Privacy Policy
Last updated: August 22, 2026
App-owned notice
This page is maintained by Simply Mindfull Moments to answer common privacy questions about the Simply Mindfull Moments platform. It describes what the app currently does with your data, not independent legal certification. If you have questions about your specific situation, please contact us or consult a privacy professional.
HIPAA data vs. consumer health data
“Not covered by HIPAA” does not mean unprotected. Health information falls into two different legal buckets, and what you write in Simply Mindfull Moments sits firmly in the second one.
Protected health information (HIPAA)
Information held by a healthcare provider, health plan or clearinghouse — or by a vendor working on their behalf. Used directly by you for your own self-care, Simply Mindfull Moments is none of those, so what you record here is generally not protected health information.
Consumer health data (state law)
Your mood check-ins, journal entries and anything else you record about your mental wellbeing. This is protected — by Washington My Health My Data, Nevada SB 370, CCPA/CPRA and similar state acts, plus the FTC Act and the FTC Health Breach Notification Rule.
What the difference means for you
- You get either way: access to your own data, a portable export, deletion, withdrawal of consent, no sale, no targeted advertising, and opt-in consent before sensitive data is processed.
- HIPAA would add: a Notice of Privacy Practices, an accounting of disclosures, amendment rights, and provider-side obligations such as workforce training and signed agreements with every vendor in the path.
Simply Mindfull Moments would become covered if a licensed clinician delivered treatment through it, if we engaged with an employer health plan as its business associate, or if insurance were billed. Those triggers and the gaps we would close are listed in the HIPAA readiness & gap checklist.
What we collect and why
Every category of data Simply Mindfull Moments holds is listed below, together with the reason we collect it and how long we keep it. Nothing you write in Simply Mindfull Moments is used for advertising, profiling, or to train AI models.
Consumer health data
Mood check-ins and their optional notes, journal entries, entry timestamps.
Why: Show you your own history, trends and insights.
How long: Kept while your account is active; deleted when you delete an entry or the account.
Account
Email address, authentication state, email-verification status, display preferences.
Why: Sign you in, secure the account, remember your settings.
How long: Kept while your account is active.
Consent and privacy choices
Marketing opt-in, Global Privacy Control signal, consent event history, privacy requests you submit.
Why: Honor your choices and keep a record proving we did.
How long: Consent and request records are kept as evidence of compliance, then deleted on schedule.
Product usage
Which features you open, monthly quota counters for the free plan.
Why: Enforce free-plan limits and find what to fix or improve.
How long: Counters reset monthly; usage events are deleted with your account.
Subscription and billing
Plan status, billing period dates, payment-provider identifiers. Never card numbers.
Why: Run Simply Mindfull Moments Plus and consultation credits, and show your billing state.
How long: Kept as long as needed for the subscription and financial records.
Consultations
Bookings, consultation credits, order records.
Why: Deliver and record the sessions you purchased.
How long: Kept with your purchase history.
Merchandise
Orders, line items, fulfillment events, the shipping address you enter at checkout.
Why: Ship your order and support returns and exchanges.
How long: Kept for the returns window and applicable financial records.
Organization membership
Optional membership, your separate opt-in flag, the aggregate report access log.
Why: Let you contribute to aggregate-only wellbeing reports and audit who viewed them.
How long: Kept while you remain a member; the access log is retained for audit.
On your device only
Your emergency plan, entries drafted before you sign in, cookie and consent flags.
Why: Keep these private to your device.
How long: Stays on the device until you clear it; never uploaded to us.
What we never collect
- Biometric identifiers, faceprints, voiceprints or genetic data.
- Precise location or background location tracking.
- Your contacts, calendar or other apps on your device.
- Card numbers — payments are handled entirely by our payment provider.
Families, kids and teens
We have separate rules for children under 13 and teenagers 13–17. Kids mode is device-only and collects nothing from the child; teen mode stores only calm-tool totals and never uploads a teen's written content. See the Kids & teen privacy and compliance page for the full notice, consent, retention, and rights information.
How we store and protect your data
Simply Mindfull Moments stores your data in a managed backend. Traffic between your browser and Simply Mindfull Moments is served over HTTPS, and access rules are enforced in the database itself so each record is returned only to the account that created it. Sensitive account actions require a confirmed email address. We do not sell your personal data or share it with third parties for advertising. Full detail is on our security practices page.
Your mood and journal entries are tied to your account. Until you are signed in, any entries are stored locally on your device and are not backed up to our servers. Once you create an account, your data is synced so you can access it across devices.
How we use AI
Simply Mindfull Moments uses AI in exactly one place: translating the app’s own wording — buttons, headings, page copy — when you switch languages. Translated wording is cached so the same phrase is only ever translated once.
- Your entries are never sent to an AI model. Journal entries, notes, mood check-ins and emergency plans are excluded from translation and from every AI request we make.
- Nothing you write is used to train, fine-tune or improve any AI model, ours or anyone else’s.
- AI does not make decisions about you. There is no automated profiling, risk scoring, diagnosis or eligibility decision anywhere in Simply Mindfull Moments.
- Simply Mindfull Moments has no AI chatbot or companion. If you are in crisis, the app points you to real human help on our crisis support page rather than generating a response.
Third parties that process data for us
We do not sell your personal data and we do not share it with advertisers or data brokers. The services below process limited data strictly on our instructions so the app can work. Each one receives only what its job requires.
Lovable Cloud (hosting, database, authentication, file storage)
Runs the app and stores your account and entries
What it receives: Everything you save to your account: mood check-ins, journal entries, notes, settings, and your email address for sign-in.
Never receives: Nothing is withheld here — this is our own backend, protected by per-account database rules.
Stripe (payments)
Takes payments for Plus, consultations and merchandise
What it receives: Your email address, the amount, and the plan or item purchased.
Never receives: Your journal entries, notes, mood data, or anything you write in the app.
Shopify (merchandise fulfilment)
Handles merchandise orders and shipping
What it receives: Your name, shipping address, email and the items ordered.
Never receives: Your journal entries, notes, mood data, or your Plus subscription details.
Resend (transactional email)
Delivers reminders, receipts, renewal notices and notes you scheduled to yourself
What it receives: Your email address and the contents of the message you asked us to send — including a note-to-yourself if you scheduled one for delivery.
Never receives: Your journal entries, mood history, or any data you did not ask us to email you.
Lovable AI Gateway (Google Gemini) — interface translation only
Translates the app’s own wording when you switch languages
What it receives: Only the app’s fixed interface text — headings, buttons and page copy written by us. Requests carry no account identifier.
Never receives: Your journal entries, notes, mood check-ins, emergency plan, email address, or any other personal data.
If we add or replace a processor that handles your personal data, we will update this list and the “Last updated” date above.
Your rights
Access
You can view your mood history and journal entries at any time from your account.
Export
You can request a copy of your data in a common, machine-readable format.
Delete
You can delete individual entries or your entire account and associated data.
Control
You can update your email, password, and communication preferences from your account settings.
Data retention
We keep your mood and journal data for as long as your account is active. If you delete your account, we remove your personal data from active systems within a reasonable time and securely archive or delete it according to our backend provider’s retention policies.
If you join through an employer or university
Joining an organization is optional, and contributing to its wellbeing reports is a separate opt-in you can withdraw at any time. Reporting access is granted per person by role: administrators can read aggregate reports, export them, and manage organization settings and access; viewers can read and export aggregate reports only. Neither role can see an individual mood check-in, a journal entry, a note, or a member list — reports are produced by protected database functions that return group totals only, and nothing is shown unless at least 25 opted-in members contributed to that exact selection.
No one can grant themselves a role; only an existing administrator of that organization can add or remove access. Every report view and export is recorded in an access log with the person, their role, the date range and the cohort, and only administrators of that organization can read that log.
Teens (13–17)
Teens aged 13 to 17 may use the teen calm tools only with a parent or legal guardian who confirms consent from their own account; that consent is recorded with its date and notice version, and either the parent or the teen can withdraw it at any time.
For a linked teen we store only which calm tool was opened and how long it was used. Anything a teen writes in a teen tool stays on their device and is never uploaded. A parent sees totals only — sessions, minutes and last activity — never content, feeling words, journal entries, notes, or mood check-ins. Teen activity is never used for advertising, ad targeting, profiling, recommendation scoring, AI training, or sale or sharing of data, and the teen area contains no public posting or messaging. Full details are on the teen safety and privacy page.
Children under 13
The main Simply Mindfull Moments app is not intended for children under 13, children cannot create accounts, and we do not knowingly collect personal information from a child. If we learn that an account belongs to a child under 13 we delete it.
Kids mode is the one place a child under 13 may use, and only after a signed-in parent or legal guardian with a confirmed email address records verifiable consent and enters a one-time code on the child's device. Kids mode is device-only: we collect nothing from the child — no account, no login, no activity records, no free text, no analytics, no advertising or personalisation, and no third-party scripts. The only data stored is the parent's own consent record (the child's first name and birth year as typed by the parent, the consent date and notice version, and the unlock code), which the parent can review, delete, or withdraw at any time from their account. Full details are on the kids mode parent guide and consent notice.
Not a medical or healthcare service
Simply Mindfull Moments is a self-care tool and is not a substitute for professional mental health treatment, diagnosis, or advice. That is why what you record here is consumer health data under state law rather than protected health information under HIPAA — protected, but under a different set of rules, as described above. If you are a healthcare provider using Simply Mindfull Moments with patients, you are responsible for your own professional and legal obligations; see the HIPAA readiness checklist and clinician onboarding steps.
Emails we send
- Reset Kit confirmation. When you request the free 7-Day Mindfull Reset Kit, we send one email with your download link. It is sent once, even if you sign up again.
- Weekly wellness emails (optional). If you agreed on the signup form, you may receive a gentle weekly wellness email. These are delivered by our newsletter provider, who receives only your first name and email address.
- Unsubscribing. Every email includes an unsubscribe link. You can also email hello@simplymindfullmoments.org and we'll remove you.
Our emails are for general wellbeing, not medical or mental-health treatment. We never sell your email address.
Cookies and analytics
We use only essential cookies and local storage needed for authentication and app functionality. We do not use third-party advertising trackers. We may use privacy-focused analytics to understand feature usage in aggregate form, but this data is not linked to your journal or mood entries.
Contact us
If you have questions about this Privacy Policy, want to exercise your data rights, or need help with your account, please contact us.
We may update this policy as the app grows. When we do, we will update the “Last updated” date at the top of this page and, for significant changes, notify you through the app or by email.
Act on this policy
Download everything we hold about you, delete your account, or submit a formal request about your mood, journal, and account data.
You'll be asked to sign in first — we verify every request against the email address on your account, and these tools are private to you.
Still have questions? Read our About page or return home.