Privacy Policy

1. Introduction

This Privacy Policy explains how ABDEL PRIME LLC (“we”, “us”, “our”) collects, uses, and protects information when you use the Mentalis mobile application (the “App”) and the website mentalisapp.com (together, the “Services”).

Mentalis is built privacy-first. Three commitments shape everything below: we do not sell personal data, we do not show ads, and we do not read your private content (messages, passwords, keystrokes, or screen contents).

2. Information we collect

Account information

When you create a Mentalis account we collect your email address and a password (stored by our authentication provider in hashed form — we never see or store your plain-text password), along with basic account metadata such as your chosen display name and language preference (English or French).

Wellness and app activity data

To make the App work, we store the data you create in it: your routines and their completion state, guided-pause (intervention) sessions and their outcomes, wake/sleep time preferences, reminder settings, and consistency information such as your Discipline Score inputs. This data exists to show you your own patterns — it is never used for advertising or profiling.

Onboarding preferences

When you set up Mentalis, we ask a short series of questions about what you want to change — for example your main challenge, your goal, the moments you find hardest, your preferred coaching tone, and your wake and wind-down rhythm. These answers exist to personalize your plan, and they are handled carefully:

• Until you create an account, your answers stay only on your device. Nothing is uploaded while you browse or complete onboarding anonymously.
• If you create an account, we save a minimal, coded version of your selections to your account so your personalized plan and reset plan can follow you to a new phone or reinstall. If you choose to share a first name or preferred name, it is stored with your account too, and is used only to personalize your Home, Profile, and related in-app experiences across your devices. Your answer to “How did you find Mentalis?” is saved once with your account as first-party information, so it is not lost on reinstall; it stays within Mentalis and is never shared with advertising networks or our attribution provider. Several other answers are deliberately kept on your device only.
• Your answers are self-described preferences used for app functionality and personalization — they are not medical information and are never a diagnosis of any condition.
• The commitment screen is symbolic: if you choose to “seal” your plan by holding the on-screen graphic, nothing is scanned and no fingerprint or biometric data is collected or stored — we save only the fact that you confirmed your commitment.
• A plan choice made before checkout stays on your device; purchase intent is never uploaded.
• We never sell these answers, never use them for advertising, and never send them to our payment partners — RevenueCat and Google Play receive purchase information only, never your onboarding answers.
• Onboarding preferences are stored with your account by our backend provider (Supabase), protected in transit by HTTPS and by per-user access rules so only your signed-in account can read them. Deleting your account (see Account deletion) removes them along with your other account data.

Journal and reflection data

Reflections and journal entries you write are stored so they can be shown back to you across your devices. They are treated as the most sensitive data in Mentalis: they are never sold, never used for advertising, and never shared with third parties for their own purposes.

Protection and focus settings

If you enable the optional focus-protection features, we store your protection rules (which apps you chose to protect, and during which hours). If you grant the Android accessibility permission, it is used only to detect that an app you chose to protect is being opened so a mindful pause can be shown first. The permission is configured so the system does not share window content with Mentalis — the App does not read messages, passwords, keystrokes, or on-screen content, and does not take screenshots. Protection is off by default and can be disabled by you at any time.

Diagnostics and crash reports

To keep Mentalis reliable, the App can send crash reports and technical error diagnostics. These reports are configured privacy-first: they exclude personal identifiers and are scrubbed before leaving the device so that journal text, reflections, emails, and authentication tokens are never included. Diagnostic data is limited to technical context such as app version, device model, operating-system version, and the error itself.

Purchase and subscription information

When you purchase, renew, cancel, restore, or otherwise manage a Mentalis Premium subscription, we receive limited purchase and subscription information from Google Play and RevenueCat. This may include the product purchased, transaction status and timestamps, renewal or expiration status, and the Premium entitlement associated with your Mentalis account.

We use this information to activate and restore Premium access, maintain accurate subscription status, provide customer support, prevent fraud and abuse, improve billing reliability, and produce aggregated subscription analytics. Payment-card details are processed by Google Play and are never received or stored by ABDEL PRIME LLC.

Marketing attribution measurement

To understand which of our own marketing campaigns bring people to Mentalis, we may use Airbridge (a mobile attribution service operated by AB180) to measure where app installs come from and how our campaigns perform. Where available, permitted, and enabled, this involves processing a pseudonymous Mentalis user identifier (the internal account ID — never your email or name), device or advertising identifiers such as the Android Advertising ID, an Airbridge device identifier, technical device and app information needed for attribution, and a small set of milestone events: app install, app open, completing onboarding, and a verified account sign-up. To connect campaign performance with subscription outcomes, RevenueCat may send subscription lifecycle and revenue-attribution events to Airbridge; payment-card details are handled by Google Play and are never shared with Airbridge.

Attribution measurement is strictly limited. We do not send Airbridge your journal entries or reflections, urges, emotions, triggers, guided-session content, protection or blocked-app information, AI Guide conversations, routines, Discipline Score, first name, email address, phone number, or your answer to “How did you find Mentalis?”. We use this attribution data to measure and improve the performance of our marketing campaigns. Mentalis does not display third-party advertisements inside the app, and we do not send the sensitive Mentalis content listed above to Airbridge.

Attribution measurement runs only if you allow it: Mentalis asks for your permission in the app, and you can change your choice at any time from Profile. If you decline or later turn it off, Mentalis stops measuring new activity on your device; information already processed by our measurement partners, and subscription events processed as described above, are not retroactively affected. On Android, the Advertising ID can be reset or deleted by you in system settings and may be unavailable on some devices.

3. How we use information

• To provide, operate, and personalize the App’s features;
• To sync your data across sign-ins on your devices;
• To send transactional emails (such as email verification for your account);
• To diagnose crashes and improve reliability;
• To measure, where enabled and permitted, which of our own marketing campaigns lead people to Mentalis (attribution analytics — described in “Marketing attribution measurement” above);
• To process Premium subscriptions through the app-store billing systems, when enabled;
• To respond to support requests you send us;
• To meet legal, security, and fraud-prevention obligations.

We do not use your information for third-party advertising, and we do not sell or rent personal data to anyone.

4. Service providers

Mentalis relies on a small number of infrastructure providers that process data on our behalf, under their own security and privacy commitments:

• Supabase — authentication and database hosting for your account and app data.
• Sentry — privacy-first crash reporting and error diagnostics, as described above.
• Resend — delivery of transactional emails, such as account verification messages.
• RevenueCat and Google Play Billing (and Apple’s App Store billing, once Mentalis launches on iOS) — subscription management and payment processing when Premium subscriptions are enabled. Payment card details are handled by the app stores; we never see or store your card number.
• Airbridge (AB180) — mobile attribution and marketing campaign measurement, as described in “Marketing attribution measurement” above. See the Airbridge privacy policy.

We also use an AI service to power the optional AI Discipline Guide. Requests to it are made through our own backend, contain only the limited context needed to generate a supportive response, and are not used to build advertising profiles.

5. Data retention

We keep your information for as long as your account is active. Diagnostic data is retained only as long as needed to investigate and fix issues. When data is no longer needed, it is deleted or anonymized.

Certain purchase and subscription records may continue to be retained by Google Play, RevenueCat, or ABDEL PRIME LLC where reasonably necessary for transaction records, fraud prevention, dispute handling, security, accounting, or compliance with applicable law, including after a Mentalis account-deletion request.

6. Account deletion

You can request deletion of your Mentalis account and associated app data at any time by following the steps on our Delete account page, or by emailing support@mentalisapp.com with the subject “Mentalis account deletion request”. Account data is deleted or anonymized unless limited retention is required for legal, security, fraud-prevention, or compliance reasons.

7. Your rights

Depending on where you live, you may have rights to access, correct, export, restrict, or delete your personal data, and to object to certain processing. You can exercise these rights by contacting support@mentalisapp.com. We will respond to verified requests within a reasonable timeframe and as required by applicable law.

8. Children

Mentalis is not directed at children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal data from them.

9. Changes to this policy

We may update this Privacy Policy as the Services evolve. Material changes will be reflected on this page with an updated “Last updated” date, and — where appropriate — highlighted in the App.

10. Contact

Privacy questions and requests: support@mentalisapp.com
Company contact: admin@mentalisapp.com
ABDEL PRIME LLC