Privacy Policy

1. Who We Are

Mindivate is a mobile wellness app provided by Lumos Ignite AB, Sweden ("Mindivate", "we", "us", or "our").

Mindivate helps users work with anxiety-related avoidance, habits, self-reflection, and gradual challenge exercises. The app includes CBT-inspired exercises, mood and anxiety logging, LSAS self-assessments, progress tracking, subscriptions, local reminders, and an optional AI coach called Lumi.

We are the controller of the personal data we decide to collect and use through Mindivate. Some third-party providers process data for us as service providers or processors.

Contact:

• Email: info@lumosignite.com
• Company: Lumos Ignite AB
• Company registration number: 559547-4197
• Registered location: Malmo, Sweden
• Website: https://mindivate.com
• Company website: https://www.lumosignite.com/Mindivate

2. Scope

This Privacy Policy applies when you use the Mindivate mobile app, visit our Mindivate web pages, contact us, or interact with Mindivate support.

This policy does not apply to third-party websites or services that we do not control, such as Apple App Store, Google Play, Google, RevenueCat, Expo, or Findahelpline. Those services have their own privacy policies.

3. Important Health and Safety Notice

Mindivate is a wellness and self-help app. It is not a medical device, healthcare provider, emergency service, therapist, psychologist, doctor, or clinical mental health service.

Mindivate does not diagnose, treat, cure, or prevent any disease or mental health condition. The app's exercises, assessments, AI responses, and progress insights are for general wellness support and reflection only.

If you may harm yourself or someone else, feel unsafe, or are in crisis, do not rely on Mindivate. Contact emergency services, a crisis line, a qualified healthcare professional, or someone you trust immediately.

4. Personal Data We Collect

We collect the data needed to provide Mindivate, keep accounts secure, personalize the experience, manage subscriptions, improve the app, and comply with legal obligations.

4.1 Account and Sign-In Data

When you create an account or sign in, we may collect:

• Firebase user ID
• Email address
• Display name
• Profile photo URL, if provided by Google or Apple
• Sign-in provider, such as email/password, Google Sign-In, or Sign in with Apple
• Email verification and authentication status
• Account creation and update timestamps

If you use email/password sign-in, Firebase Authentication handles authentication. We do not store your password directly.

4.2 Onboarding and Profile Data

During onboarding, you may provide:

• Name or preferred name
• Birth date and/or age
• Gender, if provided
• Motivation for using the app
• Selected anxiety or focus areas
• Avoidance patterns
• Coping styles
• CBT-related self-ratings
• Experience level
• First selected challenge
• Onboarding completion status and timestamps

4.3 Wellness and Self-Reflection Data

Mindivate may store wellness data that you choose to enter or generate through use of the app, including:

• Mood logs
• Anxiety level on a 1-10 scale
• Mood label
• Optional notes
• Selected problem areas, such as social situations, work or school, sleep, health, family, relationships, performance, or future worries
• LSAS answers and scores, including total score and sub-scores for social fear, social avoidance, performance fear, and performance avoidance
• Challenge completions, including challenge title, type, category, difficulty, points, steps completed, and timestamp
• Custom challenges that you create, including title, reason, category, difficulty, frequency, scheduled date, and points
• Progress statistics, including streaks, total points, weekly activity, daily points, bloom/progression state, and achievement unlocks

This information can be sensitive because it may relate to mental wellbeing. You should only enter information you are comfortable processing through the app.

4.4 AI Coach Data

Mindivate includes an optional AI coach called Lumi. Lumi is available only if you have access to the feature and explicitly accept the AI notice in the app.

When you use Lumi, the following information may be sent to Google's AI service through Firebase AI Logic to generate a response:

• Your current message
• Recent messages from the current chat session
• Your preferred name
• Focus areas
• Avoidance patterns
• Coping styles
• Experience level
• Current streak
• Total points
• Number of completions this week
• Average anxiety level from recent mood logs, if available
• Latest LSAS severity category, if available

Mindivate does not store Lumi chat messages in our Firestore database in the current app implementation. The conversation is held in app memory during the session and is gone when the chat is cleared, the app session ends, or the app state is reset. Your device may store a local consent flag and a local daily usage counter.

Mindivate does not use your Lumi messages or wellbeing context to train Mindivate-owned AI models. Google's processing of prompts and responses is governed by the applicable Google, Firebase AI Logic, Gemini API, and Google Cloud terms. Google may process and temporarily log prompts, responses, and technical metadata for purposes such as providing the service, safety, abuse prevention, reliability, and legal compliance.

Do not use Lumi for emergencies. Do not include information about other people unless you have the right to do so.

4.5 Subscription and Purchase Data

If you purchase or restore a subscription, payment and billing are handled by Apple App Store or Google Play. RevenueCat helps us verify your subscription status.

We may receive or process:

• App user ID or Firebase user ID used for entitlement linking
• Product ID
• Subscription status
• Trial status
• Purchase, renewal, and expiration dates
• Store platform, such as Apple App Store or Google Play
• Restore purchase status

We do not receive or store your full payment card details.

4.6 Analytics, Diagnostics, and Security Data

We use Firebase Analytics, Firebase Crashlytics, Firebase App Check, Remote Config, and related Firebase services. These may process:

• App events, such as onboarding completion, paywall views, purchases started or completed, challenge starts and completions, mood log saved, LSAS completed, review prompt shown, and coach message sent
• App version, operating system version, device model, language, and platform
• Crash reports, stack traces, error logs, and diagnostic data
• Device or installation identifiers used for analytics, security, fraud prevention, and app integrity
• App Check tokens or related verification signals
• Remote configuration fetches and feature configuration metadata

We intentionally avoid logging free-text notes, chat contents, raw anxiety scores, or LSAS scores into analytics events.

4.7 Notifications and Local Device Data

Mindivate uses local scheduled reminders through Expo Notifications. The current app implementation does not collect remote push notification tokens for our server.

The app may store local-only values on your device, such as:

• Notification permission and scheduled reminder state
• Theme preference
• Language/device locale preference
• App tour state
• Planned days for the week
• Last self-rating for challenge difficulty
• AI coach consent flag
• AI coach daily message counter
• Cached subscription status
• Cached AI model/runtime configuration
• In-app review prompt counters

Local device data may remain on your device until you clear app data, delete the app, or the app removes it.

4.8 Support and Communications

If you contact us, we may process:

• Your email address
• The content of your message
• Any information you choose to include
• Technical details needed to investigate your request

4.9 Website Waitlist

If you join the Mindivate waitlist, we collect the email address you submit and the technical information needed to deliver and protect the form. We use this information only to send the requested launch announcement, administer the waitlist, prevent abuse, and document your request. The legal basis is your consent and, where applicable, taking steps at your request before providing the service.

The form is provided by Tally BV, which processes form responses for us. Tally states that form data is encrypted in transit and at rest and stored in Europe. You can withdraw from the waitlist at any time by contacting info@lumosignite.com. We keep the submission until the launch announcement has been sent, you withdraw, or the waitlist is discontinued, after which it is deleted when no longer needed, subject to limited backup, security, and legal retention.

5. Data We Do Not Intentionally Collect

Mindivate does not intentionally collect:

• Precise GPS location
• Contacts or address book
• Microphone recordings
• Camera photos or videos
• HealthKit or Google Fit records
• Biometric identifiers
• Government ID numbers
• Payment card numbers

Mindivate does not show third-party ads and does not use your data to build advertising profiles.

6. How We Use Personal Data

We use personal data for the following purposes:

7. Legal Bases Under GDPR

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract: to create your account, provide the app, manage subscriptions, and deliver requested features.
• Consent: for optional features such as notifications and the Lumi AI coach. Where required, we rely on explicit consent for processing wellness data that may be considered special category health data.
• Legitimate interests: to keep the app secure, diagnose crashes, improve performance, prevent abuse, and understand aggregate feature usage, where those interests are not overridden by your rights.
• Legal obligation: to comply with tax, accounting, consumer protection, legal requests, and regulatory obligations.

You may withdraw consent at any time by disabling the relevant feature, deleting data, deleting your account, or contacting us at info@lumosignite.com. Withdrawal does not affect processing that occurred before withdrawal.

8. How We Share Personal Data

We do not sell your personal data. We do not share personal data for targeted advertising.

We may share personal data with:

• Service providers and processors that help us provide Mindivate.
• Website form providers, currently Tally, when you join the waitlist.
• Authentication providers, such as Google and Apple, if you choose those sign-in methods.
• Subscription providers, such as Apple, Google, and RevenueCat.
• AI service providers, currently Google through Firebase AI Logic/Gemini, when you use Lumi.
• Analytics, crash, and infrastructure providers, such as Firebase and Expo/EAS.
• Legal or safety recipients, if required by law, court order, regulation, or to protect rights, safety, and security.
• Business transfer recipients, if Mindivate or Lumos Ignite is involved in a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate protections.

9. Third-Party Services

Mindivate uses the following services:

Third-party privacy policies:

• Google Privacy Policy: https://policies.google.com/privacy
• Firebase Privacy and Security: https://firebase.google.com/support/privacy
• Apple Privacy Policy: https://www.apple.com/privacy/
• RevenueCat Privacy Policy: https://www.revenuecat.com/privacy
• Expo Privacy Policy: https://expo.dev/privacy
• Tally Privacy Notice: https://tally.so/help/privacy-policy
• Tally GDPR information and Data Processing Agreement: https://tally.so/help/gdpr

10. International Transfers

We are based in Sweden and aim to store Firestore app data in the European region, currently europe-west1 where configured for the Firebase project.

Some service providers, including Google, Apple, RevenueCat, and Expo, may process data in the United States or other countries. Where required, we rely on appropriate safeguards such as data processing agreements, standard contractual clauses, adequacy decisions, or equivalent legal transfer mechanisms.

11. Security

We use reasonable technical and organizational measures to protect personal data, including:

• HTTPS/TLS encryption in transit
• Encryption at rest provided by cloud infrastructure providers
• Firebase Authentication for account access
• Firestore security rules designed so users can access only their own user data
• Firebase App Check using platform integrity checks in production
• Limited analytics event design that avoids logging free-text notes and raw wellbeing scores
• Account deletion functionality in the app

No system is perfectly secure. We cannot guarantee absolute security.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority, where required, without undue delay and where feasible within 72 hours after becoming aware of it. If the breach is likely to result in a high risk to you, we will also notify you directly where required by law.

12. Data Retention

We keep personal data only for as long as needed for the purposes described in this policy, unless a longer period is required or permitted by law.

Typical retention:

• Account and Firestore data: kept while your account is active.
• Mood logs, LSAS results, custom challenges, completions, stats, and achievements: kept while your account is active, unless deleted through account deletion or a valid deletion request.
• Lumi chat messages: not stored in our Firestore database in the current app implementation; processed during the session and by the AI provider as described in its applicable terms.
• Subscription records: retained as needed by Apple, Google, RevenueCat, and us to provide entitlements, restore purchases, resolve disputes, and comply with legal obligations.
• Crash and analytics data: retained by Firebase according to Firebase/Google settings and policies; aggregate or de-identified analytics may be retained longer.
• Support emails: retained as long as needed to handle the request and maintain business records.
• Waitlist submissions: retained until the launch announcement has been sent, consent is withdrawn, or the waitlist is discontinued, and then deleted when no longer needed, subject to limited backups and legal requirements.
• Local device data: may remain on your device until you clear app data, delete the app, or the app removes it.

When you delete your Mindivate account in the app, the app deletes your user document and known user subcollections in Firestore, including stats, completions, custom challenges, mood logs, coach message documents if any exist, LSAS results, and achievements, and then deletes your Firebase Authentication account. Some local-only device settings or caches may remain until you clear app data or delete the app.

Backups, logs, and third-party records may persist for a limited period as required for security, legal, disaster recovery, or compliance purposes.

13. Your Privacy Rights

Depending on where you live, you may have rights to:

• Access your personal data
• Correct inaccurate personal data
• Delete personal data
• Restrict processing
• Object to processing
• Receive a portable copy of your data
• Withdraw consent
• Object to direct marketing, if any
• Appeal certain privacy request decisions, where applicable
• Lodge a complaint with a data protection authority

To exercise your rights, contact info@lumosignite.com.

If you are in the EU/EEA, you may contact your local data protection authority. In Sweden, the authority is Integritetsskyddsmyndigheten (IMY): https://www.imy.se

We will respond within the time required by applicable law. For GDPR requests, this is normally within 30 days. For certain US state requests, response periods may differ.

For ordinary support requests, we aim to respond within 48 hours, but response times may vary depending on request volume and complexity.

14. US State Privacy and Consumer Health Data Notice

Some US state laws provide additional rights for personal data and consumer health data.

Mindivate may process wellness information that could be considered "consumer health data" under certain laws, including:

• Anxiety level and mood logs
• Optional notes about wellbeing
• Selected problem areas
• LSAS self-assessment answers and scores
• Challenge and progress history related to anxiety-related self-help
• Wellbeing context sent to Lumi if you use the AI coach

Sources of consumer health data:

• You, when you enter information in the app
• Your app activity, when you complete challenges or assessments
• Derived app summaries, such as recent average anxiety level or LSAS severity category

Purposes:

• Provide app features you request
• Personalize exercises and progress insights
• Provide optional AI coach responses
• Maintain your progress history
• Improve app reliability and safety

Sharing:

• We share consumer health data with service providers only as needed to provide the app, such as Cloud Firestore and Firebase AI Logic/Gemini when you use Lumi.
• We do not sell consumer health data.
• We do not share consumer health data for targeted advertising.

You may request access, deletion, correction, or withdrawal of consent by contacting info@lumosignite.com. If we deny a request, you may appeal by replying to our decision email and stating that you want to appeal.

15. California Privacy Notice

If California privacy law applies, the categories of personal information we may collect include:

• Identifiers, such as email address, user ID, display name, and account identifiers
• Customer records, such as subscription status and support correspondence
• Commercial information, such as purchase history and subscription entitlement
• Internet or electronic network activity, such as app events and diagnostics
• Geolocation at coarse level only if inferred by service providers from IP or device settings; we do not request precise GPS location
• Sensitive personal information, such as account login credentials handled by Firebase Authentication and wellness information you choose to enter
• Inferences, such as personalization categories and progress summaries

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics for purposes other than providing and improving Mindivate.

16. Children and Minors

Mindivate is not intended for children under 13. We do not knowingly collect personal data from children under 13.

If you are under the age of majority where you live, you may use Mindivate only with permission from a parent or legal guardian.

If you believe a child under 13 has used Mindivate or provided personal data, contact info@lumosignite.com and we will take appropriate steps to delete the data.

17. Automated Processing and AI

Mindivate uses automated processing to personalize recommendations, show progress, calculate stats, and generate optional AI coach responses. These features do not make legal decisions about you or decisions that produce similarly significant effects.

AI-generated responses may be incomplete, inaccurate, or inappropriate for your situation. Use your own judgment and seek professional help where needed.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date. For material changes, we may provide notice in the app or by other reasonable means.

Continued use of Mindivate after an updated policy becomes effective means you acknowledge the updated policy.

19. Contact

For privacy questions or requests:

Email: info@lumosignite.com