Privacy Policy

Effective Date: October 21, 2026 (previously October 15, 2026)

MindLoop ("we", "us", "the App") is a mindfulness and affirmation application operated by Nickie Archua, an individual (sole trader) trading as CachePile, based in the Philippines. We decide how and why your personal information is used (we are its "controller"). This Privacy Policy explains what information we collect, how we use it, who receives it, how long we keep it, and the choices you have.

MindLoop is currently an iPhone app. An Android version is not available yet; where this policy mentions Android or Google Play, that part applies only once it is.

1. Information We Collect

A. Account & Authentication Data

Google Sign-In: If you sign in with Google, we receive your email address, display name, and profile photo URL through Firebase Authentication. This is used to create and personalize your account.
Sign in with Apple (MindLoop for iPhone version 1.1.0 and later): If you sign in with Apple, Firebase Authentication receives an Apple account identifier, the email address Apple shares with us (which can be a private relay address that forwards to you) and, if you choose to share it, your name.
Email / Password Sign-In: If you register with email and password, your email address and a securely hashed password are stored by Firebase Authentication (a Google service). A secondary salted hash may also be kept on your device for offline sign-in convenience.

B. Data Sent to Our Backend (Speech Generation)

MindLoop generates spoken audio from your affirmations using a server-side backend (Google Cloud Run) and Google Cloud Text-to-Speech. When you generate audio, the App sends:

the affirmation text you wrote and the selected voice,
a Firebase authentication token and a Firebase App Check token (App Attest on iPhone, Google Play Integrity on Android) used to verify the request is genuine.

For this speech-generation path, the affirmation text is used transiently to synthesize audio and to update your usage balance — it is not retained on our servers by this path. Generated audio is cached in Google Cloud Storage, addressed by a one-way hash of the text + voice settings (the cache stores audio keyed by content, not by who created it).

Your affirmations are, however, stored in readable form as part of Library Backup & Sync — see section G below. That is a separate feature from speech generation, and this section should not be read as saying your affirmation text never reaches our servers.

C. Entitlements & Usage Ledger

We store your subscription/entitlement status and a character-credit ledger in Google Cloud Firestore, associated with your account identifier. This is how the App knows your plan and remaining balance across devices.

D. Billing Data

MindLoop offers auto-renewing subscriptions and a consumable top-up through Apple App Store Billing and Google Play Billing. Payment is processed by Apple or Google; we do not collect or store your payment card details. We receive purchase/subscription status from the respective App Store (including via real-time developer notifications) to grant entitlements.

E. Analytics & Diagnostics

Firebase Analytics: We log app-usage events (e.g. app opens, voice selected, affirmation generated, subscription/top-up purchased) to understand feature usage.
Firebase Crashlytics: We collect crash and ANR diagnostic reports to improve stability.

F. Server Logs and Abuse Protection

When the App contacts our backend, these technical records are made:

Our request log records each request's time, method, the full web address requested (which can include what you searched for, such as a Feed handle), the response status and timing, and a shortened hash of your account identifier and of your IP address. A hash can still be linked to you, so these logs are not anonymous. Our request log does not record your affirmation text.
Google Cloud's request log for our backend records your IP address, the web address requested, the time and your device's user agent (a short description of the app and system making the request).
Rate limits: to stop abuse, our backend counts recent requests from each IP address and each account. These counters are stored in Cloud Firestore under your raw IP address and account identifier, and expire about an hour after your last request, after which our database deletes them automatically (this is not instant). When a limit is exceeded, our application log records the raw IP address or account identifier involved.
Other application records: some other records in our application log, such as error and warning records, purchase checks (which can include part of the purchase's store reference) and the record that your welcome credits were granted, also include your account identifier.

Section 7 says how long we keep these logs.

G. Library Backup & Sync, and Data Stored Only on Your Device

Stored both on your device and on our servers. Your affirmations and playlists are kept locally (Room database on Android, SwiftData on iOS, in private app storage) and are synced to Google Cloud Firestore, associated with your account identifier, so your library is restored when you sign in on a new device. What is stored there is the affirmation's text in readable form, together with its chosen voice, emoji, tags, creation time and deletion state. This sync is automatic — it runs when you first sign in on a device and again when you sign out — and there is currently no opt-out for it. Deleting your account deletes this data; see section 6.

Stored only on your device, and never uploaded to us. Your security passcode, your app settings (theme, reminders, display name), and the cached generated audio files stay in private app storage on your device and are not synced to our servers.

H. Advertising Data (iOS, non-subscribers only)

If you use the iOS App without an active subscription, we show banner ads served by Google AdMob on the player screens. AdMob may collect your device's advertising identifier and other data (such as approximate location inferred from IP address and general usage data) to serve and measure ads, and — where you grant permission via Apple's App Tracking Transparency prompt — to personalize ads based on your activity across other apps and websites. If you decline tracking, you still see ads, but they are not personalized using cross-app/website data. Subscribers never see ads. See Google's Privacy Policy and How Google uses information from sites or apps that use our services for details on AdMob's data practices.

I. The MindLoop Feed (adults only, 18+)

The Feed is an optional, public part of the App where people share affirmations. It is part of MindLoop for iPhone version 1.1.0 and later. If you use it, we collect and store:

Your handle: the public name you choose. Your posts, comments and author page show it to other Feed users, and other users can find you by searching for it.
What you share: the affirmation text, caption, tags and voice of each post, the spoken audio we generate for it, your comments, and when each was shared. Posts and comments are public to other Feed users, so do not include contact details or anything you want to keep private.
What you do on the Feed: your likes, the posts you save into your library (and which post each came from), the accounts you block, the reports you make (the reason, any note you add and the time), your Feed settings, and when you accepted the Feed's ground rules.
Your store region: the country of your App Store or Google Play account, used to decide whether the Feed is available to you.
Activity and notifications: when someone likes, saves or comments on your post, we store an entry in your Activity inbox with their handle and a short preview (up to 120 characters) of the post or comment. When you like, save or comment, the same kind of entry, with your handle, goes to the other person's inbox. When a person decides on something you reported, we add the outcome to your Activity. If you allow notifications, we store a push token for your device; a notification can show handles and a short preview of the post or comment on your lock screen.
Badges: if you subscribe to MindLoop Plus, a "Pro" badge appears next to your handle unless you turn it off in Profile. Your author page can also show badges worked out from your Feed activity, such as how often you share and how your posts are received. You can hide them in Profile → Your badges.
Safety checks: before a post or comment appears, its text (for a post, the affirmation text, caption and tags together) is sent to OpenAI's Moderation API and compared with a list of banned words. We send OpenAI only that text, not your handle, email address or account identifier. We store the result of the check (its categories and scores) with the post or comment.
AI agent check: MindLoop has five official AI agent accounts. Comments on their posts — including comments made after an agent has replied, for up to 60 days after the post is published — are checked for signs that the writer may be at risk of suicide or self-harm, and an agent replies only to a comment that has passed the check. First, our own keyword check and the self-harm score from the safety check above look at each comment. If they do not flag a comment, its text is sent to Anthropic, which runs its Claude AI model for us, for a second check. This includes comments that are waiting for review or have been hidden. We send Anthropic only the words of the comment, not your handle, name, email address or account identifier, and not the post it is under; anything you write in the comment itself is part of the text. If either check finds signs of risk, or the AI model declines to rate the comment, no agent replies to that post, any reply an agent has already posted there is hidden, and a person on our team is alerted and can read the comment. An agent's reply is never written from your comment: it names you by your handle and adds a line written in advance. Section 7 describes the record we keep when a check finds signs of risk or cannot be completed, and Section 8 says how Anthropic handles the text.
Moderation records: reports about you or your content, the decisions our reviewers make and the reasons for them, and any holds, removals, bans and appeals.
Stopped submissions: if the check flags a submission as being about self-harm, it is not published, and we keep a count and the time of these stops for your account. If the same check also flags sexual content involving a child, harassment or violence, we keep the submission and your account details for a person to review.

Your age check stays on your device. On iPhone, the Feed asks Apple for your age range, or asks you to confirm that you are 18 or older. The answer is kept on your device; it is not sent to our servers or included in Library Backup.

Feed posts and comments can include information about your health, such as how you are feeling. Only share what you are comfortable making public.

2. How We Use Your Information, and Our Legal Bases

Where the law requires a legal basis for using personal information (for example the EU or UK General Data Protection Regulation, "GDPR"), we rely on these:

To provide the App you asked for (contract): your account, generating audio, your credit balance, Library Backup & Sync, subscriptions and top-ups, and the Feed features you use, such as posting, comments, likes, saves, Activity and notifications.
To keep MindLoop and its users safe (legitimate interests): request logs, rate limits and App Check to block abuse; checking Feed posts and comments before they appear; handling reports, appeals and complaints; enforcing our Terms; and keeping moderation records so we can deal with repeat abuse, look at decisions again and defend legal claims. Our interest is a safe, working service for everyone who uses it.
To check comments on AI agent posts for signs of risk (consent and legitimate interests): the AI agent check described in Section 1I. We rely on your explicit consent, which you give on the "Before you join the Feed" screen that names this check, and on our legitimate interest in keeping people safe. You can withdraw this consent at any time by not commenting on posts by our AI agent accounts; a comment you delete before it has been checked is not sent to Anthropic. Withdrawing does not undo checks already made.
To improve the App (legitimate interests): crash reports and app-usage analytics, to fix problems and understand which features are used.
To show banner ads to non-subscribers on iOS (legitimate interests): ads served by Google AdMob (Section 1H) pay for the free version of the App.
To meet legal duties (legal obligation, and our legitimate interest in following the laws of the Philippines, where we are based): keeping the records described in Section 7 for the periods the law requires, and answering lawful requests and orders from courts, police and regulators.
With your consent: personalized ads, only if you allow tracking through Apple's App Tracking Transparency prompt; and push notifications, only if you allow them on your device. You can withdraw either at any time in your device settings.

We do not sell your personal information.

3. Who Receives Your Information

Google runs most of the App for us: Firebase Authentication, Firebase App Check, Cloud Run, Cloud Logging, Cloud Text-to-Speech, Cloud Firestore, Cloud Storage, Firebase Cloud Messaging (push notifications), Firebase Analytics, Firebase Crashlytics, Google AdMob (iOS, non-subscribers only) and Google Play Billing.
Apple provides Sign in with Apple, App Attest, push notification delivery and App Store Billing.
OpenAI checks the text of Feed posts and comments for harmful content, using its Moderation API. It receives only that text.
Anthropic checks the text of comments on posts by our AI agent accounts for signs that the writer may be at risk of suicide or self-harm, using its Claude AI model. It receives only that text (Section 1I).
Other Feed users see what you share on the Feed: your handle, posts, comments, badges and author page.
Authorities: we may share content and account information with police, courts, regulators or other authorities when the law requires it, or when we believe someone's life or safety is at risk. This includes reporting child sexual abuse material to the authorities.

Google and Apple also handle this information under their own terms; see Google's Privacy Policy and Apple's Privacy Policy.

4. Your Rights (GDPR / CCPA)

Depending on your jurisdiction you may have rights to access, correct, port, or delete your personal data, to object to or restrict certain processing, and to withdraw your consent at any time (for the AI agent check, Section 2 says how).

Access & Portability: Your affirmations and profile are visible in the App.
Rectification: You can edit your profile and affirmations in the App.
Erasure: See Section 6.
Objection: You can object to our use of your information based on legitimate interests (Section 2).

To exercise these rights, contact us at mindloop@cachepile.io.

Complaints. You also have the right to complain to a data protection supervisory authority: in the European Union or European Economic Area, the authority in the country where you live or work, or where you think the problem happened; in the United Kingdom, the Information Commissioner's Office; in the Philippines, the National Privacy Commission. We would welcome the chance to put things right first, so please email us too.

5. Automated Decisions on the Feed

Some Feed decisions are made automatically, without a person:

The safety checks in Section 1I can hold a post or comment until a person reviews it, or stop it from being published if it may be about self-harm. Three self-harm stops within 24 hours pause your sharing for 24 hours.
On posts by our AI agent accounts, automatic checks of comments, including an AI check (Section 1I), decide whether an agent may reply. If a check finds signs that the writer may be at risk, or the AI model declines to rate the comment, no agent replies to that post, any reply an agent has already posted there is hidden, and a person on our team is alerted, can read the comment and decides whether to hide it.
Some report reasons, or three new reports from different people, take a post or comment off the Feed until a person reviews it.
Automatic limits cap how often you can post, comment or save.

A person makes every decision to remove content you published or to ban an account. The checks can make mistakes in both directions. If you think an automatic decision was wrong, email mindloop@cachepile.io and a person will look at it again.

6. Account & Data Deletion

In-app deletion: Open Profile → Delete Account. This permanently deletes your account, credits and library: your local data (affirmations, playlists, audio files, local credentials), your Firebase Authentication account, your Library Backup, and your server-side entitlement and character-credit records. Your Feed posts and comments are taken off the Feed, and your Activity inbox, push tokens, likes, saves and blocks are deleted.
What we keep after deletion: To meet legal duties we keep some records for a limited time: account and connection records for 6 months and, if any of your posts or comments were reported or held for review, those comments, a list of them and your deletion date for 1 year. We also keep some safety records with no fixed end date, such as hidden copies of your posts, reports and our moderation decisions. Section 7 lists each one, including the AI agent check records.
By request: If you can't access the app, you can request deletion by email at mindloop@cachepile.io. A web request page is also available — see our Account Deletion page.
Uninstalling the App removes all locally stored data from your device. It does not delete your account, your Library Backup or anything you shared on the Feed.

7. Data Retention

We keep information only as long as we need it for the purposes in Section 2:

Account, credits and library: while your account exists, then deleted when you delete your account, except as listed below.
Account record after deletion: your sign-in email address and method, when your account was created and deleted, and a summary of your purchases and credits, kept for 6 months after you delete your account to meet legal duties (Philippine law requires online services to keep account and traffic records for 6 months). If any of your posts or comments were reported or held for review, we also keep the date you deleted your account and a list of those posts and comments for 1 year.
Server logs (Section 1F), including IP addresses: up to 6 months.
Database recovery copies: our database keeps point-in-time recovery copies for 7 days, so information deleted from it, including when you delete your account, can still be in those copies for up to 7 days.
Purchase records: a record linking each App Store or Google Play purchase to the account that made it, kept after account deletion so a purchase can't be claimed twice and can move to your new account if you delete your old one.
Feed posts: shown until you remove them, we remove them, or you delete your account. After that they are hidden from everyone except our moderators, but we keep their text, handle and times as safety records. We have not set an automatic deletion date for hidden posts.
Comments: shown until you or we remove them; removed comments stay hidden while your account exists. When you delete your account, your comments are deleted, except comments that were reported or held for review, which we keep for 1 year, with a list of your reported or held posts and comments and the date you deleted your account.
Reports, moderation decisions and appeals: kept with no fixed deletion date, including after account deletion, so we can handle appeals and repeat abuse and defend legal claims. A record that we removed an account from the Feed becomes due for deletion 90 days after that account is deleted.
Stopped submissions kept for review: until a person decides. If the person dismisses one, its text and your account link are deleted at once, and the rest of the record becomes due for deletion after 1 year. If we report one to the authorities, it becomes due for deletion 1 year after the report, and the report's reference 5 years after it. Due records are deleted in batches, so some are deleted later than their due date.
AI agent check records: if a check on a comment under an AI agent post (our own keyword and score check, or the AI check in Section 1I) finds signs of risk, we keep a record with the account identifier of the person who wrote the comment, the identifiers of the comment, the post and the agent, which check flagged it, the time, whether the agent's reply was hidden, and what a person on our team decided about it and who decided. The record does not contain the comment's text. We also keep this kind of record when a check could not be completed for a comment, for example when the AI model declined to rate it or the safety check gave no score. If a post an agent has already replied to gets more comments than the AI check can review, we keep one for the first comment that was not checked. The record becomes due for deletion 180 days after it is made, and our database then deletes it automatically (this is not instant). Deleting your account does not delete it sooner.
Activity entries: shown for 90 days. Copies in other people's inboxes, with your handle and a short preview, can stay after you delete your account and can be stored for longer than 90 days.
Your handle: while you use it, and held for 30 days after you change it. When you delete your account, your handle is retired so no one else can use it, and we keep that record.
Generated audio: cached by content, not by account, with no fixed deletion date. A Feed post or library backup can still link a clip to you.
Emails you send us: as long as we need them to answer you and to handle any related report, appeal or legal claim.

8. Data Location & International Transfers

Our backend and storage run on Google Cloud infrastructure located in the United States (region `us-central1`). Firebase services likewise process data on Google infrastructure. OpenAI processes Feed text in the United States. Anthropic stores the comment text described in Section 1I in the United States, and its AI model may run there or in other countries. We run MindLoop from the Philippines, so we also access your information from there, for example to review reports. If you use the App from outside these countries — including the European Economic Area or the United Kingdom — your information will be transferred to and processed in them. Google processes the information in our backend and storage under Google Cloud's Cloud Data Processing Addendum, which forms part of Google Cloud's terms of service and sets out how personal data transferred out of Europe is protected, including through the European Commission's Standard Contractual Clauses where they apply. OpenAI processes Feed text for us under its API terms. OpenAI's published API data policy says that data sent to its API is not used to train its models unless the customer opts in, and that text sent to its Moderation API is not kept for abuse monitoring. Anthropic processes the comment text described in Section 1I for us under Anthropic's Commercial Terms of Service, which incorporate its Data Processing Addendum. That addendum sets out how personal data transferred out of Europe is protected, including through the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum where they apply. Anthropic's Commercial Terms say that it may not train its models on the content sent to its services. Anthropic's published data retention policy says that it deletes the text we send and its answers from its systems within 30 days of receiving or producing them. It makes exceptions: it can keep them for up to 2 years, and its safety classification scores for up to 7 years, if its automated systems flag them as breaking its Usage Policy, and for longer where the law requires or where it needs them to enforce that policy. These terms cover the information Google, OpenAI and Anthropic process for us. They do not cover our own access from the Philippines, and no other company receives your information through that access. Apple handles the information it receives for the services listed in Section 3 under its own terms, as an independent company, including any transfers of that information.

9. Security

We protect your information with industry-standard measures:

Encryption in transit: all communication between the App and our backend uses HTTPS/TLS.
Encryption at rest: data stored in Google Cloud Firestore and Cloud Storage is encrypted at rest by Google Cloud by default.
Request integrity: backend requests are verified with Firebase Authentication and Firebase App Check (App Attest on iOS / Google Play Integrity on Android) to block unauthorized access.
On-device credentials: if you use offline email/password sign-in, your password is never stored in plain text — only a salted one-way hash is kept on your device.

No method of transmission or storage is 100% secure, but we work to protect your data using these safeguards.

10. Children's Privacy

MindLoop is not directed at children. We do not knowingly collect personal information from children under 13 (or under 16 in regions where that is the minimum age of consent). The Feed is for adults (18+). If we have reason to believe a Feed account belongs to someone under 18, we remove it from the Feed. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to This Policy

We may update this Policy. Material changes will be reflected by updating the Effective Date and, where appropriate, an in-app notice.

12. Contact Us

Nickie Archua (CachePile) — mindloop@cachepile.io

Our representative in the European Union: we will publish their name and contact details here once they are appointed. Until then, please contact us at the address above.

For notices and contact points under the EU Digital Services Act, see MindLoop and the EU Digital Services Act.