Privacy Policy

1. Introduction

Welcome to GoldMind. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website. GoldMind is a behavioural-awareness journal: a 30-second daily check-in that helps you notice the cognitive biases behind your spending, grounded in peer-reviewed behavioural-finance research.

We are committed to protecting your privacy and handling your data responsibly. Please read this policy carefully. By using GoldMind, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: When you create an account, we collect your email address, display name, and password (encrypted). Authentication is managed through Supabase.
• Profile Information: Your display name, optional avatar, and the preferences you set during onboarding or later change in your profile settings.
• Your Journal Entries: The spending events you log: amount, category, life area, spending driver, and any note you write. You type all of this yourself.
• Check-ins and Reflections: Your daily check-in responses, monthly decisions, end-of-week reflections, and your answers to the MoneyMind quiz.
• Budget Context: Optional monthly income range, budget settings, and balance snapshots that you enter to give your entries context.

2.2 Information Collected Automatically

• Usage Data: We collect information about how you interact with the app, including check-ins completed, entries logged, streaks, bias lessons viewed, and feature engagement. This data powers your personalised experience and progress tracking.
• Device Information: Device type, operating system version, app version, and general device identifiers necessary for app functionality.
• Analytics Data: The iOS app ships with no third-party advertising or analytics SDK. We derive aggregate, de-identified usage patterns (for example, “X% of users complete a check-in within 30 seconds”) from your activity to improve the product. These aggregates cannot be traced back to you.

2.3 Information from Third-Party Sources

We collect no information about you from any third-party source. Every piece of personal data we hold was typed in by you.

• No Third-Party Data Access: GoldMind holds no direct connection, API access, or credential to any external data authority or provider that could return information about you. We do not connect to your bank, read your card statements, request data under the Consumer Data Right (CDR), query credit bureaus or government agencies, or buy, licence, or import personal data from data brokers or advertising networks.
• No Scraping, No External Lookups: The app does not scrape websites, harvest research papers, or call out to any external database. It talks only to our own Supabase backend and, for purchases, to Apple and RevenueCat.
• Educational Content Is Shipped, Not Fetched: The bias lessons, the BFAS framework, and the academic papers referenced in the app are published research we cite by title, author, and DOI. That content is bundled with the app as static material. We do not host copies of copyrighted papers, and reading it triggers no request that involves you.

2.4 Information Collected Through Our Website

• Waitlist Email: When you submit the waitlist form, your email address is processed by Formspree on our behalf and forwarded to us. We use it only to send you product updates about GoldMind. You can unsubscribe from any email or ask us to delete your record at any time.
• Feedback Board: Our feedback page embeds a public board hosted by Canny (canny.io). If you choose to post or vote, Canny stores the email address and display name you sign up with under their own privacy policy. You can browse without signing up. We use Canny only to collect product feedback, never marketing data.
• Hosting Logs: Vercel, our website host, records aggregated, non-identifying request metadata (page, region, response time) so we can keep the site fast and secure. There are no advertising cookies, no fingerprinting, and no cross-site tracking on this website.

2.5 Subscription and Purchase Information

• Payment Processing: Auto-renewable subscriptions are sold and processed by Apple through the App Store. Apple handles your payment under its own privacy policy. We never receive or store your card number, billing address, or any other payment credential.
• Subscription Status: We use RevenueCat to validate App Store receipts and tell the app whether your subscription is active. RevenueCat receives the purchase receipt, the product purchased, and an app user identifier. It does not receive your name or the contents of your journal entries.
• Managing Your Subscription: You can view, change, or cancel your subscription at any time in your Apple ID settings. Cancellation is handled by Apple, not by us. Refunds are covered by our Refund Policy and the Australian Consumer Law.

3. How We Use Your Information

The following table summarises the data we collect, its purpose, and how long we retain it:

• Email & account details

  Purpose

  Authentication, account management, and communication

  Retention

  Until account deletion

• Profile & preferences

  Purpose

  Personalising your check-in, insights, and bias mapping

  Retention

  Until account deletion

• Check-ins & streaks

  Purpose

  Progress tracking, streaks, and daily missions

  Retention

  Until account deletion

• Spending entries & notes

  Purpose

  Showing you your own patterns over time

  Retention

  Until account deletion

• Bias mapping & quiz responses

  Purpose

  Generating your bias profile and lesson recommendations

  Retention

  Until account deletion

• Device information

  Purpose

  App compatibility, debugging, and performance optimisation

  Retention

  90 days

• De-identified usage aggregates

  Purpose

  Understanding usage patterns to improve the app

  Retention

  Indefinitely (cannot identify you)

• Waitlist email (Formspree)

  Purpose

  Sending product updates about GoldMind

  Retention

  Until you unsubscribe, or 24 months after your last activity

• Feedback posts (Canny)

  Purpose

  Collecting and prioritising product feedback

  Retention

  Until you delete your Canny account

• Subscription receipts (Apple, RevenueCat)

  Purpose

  Validating purchases and unlocking paid features

  Retention

  Duration of subscription + 7 years (tax and audit obligations)

4. How the Bias Algorithm Works

GoldMind maps your logged spending to cognitive biases using our BFAS-mapped algorithm. Here is how this works:

• Rules, Not a Black Box: The mapping is a deterministic, rules-based algorithm derived from published behavioural-finance research. It runs against your own entries in our database.
• No Third-Party AI: GoldMind does not send your entries, notes, check-ins, or any other personal data to any third-party AI service. We do not use your data to train any model.
• Not a Diagnosis: Bias mappings are heuristics intended to prompt reflection. They are not a clinical, psychological, or financial assessment of you.

4.1 Where Your Entries Live

Your entries are stored in your own account in our Supabase database, protected by Row Level Security so that no other user can read them. They are used to show you your own history and to generate your bias mapping. They are not shared with advertisers, data brokers, or AI providers, and they are not used to train any model.

5. How We Share Your Information

We do not sell, trade, or rent your personal information to third parties. We may share information only in the following limited circumstances:

• Service Providers: We use Supabase for database hosting and authentication, Apple and RevenueCat for subscription processing and receipt validation, Formspree for the website waitlist form, Canny for the public feedback board, and Vercel for website hosting. These providers only receive the minimum data necessary to perform their services and are bound by their own privacy policies.
• Legal Requirements: We may disclose your information if required to do so by law, in response to valid legal process, or to protect the rights, property, or safety of GoldMind, our users, or the public.
• Aggregated Data: We may share anonymised, aggregated statistics about app usage that cannot be used to identify any individual user.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal information:

• All data in transit is encrypted using TLS/SSL
• Passwords are hashed and salted using industry-standard algorithms via Supabase Auth
• Database access is restricted through Row Level Security (RLS) policies
• API keys and secrets are stored securely and never exposed client-side
• Regular security reviews of our infrastructure and codebase

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to implementing best practices.

7. Your Rights and Choices

You have the following rights regarding your personal data:

• Access: You can view your personal data through your profile settings at any time.
• Correction: You can update your account information and preferences directly in the app.
• Deletion: You can delete your account and all associated data from within the app at any time (Settings → Delete account). This removes your check-ins, entries, bias progress, budgets, decisions, quiz responses, and profile. You can also request deletion by contacting us at infogoldmind@gmail.com. We will process deletion requests within 30 days.
• Data Export: You can request a copy of your personal data in a machine-readable format.
• Withdraw Consent: You can withdraw consent for data collection at any time. Note that this may limit app functionality.
• No Tracking to Opt Out Of: The app contains no advertising trackers, no cross-site tracking, and no third-party analytics SDK, so there is nothing to switch off.

8. Data Retention

We retain your personal data only for as long as necessary to provide our services and fulfil the purposes described in this policy. When you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required by law to retain certain information.

Anonymised and aggregated data that cannot identify you may be retained indefinitely for research and analytical purposes.

9. Children's Privacy

GoldMind is designed for adults managing their own money, and for students and professionals building financial self-awareness. The Service is rated 13+ on the Apple App Store, and we do not knowingly collect personal information from children under the age of 13. If we become aware that we have collected data from a child under 13, we will take steps to delete that information promptly. Users in the European Economic Area between 13 and 16 may require parental consent depending on local law. If you believe a child has provided us with personal data, please contact us immediately.

10. International Data Transfers

GoldMind operates globally, and your data may be processed in countries other than your country of residence, including the United States (where our service providers Supabase, RevenueCat, and Vercel are based). We ensure that appropriate safeguards are in place for any international transfers of personal data in compliance with applicable data protection laws.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of any material changes by posting the updated policy within the app and updating the “Last Updated” date. Your continued use of GoldMind after any changes indicates your acceptance of the updated policy.

12. Australian Privacy Act Compliance

As an Australian-based service, GoldMind complies with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). This includes:

• Open and transparent management of personal information (APP 1)
• Giving you the option of not identifying yourself where practicable (APP 2)
• Collecting only information that is reasonably necessary (APP 3)
• Taking reasonable steps to ensure data quality and security (APP 6, 11)
• Providing access to and correction of your personal information (APP 12, 13)

If you are located in the European Economic Area (EEA), you may also have additional rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local data protection authority.

13. Financial Disclaimer

GoldMind is general financial-awareness software and a behavioural-awareness journal. It is not personal financial advice, a financial product, or a recommendation to acquire or dispose of any financial product.

We do not hold an Australian Financial Services Licence (AFSL), and we do not provide financial product recommendations. Nothing in the app or on this website takes into account your objectives, financial situation, or needs. If you need personal financial advice, please consult a licensed financial adviser.

All entries in the app are created by you, manually. We do not connect to your bank, read your card statements, or request data under the Consumer Data Right (CDR). We do not collect bank statements, transaction feeds, credit reports, or holdings.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Developer: Arabella Haythorpe

Email: infogoldmind@gmail.com

Website: mygoldmind.vercel.app

Location: Melbourne, Victoria, Australia