercial information	Transaction information, purchase history, financial details, and payment information	NO
E. Biometric information	Fingerprints and voiceprints	NO
F. Internet or other similar network activity	Browsing history, search history, online behaviour, interest data, and interactions with our and other websites, applications, systems, and advertisements	YES
G. Geolocation data	Device location	NO
H. Audio, electronic, sensory, or similar information	Images and audio, video or call recordings created in connection with our business activities	NO
I. Professional or employment-related information	Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us	NO
J. Education information	Student records and directory information	NO
K. Inferences drawn from collected personal information	Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual's preferences and characteristics	NO
L. Sensitive personal information	Personal data from a known child	YES

We only collect sensitive personal information, as defined by applicable privacy laws or the purposes allowed by law or with your consent. We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.

We will use and retain the collected personal information as needed to provide the Services or for:

• Category A – For as long as the user maintains an account with us. If an account is deleted, associated account data is permanently deleted within 30 days.
• Category B – For as long as the user maintains an account with us. If an account is deleted, associated account data is permanently deleted within 30 days.
• Category F – 1 year
• Category L – Retained for as long as it remains active within the household. When content is deleted — by a user, or because the household itself ends — it is soft-deleted and then permanently purged within 30 days. If the household member who created the content leaves but the household continues, their content is retained in anonymised form rather than deleted.

Sources of personal information

Learn more about the sources of personal information we collect in What information do we collect?

How we use and share personal information

Learn more about how we use your personal information in the section How do we process your information?

We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Learn more about how we disclose personal information in the section When and with whom do we share your personal information?

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.

We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed the following categories of personal information to third parties for a business or commercial purpose in the preceding twelve (12) months:

• Category A. Identifiers
• Category B. Personal information as defined in the California Customer Records law
• Category F. Internet or other electronic network activity information
• Category L. Sensitive personal information

Your rights

You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects

Depending upon the state where you live, you may also have the following rights:

• Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)
• Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)
• Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)
• Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Connecticut and Minnesota)
• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)
• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)

How to exercise your rights

To exercise these rights, you can contact us by submitting a data subject access request, by emailing us at privacy@mentaldownloadapp.com, or by referring to the contact details at the bottom of this document.

Under certain US state data protection laws, you can designate an authorised agent to make a request on your behalf. We may deny a request from an authorised agent that does not submit proof that they have been validly authorised to act on your behalf in accordance with applicable laws.

Request verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request.

If you submit the request through an authorised agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.

Appeals

Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at privacy@mentaldownloadapp.com. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.

14. Do other regions have specific privacy rights?

In Short: You may have additional rights based on the country you reside in.

Australia

We collect and process your personal information under the obligations and conditions set by Australia's Privacy Act 1988 (Privacy Act). This Privacy Policy satisfies the notice requirements defined in the Privacy Act, in particular: what personal information we collect from you, from which sources, for which purposes, and other recipients of your personal information.

If you do not wish to provide the personal information necessary to fulfil their applicable purpose, it may affect our ability to provide our services, in particular: offer you the products or services that you want; respond to or help with your requests; manage your account with us; confirm your identity and protect your account.

At any time, you have the right to request access to or correction of your personal information by contacting us using the details provided in the section How can you review, update, or delete the data we collect from you?

If you believe we are unlawfully processing your personal information, you have the right to submit a complaint about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner.

15. Who can see what inside your household

Content visibility inside your household is controlled by settings only the Subscribed User can change — not everyone in a household automatically sees everything. The Subscribed User can see all content within their own household. An Invited User's access is controlled by the Subscribed User, and depends on the household's content-access setting: either all household content, or only the items assigned to them, plus shared shopping lists and meal plans. Any item can be marked visible to the Subscribed User alone. Each list also carries its own visibility setting, controlled by the Subscribed User. If you belong to more than one household, your information is never shared across households.

16. Personal information about other people, including sensitive information

Most of the personal information in MDL is not about you. MDL is built for one person to manage a household on behalf of other people — children, a partner, other family members, and service providers such as a nanny or a cleaner — and the content you create routinely describes them: a name, a medical appointment, a school obligation, a photograph, a service provider's schedule. Because this content is free text and media you choose to record, it may include health-related information — such as a note or appointment referencing a medical condition, treatment, or provider — about you or about someone else, including a child. We treat this as sensitive information. You are responsible for having the right to share this information with us — for example, as the parent or guardian of a child, or as the person who engaged a service provider directly. We process it only to provide the Services to you: to store it, route it to the right place in the app, and display it to the household members you have given access to. We do not use it for advertising, and we do not use it to train third-party AI models. It is retained and deleted according to the rules in "How long do we keep your information?"

17. How we use AI

We use Anthropic's Claude API to route what you capture to the right place in the app, and to identify ingredients from a meal. What you send is not used to train Anthropic's models, and is deleted from Anthropic's systems within 30 days. When you speak or type a thought, we send the text — and a photo, if you attach one — to Anthropic's Claude API, along with your household member list and recent chat history, so it can determine what kind of item it is, where it belongs, who it's assigned to, and when it's due. We use the same API, on request, to identify ingredients from a meal's notes or photo. Because this content is often about people other than you — a child's name, an appointment, a photo of someone else — what we send to Anthropic frequently includes personal information about people who are not MDL users. We send only what's needed to route your capture or identify ingredients, and Anthropic processes it solely to provide that functionality back to us, as our data processor under its Commercial Terms. Your inputs and Anthropic's outputs are not used to train Anthropic's models, and are deleted from Anthropic's backend systems within 30 days — matching how long we ourselves retain deleted content. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

18. Third-party services

We use the following third-party service providers who may process your data on our behalf:

• Supabase — database, authentication, and file storage for all account data, content, and media you create.
• Anthropic — processes the text you capture, and any attached photo, along with your household member list and recent chat history, to route captures to the right place and identify ingredients. See "How we use AI" above.
• Apple — authentication identity and email if you sign in with Apple, and payment processing for App Store subscriptions.
• Google — authentication identity and email if you sign in with Google.
• RevenueCat — subscription status and purchase events, for subscription management.
• PostHog — product usage events, for analytics.
• Loops.so — your email address and name, for our onboarding and feature-update emails.

Each provider has their own privacy policy governing their use of your data.

19. Account deletion and how long we keep your information

When you delete an item — a task, a note, a photo, or anything else you've created — it is permanently removed, along with any attached media, 30 days after deletion. This window exists to let you recover something deleted by mistake. Completing an item is a different action from deleting it: completed items remain retrievable through Search for up to a year and are not affected by this 30-day window.

You can permanently delete your account at any time from within the app, from Settings → Delete Account. This is a deliberate, irreversible action — you must type DELETE to confirm — and once confirmed, your account, your profile and your email address are permanently removed from our active databases. What else happens depends on your role in your household: if you are a Subscribed User, deleting your account ends your household — every invited member loses access to its content, and the household's content is deleted along with it. If you are an Invited User, deleting your account removes you from every household you belong to, but tasks and other content you created remain with those households, unassigned and attributed to a removed member rather than to you by name, so the household's own records are not disrupted by your departure.

Deleting your account does not cancel a paid subscription — subscriptions are billed and managed through the Apple App Store and must be cancelled separately, in Unsubscribe within the app or through your App Store account settings. If you delete your account without cancelling first, billing continues until you cancel it through the App Store.

Account deletion cannot be undone and is not recoverable through customer support. If you would like to review or correct the information in your account without deleting it, or if you have other questions about your privacy rights, contact us at privacy@mentaldownloadapp.com.

20. Do we make updates to this policy?

In Short: Yes, we will update this policy as necessary to stay compliant with relevant laws.

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Policy. If we make material changes to this Privacy Policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Policy frequently to be informed of how we are protecting your information.

21. How can you contact us about this policy?

If you have questions or comments about this policy, you may email us at privacy@mentaldownloadapp.com.

22. How can you review, update, or delete the data we collect from you?

You have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please fill out and submit a data subject access request.