Privacy Policy
1. Information we collect
Mental.OS collects information you provide directly, including your username, optional email address, password hash, optional display name, bio, profile settings, submitted programs, Wall posts, diary entries, tasks, action responses, feedback, and information you enter when using program-creation tools.
We also store activity generated through the Service, such as programs viewed or completed, saves, reactions, follows, friendships, social activity, points, streaks, unlocks, purchases, Arena results, device or session information, and basic security or diagnostic logs.
2. How we use information
We may use information to:
- Provide, personalize, maintain, and improve the Service.
- Save your progress, private entries, preferences, and account history.
- Operate profiles, social features, leaderboards, rewards, moderation, analytics, support, and security systems.
- Generate or improve programs when you deliberately use an AI-assisted creation feature.
- Communicate with you about your account, the Service, policy changes, support requests, or features when permitted by law.
- Investigate abuse, fraud, security incidents, or violations of our Terms of Service.
- Comply with applicable law and valid legal process.
3. Diary entries and other private content
Diary entries, private tasks, and private action responses are not displayed on public profiles, leaderboards, or social feeds. We do not routinely monitor or review their contents.
Access is restricted to authorized personnel and may occur when reasonably necessary to operate, maintain, secure, troubleshoot, or improve the Service; fulfill a user support, access, export, or deletion request; investigate abuse, fraud, security incidents, or violations of our terms; protect the rights, safety, or property of users or others; comply with applicable law or valid legal process; or evaluate or complete a business transaction described below. Diary entries may be included when an authorized administrator deliberately runs a diary or full-data export.
Administrative access does not make private content public. We may add or maintain access and export logs for security and accountability.
4. Public information
Depending on your settings and activity, public information may include your username, display name, bio, avatar, profile appearance, public programs, Wall posts, public activity, creator information, social counts, achievements, and leaderboard placement. Private profiles and privacy settings may limit some of these surfaces, but information you intentionally post publicly can be viewed and copied by others.
5. AI-assisted features
When you deliberately use an AI-assisted creation or editing feature, the text and context needed to complete that request may be sent to the AI provider configured by the operator, such as Google Gemini or an OpenAI-compatible provider. The provider processes that information under its own terms and privacy practices. Do not include names or other highly identifying information unless it is necessary and you are comfortable sending it to the configured provider.
Diary entries are not automatically sent to an AI provider merely because they are stored in your account. If a future feature uses private content with AI, the Service will provide an appropriate disclosure or choice when required.
6. How information may be disclosed
We may disclose information:
- To hosting, infrastructure, email, security, analytics, payment, AI, moderation, or other service providers and contractors that help operate the Service.
- When you direct us to disclose it or make it public.
- To comply with applicable law, a court order, subpoena, or other valid legal process.
- To investigate or prevent fraud, abuse, security threats, or harm.
- To enforce our agreements or protect the rights, property, or safety of the Service, users, or others.
- As part of a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar business transaction, subject to applicable notice and legal requirements.
7. Sale and sharing of personal information
As of the effective date above, we do not sell or share personal information as those terms are defined by applicable privacy law. We do not sell diary text, private tasks, or private action responses.
Our business practices may change as the Service develops. Before beginning a materially different sale or sharing practice, we will update our disclosures and provide any notice, consent mechanism, opt-out method, preference-signal support, or other choice required by applicable law. Service-provider disclosures and business transfers are not treated as a sale in every jurisdiction, but they are described in this policy for transparency.
8. Cookies and third-party resources
We use PHP session cookies and local browser storage where needed to keep you signed in, remember preferences, and operate Service features. The Service may load resources such as Google Fonts, which can disclose basic connection information such as your IP address and browser details to the provider. We do not currently use third-party behavioral advertising trackers.
9. Security and retention
Passwords are stored using one-way password hashing. We use reasonable administrative and technical safeguards, but no service can guarantee absolute security. We retain information for as long as reasonably needed to provide the Service, maintain security and records, resolve disputes, enforce agreements, comply with law, or complete the purposes described in this policy. Retention periods may differ by category.
10. Your choices and rights
Depending on your account and applicable law, you may be able to:
- Edit your profile, email, appearance, and privacy settings.
- Download a copy of account data through available self-service or administrator-assisted export tools.
- Delete individual private entries or request account deletion.
- Make your profile non-public where that setting is available.
- Request access, correction, deletion, or information about applicable disclosures.
- Opt out of a qualifying sale or sharing practice if one is introduced and applicable law provides that right.
- Appeal or complain to an appropriate privacy regulator where available.
Account deletion may remove or de-identify account information while allowing public programs to remain under the content license in the Terms of Service. We may retain limited records when reasonably necessary for security, fraud prevention, legal compliance, dispute resolution, or enforcing our agreements.
11. Children
The Service is not intended for children under 13. If we learn that we collected personal information from a child under 13 without legally valid authorization, we will take appropriate steps to delete it.
12. Contact
For privacy questions or requests, use the feedback form. We may need to verify your identity before completing certain requests.
13. Changes to this policy
We may update this policy as the Service and applicable law change. The effective date and version above will be revised when the policy changes. We will provide additional notice or obtain consent when required for a material change. A policy update does not automatically authorize us to apply materially expanded uses of previously collected sensitive or private information when applicable law requires additional notice, consent, or choice.