EFFECTIVE NOVEMBER 8, 2026

Privacy at MindCoda

This notice covers the MindCoda web app at mindcoda.app. MindCoda is a study-planning service. This notice explains the information handled when you use the MindCoda website or app and the choices you have over it.

Information we handle

We may process account details such as your email address and sign-in provider, plus the study content you choose to add: courses, tasks, deadlines, notes, flashcards, focus-session progress, and preferences. We do not ask for your school password.

Why we use it

We use this information to authenticate you, provide the MindCoda web study tools you choose, and help diagnose reliability issues. Google sign-in provides the basic identity details needed to create or access your MindCoda account; MindCoda does not receive your Google password. Cross-device sync is not presented as a guaranteed feature until it has completed production verification.

Optional features

Some features use information only after you choose them. A calendar connection uses the calendar information needed to show availability and avoid conflicts. Camera or photo access is used for material you select for study help. Notifications are used only for reminders you enable.

Web study reminders and app-icon badges

When available, push reminders require your choice to enable this device and permission from your browser or operating system. MindCoda associates its push endpoint and encryption keys with your signed-in account and session in private server tables. The schedule stores reminder identifiers, types, times, your time zone and unread counts. Notification wording is general: course names, task titles, notes and account details are not included. Your browser’s push provider, such as Apple, Google or Mozilla, processes the connection and delivery information needed to deliver the encrypted message.

You can turn reminders off for this device, choose quiet hours and separately control the unread-reminder badge in Profile. Device and operating-system settings also control notifications and badges. Delivery can be delayed or unavailable. Signing out or changing accounts clears this device’s reminder binding and requests server cleanup; if the connection is unavailable, server cleanup may take longer. Reminders on other enrolled devices are managed separately. A small device database stores opaque binding and receipt identifiers for account isolation and duplicate prevention; it does not hold your sign-in token, subscription endpoint or study content. Provider records and backups have separate lifecycles.

The optional screen-awake setting keeps the display awake during an active, visible Focus session when the device permits it. Media controls apply to audio MindCoda plays and use general titles; opening an external music app does not give MindCoda control of that app.

iPhone privacy lock and reminders

Privacy lock is optional. When it is on, MindCoda covers your workspace in the iPhone app switcher. You can lock MindCoda manually or choose how long the app waits after you leave before asking you to unlock. iOS verifies your identity using your device’s biometrics or passcode and tells MindCoda whether verification succeeded. MindCoda never receives your biometric data or passcode.

A running Focus timer can continue while MindCoda is locked. The lock screen inside MindCoda can show the time remaining, the next class time and the number of scheduled reminders. Each summary is off by default and can be enabled separately. Course and task names, notes and Coda chats stay covered while the app is locked. These privacy controls are stored on this iPhone.

iPhone study reminders are scheduled on the device when you enable them and grant iOS notification permission. Reminders use generic text by default. To show your name and task title in reminders, turn off Hide text in notifications in Profile → Privacy lock and enable details in Study reminders. iOS notification settings also control where previews appear.

Web subscriptions and payments

Stripe processes payments made on mindcoda.app, including Plus subscriptions and one-time AI Boost packs. You enter your card or other payment details on Stripe’s secure checkout page, and MindCoda does not receive or store your full card number. Stripe shares the information MindCoda needs to provide what you bought: Stripe customer and subscription identifiers, the product and price, billing period dates, payment, renewal and refund status, and any dispute or fraud warning on a payment. We keep these records with your account to turn paid access on and off, answer billing questions, prevent misuse and meet tax and accounting obligations. See Stripe’s privacy policy for how Stripe handles your payment information.

To manage or cancel a subscription you bought on mindcoda.app, go to Profile → Manage plan. This opens Stripe’s billing page, where you can turn off auto-renewal or update your payment method. A subscription bought in MindCoda’s iPhone app is managed through Apple instead, as described below.

Apple subscriptions in the iPhone app

Apple processes payments made in MindCoda’s iPhone app. When MindCoda checks or restores an Apple purchase, the app sends the Apple transaction identifier to MindCoda’s servers. We verify the transaction with Apple and keep account-linked purchase records, including transaction and product identifiers, expiration or revocation dates when available, and your subscription access status. We use these records to activate and restore paid access, reflect renewals and refunds, and prevent a purchase from being claimed by a different account. MindCoda does not receive your payment card details.

You can restore Apple purchases from Plans in the iPhone app and manage or cancel an Apple subscription through Apple’s subscription settings. See Apple’s privacy policy for how Apple handles your payment and purchase information.

Bot protection

When enabled, Cloudflare Turnstile checks your browser to help protect account forms from automated abuse. Its verification token is sent to Supabase Auth for validation. This does not verify your age or enable AI sharing.

Music for Focus

Apple Music and Spotify are optional. Playlist and album links you save stay in this browser for your signed-in account and can be removed in Focus. Apple’s embedded player loads only when you choose “Load Apple Music player”; Apple then receives the connection information needed to serve its player and may use cookies under Apple’s privacy policy. Spotify shortcuts open Spotify’s own app or website, where Spotify’s privacy policy applies. MindCoda does not connect to your music library or collect your music-service password or listening history. Music links and player content are not sent to Coda AI.

Google Calendar

Connecting Google Calendar is optional and separate from signing in. When you connect in Plan, MindCoda requests permission to read your calendar list, show event names and times from calendars you select, and check availability so study sessions can avoid conflicts. The named-event feed reads event identifiers, titles, start and end times, cancellation status, recurrence and version identifiers, whether an event marks time as free, and MindCoda’s own study-event markers; it does not request event descriptions or attendee lists.

The connected server flow stores encrypted Google refresh credentials in MindCoda’s Supabase backend so the connection can be renewed without asking you to sign in every time. Imported busy events, including their names, times and calendar/event identifiers, may be saved with your account’s planning records and encrypted device copies. Locking or signing out hides access to these records; it does not delete saved copies. The older browser-only availability import reads busy times, and its separate read-only event preview remains temporary unless you save an event as a task.

When you choose Add appointment and save, MindCoda sends the title and start/end times you entered to your primary Google calendar. Connected scheduling can also create a separate MindCoda Study calendar and create, move or remove MindCoda-managed study events after you approve a plan. Its scheduling changes are limited to events identified as MindCoda-managed; the appointment form does not edit unrelated existing events. Separately, you may select an existing event to edit its title and dates/times, then save those changes to Google. Changes notify guests and apply only to the selected occurrence of a repeating event. You may also explicitly select and confirm deletion of an event in a Google calendar you own. This deletes that event in Google Calendar and MindCoda and requests cancellation notifications to its guests. For repeating events, only the selected occurrence is deleted. MindCoda checks the event version before deletion; an event changed since you reviewed it must be refreshed first. Study-event writes do not include notes, source documents, AI answers or transcripts. Autopilot requires a separate approval of its rules and is available only when its background service is configured.

Calendar access does not grant permission to send content to AI. AI sharing requires the separate choices described below. MindCoda refreshes the named-event feed while the app is in use; updates may be delayed and are not represented as continuous background synchronization.

You can disconnect Google Calendar in Connections and revoke authorization in your Google Account. Disconnecting stops future access through that connection and removes its stored credentials after successful server processing. It does not delete appointments or study events already written to Google, and separately saved tasks, exports or backups have their own lifecycles. Use the account-deletion controls below to request removal of your MindCoda records.

Documents and routes you choose

When available and separately connected, Google Drive lets you select supported documents to preview. Its short-lived access token and preview stay in browser memory; a copy you choose to save becomes part of your MindCoda study records. Connecting Drive or uploading a file does not authorize sending its contents to AI. Gmail import is currently disabled.

If you add a travel reminder, the starting point, destination, room, time and travel estimate you enter are saved with your plan. Choosing Apple Maps sends the route information in that link to Apple. These reminders use your saved estimates while MindCoda is open; they do not provide background location tracking or live traffic estimates.

Welcome temperature

The welcome screen can show a model temperature for a representative city in your device’s time zone. This is not a measurement of your location. Choose “Use my location” on Home to allow a foreground device location request. Only an approximate area, rounded to two decimal places, is sent to our weather endpoint and MET Norway. Device coordinates are not saved in your browser or attached to your account; we do not track you in the background. Weather timestamps and the daily reminder use your device’s local time zone. We round the area coordinates before requesting public forecasts from MET Norway; your account details and IP address are not forwarded to that provider. A temperature may be cached in your browser session for up to ten minutes. A VPN or mobile network can change the approximate area.

Service providers

MindCoda uses Supabase to provide account authentication and cloud data services. Stripe processes payments made on mindcoda.app, and Apple processes payments made in the iPhone app. The website is delivered through OpenAI’s Sites hosting and may also be delivered through Cloudflare; like any website host, they receive standard request information such as your IP address and browser details when you visit. If you email support, Microsoft Outlook handles that email. When an AI study tool is enabled, the content needed for that request may be processed by the configured AI service. Provider handling, retention and any international transfers depend on the service, its account settings and applicable agreements. We do not claim that every provider has zero retention.

Usage analytics

Optional advertising and usage tracking are not enabled by this release. Google Analytics 4 is currently paused in MindCoda while its account privacy settings and provider terms are reviewed. The current implementation does not dispatch GA events, and a previous browser preference does not enable it. If analytics is offered later, it requires an affirmative choice; Google may then process browser and device information. Using MindCoda does not require optional analytics. Separate operational records used for security, reliability and usage limits may include your account identifier and bounded service-event metadata; they are not described as anonymous.

Google Analytics is paused while its account privacy settings are reviewed.

AI sharing: separate choices for each provider

OpenAI processes text study requests and selected material analysis through MindCoda’s Supabase backend. Requests can include your question, selected course material, notes, document or image excerpts, MindMaps content and relevant recent conversation context. With a separate opt-in, OpenAI processes eligible Coda text tutoring and Student Planner requests. That can include typed questions, relevant course excerpts, and recent conversation context. OpenAI separately processes voice transcription, natural speech and live voice conversation: this can include audio you record, text selected for speech and relevant study or conversation context. Questions, answers and generated material may be saved in your account.

Each provider requires its own affirmative sharing choice before the corresponding request is sent. Accepting account terms, signing in, uploading a file or allowing your microphone does not grant AI permission. You can decline and continue using non-AI study tools. In Settings, review OpenAI study-AI permission or choose “Stop future AI sharing” to withdraw AI permissions. OpenAI text study help and voice each ask separately when you use them. A change must reach the server to apply across devices; if it fails, the app reports that server withdrawal is unconfirmed.

Withdrawal stops future authorized requests; it does not recall information already sent or erase saved history. Retention, model-improvement settings and processing locations for MindCoda’s Google and OpenAI accounts have not yet been verified. We do not promise zero retention or that all submitted content is excluded from model improvement. Review OpenAI API terms and OpenAI API data controls for provider information; account-specific settings still require confirmation.

Deletion and retained copies

You can permanently delete your account in Profile → Settings & privacy → Delete account. Type DELETE to confirm. The app reports completion only after the server removes the account and saved study data. Request account deletion from the email address associated with your MindCoda account, or contact support for access or correction requests. A request is not confirmation that deletion has completed. Signing out does not erase cloud records. Provider records, backups and separately exported copies have their own lifecycles. Backup expiry and deletion-completion timing are not yet verified; no deadline is promised.

Device storage

The offline shell caches public application files rather than private API responses. Signed-in study tools also keep encrypted device copies for offline work; unsynced edits can remain after sign-out, locked to their account. Signing out is not a request to erase those records. Separately downloaded exports and saved music links have their own device lifecycle. Keep exported study files private, especially on shared devices.

Your choices

You can edit or remove content in MindCoda. You can sign out at any time, manage connected-provider permissions through the provider, and request account deletion from the app’s Privacy & Data area or by contacting support. Account records remain until removed through supported controls or a completed support process, subject to applicable retention. See the deletion status above.

Security and changes

MindCoda uses encrypted HTTPS connections for its website and app services. No method of transmission or storage is perfect, so please keep your device and account credentials secure. We may update this notice as MindCoda changes; the effective date above will be revised when we do.

Contact

For privacy questions or account help, contact mindcoda.app@outlook.com.