Privacy Policy

1. Who this policy is from and what it covers

This policy explains how [COMPANY_LEGAL_NAME] (“we”, “us”) handles personal data in the 2Mind apps for iPhone and Mac and on the website use2mind.com. For data protection purposes we are the controller.

It does not cover services we link to but do not run, such as the Apple App Store. Those are governed by their own policies.

Postal address: [COMPANY_ADDRESS]. Privacy contact: privacy@use2mind.com.

2. What we collect

Account data. Your email address and authentication credentials, handled through our authentication provider. If you sign in with Apple or Google once those options are enabled, we receive the identifier and the email address that provider releases to us.

Content you create. The text you write or dictate, the audio recordings you attach, the images you capture, the transcripts and extracted text produced from them, and the tags, collections, summaries and to-do items 2Mind derives from that content. Your chat conversations with your own notes are also stored so you can return to them.

Learning signals. When you move an entry to a different collection, we record that correction so routing improves. It is tied to your account and to the entry involved.

Subscription data. Whether your account has an active 2Mind Pro entitlement, and the anonymous purchase identifiers our subscription infrastructure returns. We never receive your card number: payment is handled entirely by Apple.

Technical and diagnostic data. Basic app and device information such as app version, operating system version and device model, plus crash and error reports, used to keep the app working.

What you send us. If you write to a support address or use the contact form, we keep your message and your email address so we can answer.

3. What happens on your device, not on a server

2Mind uses Apple's on-device engines for two steps that would otherwise require uploading raw media for analysis:

• Speech-to-text. Voice recordings are transcribed on your iPhone or Mac.
• Optical character recognition. Text visible in a photo is extracted on your device using Apple Vision.

This means the analysis of your audio and images happens locally. The resulting entry — including the media file you chose to attach — is then stored in your 2Mind account so it can sync across your devices and be searched later.

4. What we send to AI providers, and why

To provide the features the app is built around, the content of your entries is sent to third-party large language model providers acting as our processors. This happens when 2Mind:

• generates tags for an entry;
• decides which collection an entry belongs to;
• writes or updates a collection summary and extracts open to-do items;
• answers a question you ask in chat, by reading across your entries;
• runs a background research job you have started.

These providers process the content only to return a result to us. We instruct them contractually not to use your content to train their models. We do not send your content to advertising networks, data brokers or analytics companies, and we do not sell it.

5. Why we are allowed to process it

Under the GDPR we rely on the following legal bases, and under the KVKK on the corresponding grounds in Article 5:

• Performance of a contract — running your account and delivering the features you asked for, including capture, tagging, filing, summaries, search and chat.
• Legitimate interests — keeping the service secure, preventing abuse, fixing crashes, and improving routing quality from the corrections you make.
• Legal obligation — keeping records we are required to keep, such as those relating to purchases.
• Consent — where we ask for it explicitly, for example before enabling an optional feature that needs it. You can withdraw consent at any time.

6. Who else is involved

We use a small number of processors to run the service. Each is bound by a data processing agreement:

• An authentication and database provider, which stores your account and your entries.
• Large language model providers, which generate tags, routing decisions, summaries, research results and chat answers.
• Apple, which processes your purchase and manages your subscription, and our subscription infrastructure provider, which tells the app whether your entitlement is active.
• A hosting and email provider used for the website and for support correspondence.

We do not otherwise share your content. We may disclose data if the law requires it, and we will tell you where we are permitted to.

7. Where your data is processed

Our providers may process data outside your country, including in the United States. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or another recognised transfer mechanism, and by the corresponding requirements under Turkish law.

8. How long we keep it

Your entries stay in your account until you delete them or delete your account. Deleting an entry removes it from the app immediately and from our backups within 30 days.

If you delete your account, we delete your content within 30 days, except where we must keep specific records — for example transaction records — for the period the law prescribes.

Crash and diagnostic reports are kept for up to 12 months. Support correspondence is kept for up to 24 months.

9. Your rights

Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider in a portable format. Under the GDPR these are Articles 15 to 22; under the KVKK they are Article 11.

Write to privacy@use2mind.com. We answer within one month under the GDPR and within thirty days under the KVKK. We do not charge for this, and we will not ask you for more information than we need to confirm it is your account.

If you are not satisfied, you can complain to your national supervisory authority. In Turkey that is the Personal Data Protection Authority (KVKK); in the EU it is the authority in your country of residence.

10. Security

Data is encrypted in transit with TLS and encrypted at rest by our infrastructure providers. Access to production systems is restricted to the people who need it. Sensitive keys, including any service-role credentials, are held on the server side and are never shipped inside the app.

No system is perfectly secure. If a breach affects your data and creates a risk to you, we will notify you and the relevant authority within the deadlines the law sets.

11. Children

2Mind is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, write to privacy@use2mind.com and we will delete it.

12. Changes

If we change this policy in a way that materially affects you, we will say so in the app or by email before the change takes effect. The date at the top of this page always reflects the current version.

13. Contact

Privacy questions and data requests: privacy@use2mind.com. Everything else: hello@use2mind.com. Postal address: [COMPANY_LEGAL_NAME], [COMPANY_ADDRESS].