Privacy Policy

1. About this policy

Mind Refuge ("we", "us", "our") respects your privacy. This policy explains what personal information we collect when you use our mobile application, what we do with it, where it is stored, and the rights you have over it.

This policy applies to:

• The Mind Refuge iOS and Android applications (the "App")
• The Mind Refuge website at mindrefuge.ca and any subdomains we operate (the "Site")

It does not apply to:

• Apple's App Store (governed by Apple's privacy policy)
• Independent practitioners, or any third-party websites, platforms or services that may be accessed through the Services. Such third parties operate independently and have their own terms and privacy policies, which govern your interactions with them.

2. Who we are

Mind Refuge is operated by 9406-0548 Québec Inc., doing business as Mind Refuge ("the Company"), a Québec-registered corporation established under the laws of the Province of Quebec, Canada.

• General contact: info@mindrefuge.ca

Privacy Officer

In accordance with section 3.1 of the Act respecting the protection of personal information in the private sector (Quebec, c. P-39.1, "Loi 25"), we have designated a Privacy Officer:

• Name: Jonathan Taillefer
• Email: info@mindrefuge.ca

You can contact the Privacy Officer directly with any privacy-related question, complaint, or request to exercise your rights (described below).

3. Personal information we collect

We try to collect as little as possible. The complete list:

When you save a personalized hypnosis session

If you use the "Create" feature to build a personalized hypnosis, we collect:

• The choices you make in the 6-step wizard: the challenge you selected (e.g. "Stress & Anxiety"), the trigger category and sub-trigger, your selected trigger states and desired states, your safe place, and your soundscape preferences (voice, ambient, music, isochronic tones, pacing, supra-liminal layer). These are required to assemble your personalized audio file.

We do not ask for your email to create, save, or download a session. If you voluntarily use the optional "Notify me" feature, we collect your email address solely to notify you when the requested hypnosis theme or feature becomes available. Every such email includes an unsubscribe link, and you may opt out at any time. Your session is identified only by a random token stored on your device, and you restore a purchase through Apple's or Google's "Restore Purchases" — not through an email link.

When you download a free NSDR session

You can listen to our free NSDR sessions on the Site without giving us any information. To download one, you enter your email address and we email you the download link. If you do not tick the optional box below the form, we use your address only to send that email, through our email provider, and we do not add it to any list. If you tick it, we add your address to our mailing list, with the date and the wording you agreed to, and send you occasional emails from Mind Refuge until you unsubscribe. We count downloads by session and by page of the Site, without any information about who downloaded.

When you purchase the personalized hypnosis

Depending on how you make your purchase (through the App or the Site), we receive certain transaction information from the applicable app store or our third-party payment provider, such as a transaction identifier, the product purchased and the purchase status. We use this information to confirm your purchase, provide access to your personalized hypnosis session and, where applicable, process refunds.

We do not collect or store your credit card number, billing address, or any other payment information. Payments made through the App are processed by Apple or Google Play, and payments made through the Site are processed by our third-party payment provider, each of whom processes your payment information in accordance with its own privacy policy. That information is processed directly by the applicable app store or our third-party payment provider and is not collected or stored by Mind Refuge.

When you use the app

• Crash and performance data via Sentry (see § 5 — Third Parties). This includes the device model, operating system version, and the JavaScript stack trace when an error occurs. It does not include your email, session selections, IP address, or any other content you provided.
• The number of times you have opened a library resource is counted on your device only and used to time our request for notification permission. This count never leaves your device.

What we do not collect

• Your name (unless you choose to include it in an email to us)
• Your phone number
• Your contacts, photos, location, microphone, or any other device sensor
• Your IP address
• Your browsing history
• Any advertising identifier (IDFA, IDFV)
• Any analytics data linkable to you across apps or websites

We do not use technologies that track your activity across third-party apps or websites for advertising purposes. Accordingly, where applicable, we do not request permission under Apple's App Tracking Transparency framework.

4. How we use your personal information

We use what we collect strictly for these purposes:

We do not:

• Use your personal information for marketing or to send promotional messages. The only exceptions are the optional "Notify me" service that you expressly request, which is used solely to send the specific notification you asked to receive, and the optional box on the free NSDR download form, which you tick only if you want occasional emails from us.
• Sell, rent, or share your personal information with third parties for their own use
• Build behavioural profiles about you
• Train AI models on your data

5. Third parties that process your data on our behalf

We use the following service providers to operate the app. Each is contractually bound to use your data only for the purpose we tell them.

This Privacy Policy does not apply to any independent practitioner, third-party website, platform or service that you may access through the Services. If you choose to contact or engage with a third party, any personal information you provide to that third party will be governed solely by that third party's privacy policy and practices. Mind Refuge has no control over and is not responsible for the privacy practices, content or services of any third party.

When personal information about a Quebec resident is transferred outside Quebec, we assess whether the recipient provides a level of protection that is comparable to that required under applicable privacy laws. Where appropriate, we implement contractual and other safeguards, including Standard Contractual Clauses, to protect your personal information.

6. Where your data is stored

• Quebec users: your personal information may be transferred outside Quebec, including to service providers located in the United States (Vercel, Upstash, Supabase, Sentry, Resend). Such transfers are carried out only where appropriate safeguards have been implemented, in accordance with applicable privacy laws.
• United States, European Union, and other jurisdictions: your data may be transferred to and processed in the United States or the region your service provider operates in.

If you want a copy of the Data Processing Addendum or transfer impact assessment for any of the above, contact our Privacy Officer.

7. How long we keep your data

• Your saved session selections (Upstash Redis): 30 days by default; 90 days if you purchased the personalized hypnosis. The countdown starts at session save time. After the applicable retention period expires, the record is automatically deleted. No email is stored on the session.
• Notify-me email list (Supabase): if you enter your email address in the App's "Notify me" feature, we store it solely to notify you when the content or feature you asked to be notified about becomes available. We keep it only for these notifications, and only until you unsubscribe or ask us to delete it. Every message includes a one-tap unsubscribe link, and you can opt out at any time through that link or by contacting support.
• Free NSDR mailing list (Supabase): if you tick the optional box on the free NSDR download form, we keep your email address, with the date and the wording you agreed to, until you unsubscribe or ask us to delete it. Without that box, we do not keep the address you enter.
• In-app feedback (Supabase): if you submit feedback, we keep your message and any optional email you included for as long as reasonably necessary to review and respond to your feedback, after which they are deleted.
• IAP receipt mapping (Upstash Redis): 2 years, so we can honour Apple- or Google-initiated refunds long after purchase.
• Cached audio file (Vercel Blob): 30 days from last generation, enforced by an automated daily purge. Deleted earlier when a refund is processed.
• Sentry crash data: 90 days retention on the Sentry side (Sentry's standard plan retention). De-identified.
• Email messages you send us (info@mindrefuge.ca): kept as long as necessary to resolve your request, then deleted within 6 months unless a longer period is required by law.

Notwithstanding the retention periods described above, we may retain certain personal information for a longer period where required or permitted by applicable law, including to comply with legal or regulatory obligations, resolve disputes, enforce our agreements, prevent fraud, or establish, exercise or defend legal claims. Once such information is no longer required for these purposes, it will be securely deleted or anonymized, as appropriate.

8. Your rights

Under Loi 25 (Quebec) and similar laws elsewhere, you have the right to:

1. Access the personal information we hold about you, and obtain a copy in a structured, commonly used format.
2. Correct information that is inaccurate, incomplete, or ambiguous.
3. Delete your personal information (also called "the right to be forgotten"). Note: if you have purchased the personalized hypnosis and request deletion, we will still retain the IAP receipt mapping only for as long as necessary to process Apple or Google refund requests and comply with applicable legal obligations, but we will delete the linked session content immediately.
4. Port your information to another service provider — we will send you a JSON export of your data.
5. Object to a specific use of your data (e.g. crash reporting via Sentry).
6. Withdraw any consent you previously gave, at any time.
7. File a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) if you believe we have not respected your rights.

To exercise any of these rights, email our Privacy Officer at info@mindrefuge.ca. We will respond within 30 days.

9. Automated decision-making

We do not use your personal information to make automated decisions that significantly affect you. The assembly of your personalized hypnosis is fully determined by your own selections — no AI inference, no algorithm ranking, no machine learning.

10. Children

Mind Refuge is intended for adults. We do not knowingly collect personal information from children under 14 (or under the minimum digital consent age in your jurisdiction, if higher). If you believe a child has provided us their personal information, contact us and we will delete it immediately.

11. Security

We protect your personal information using:

• HTTPS / TLS for all network communication
• Encryption at rest for sensitive data on Vercel Blob, Upstash Redis, and Sentry
• Apple's StoreKit JWS verification before unlocking any paid feature, so a forged receipt cannot bypass our payment check
• A short-lived UUID session token that lives only in react-native-mmkv on your device, not in any third-party storage

While we use reasonable administrative, technical and physical safeguards to protect your personal information, no method of transmitting or storing data over the Internet or through electronic systems is completely secure. Accordingly, we cannot guarantee the absolute security of your personal information.

If a security breach affecting your personal information occurs, we will notify you and the Commission d'accès à l'information du Québec as soon as possible in accordance with Loi 25.

12. Cookies and tracking

The Mind Refuge mobile app does not use cookies.

The Mind Refuge website at mindrefuge.ca may use cookies strictly necessary for the site to function (e.g. session cookies for the contact form). A cookie banner on the site, if applicable, will give you the choice to accept or refuse non-essential cookies.

13. Changes to this policy

We may update this policy occasionally — for example when we add a new feature or change service providers. We will:

• Post the new version on mindrefuge.ca/privacy
• Update the "Last updated" date at the top
• For material changes affecting how we collect or use your data, notify active users via the email address on file

Your continued use of the app after a change indicates acceptance of the revised policy.

14. Contact us

For any privacy question:

• Email: info@mindrefuge.ca (Privacy Officer — Jonathan Taillefer)
• General support: info@mindrefuge.ca

We respond within 30 days, usually within a week.