Privacy Policy

1. Web Services, Hosting & Typography

When you visit our website (mindcitadel.app), your browser sends technical connection information, including your IP address, to the server delivering the pages. We rely on our legitimate interest in making the website available to visitors for this necessary delivery processing (GDPR Article 6(1)(f)).

• Typography: The website serves EB Garamond and Inter font files from its own domain. Font loading does not request font assets from Google or another third-party font host.
• Appearance Preference: The website stores your selected light or dark theme in your browser's local storage so the choice is remembered. This local preference is not sent to us as an analytics profile. The theme value is written when you choose an appearance and has no automatic expiry. It remains until you clear the site data or your browser removes it.
• Zero Web Trackers: We do not deploy third-party advertising cookies, conversion pixels, or fingerprinting scripts on our web pages.

Contacting the developer

If you email us, we receive your address, message and any information you choose to include. We use this to respond to your enquiry, not to add you to marketing. See correspondence and retention, your rights and operator and provider details. Please do not send sensitive records or complete backups.

2. App Development: Local Data & Analytics

MindCitadel stores ambitions, daily disciplines, reflections, and focus records in a local SQLite database inside the iOS app sandbox. We do not operate remote user accounts or a cloud database for these records, and the mobile app does not use behavioral analytics SDKs. This does not mean the product makes no network requests: purchase validation and optional error diagnostics can involve off-device processing. Optional Apple Health writes are described separately below.

We process the records needed to provide the local features you request on the basis of performance of our agreement with you (GDPR Article 6(1)(b)). Optional HealthKit writes and diagnostics have separate consent choices, described below.

3. On-Device Storage

Local application data is stored in a SQLite database inside the iOS application sandbox. Access to files on your device is subject to iOS and your device's passcode and data-protection settings.

MindCitadel does not operate a remote backup server or receive the local database through a server. If you choose to export or share a backup, it may be accessible to services or people with whom you save or share it; see section 7.

On-device features can use additional copies: scheduled notifications may contain discipline titles; shared storage used by widgets can contain discipline titles and completion state, ambition titles, your morning intention, lifespan summaries and focus status. Active ambition titles and target dates may be indexed in device search. These are device/operating-system integrations, not a developer-operated cloud database. Their availability and visibility depend on the app build and your device settings, including notification and widget visibility.

4. Apple HealthKit Integration (Write-Only)

MindCitadel optionally integrates with Apple HealthKit to sync elapsed focus sessions as Mindful Minutes (HKCategoryTypeIdentifierMindfulSession). Syncing requires your explicit authorization. The legal bases for this optional health-data processing are your consent (GDPR Article 6(1)(a)) and explicit consent (Article 9(2)(a)). You can stop future writes by disabling Apple Health sync in the app or revoking its write permission in Apple Health. Withdrawal does not affect processing that was lawful before withdrawal or delete sessions already saved to Apple Health; manage those records in Apple Health.

• Write-Only Scope: The optional integration writes the duration and timing of completed or elapsed focus sessions as Mindful Minutes. It also uses a session identifier to avoid duplicate writes.
• Zero Read Access: MindCitadel does not read, aggregate, or inspect your existing health or medical history.
• Health Data: The app does not send HealthKit records to the developer, RevenueCat, Sentry, or advertising networks. Apple Health storage and any synchronization you enable through Apple are governed by your Apple settings and Apple's privacy information.
• Availability: Health sync depends on the app build, device and authorization. Choose it in Settings > Health & widgets. If it is unavailable, focus sessions can still be recorded locally; Health permission is not required for those local records.

5. Lifespan & Profile Data

To render the Memento Mori lifespan matrix and perspective calculations, you may optionally input your date of birth and target lifespan in years.

• This information is stored in the local SQLite database and is not automatically sent to MindCitadel servers or used for profiling or marketing.
• A plaintext copy may be included in a JSON backup that you choose to export. After export, handling depends on where you save or share the file.
• You can edit these values in Settings > Lifespan & profile. The app does not currently offer selective erasure of these fields; Settings > Data & backup > Erase all data removes all local app records, including profile settings. This does not remove copies in operating-system backups or exported files.

6. Purchases, Subscriptions & RevenueCat

On iOS, in-app purchases and subscription plans are billed through Apple Media Services via the App Store. This policy describes the planned iOS release.

The mobile app uses RevenueCat (RevenueCat, Inc.) to process purchase-related requests and verify paid-access status with the applicable store. RevenueCat receives an app user identifier and purchase information needed for that purpose. Store billing and payment details are handled by Apple.

• Payment card details are handled by the applicable store and are not processed by MindCitadel. Purchase-related identifiers and information are processed by RevenueCat to support entitlement status.
• We use purchase-related identifiers and information to provide, restore, and verify paid access under our agreement with you (GDPR Article 6(1)(b)). Without this processing, we cannot verify a purchase or restore paid access. Store providers explain their own billing and account processing in their privacy notices.

7. Data Retention, Deletion Scope & Portability

For core app records stored locally by default:

• Retention: Your data remains on your physical device for as long as you keep the app installed, or until you choose to delete it.
• Application Deletion: Removing MindCitadel deletes the app's local database. Copies in operating-system backups and exported files are not removed by uninstalling it.
• In-App Erase: You can permanently wipe local records and profile settings via Settings > Data & backup > Erase all data. This keeps a separate record of verified paid access in platform secure storage so that clearing your app records does not remove your purchase. It records your verified plan, expiry, and verification details, contains no receipt or app user ID, and is excluded from record exports. If your pass has expired, choose MANAGE DATA & PRIVACY on the access screen to open Data & backup without purchasing or restoring a pass.
• Data Portability: You can export an unencrypted plaintext JSON backup of your local records and profile settings via Settings > Data & backup > Export backup (JSON), including from Data & backup opened through MANAGE DATA & PRIVACY on the expired-pass screen.

A JSON backup contains ambitions, checkpoints, disciplines and completion history, morning intentions, evening audits, focus sessions, and profile/settings values, including birth date and reminder preferences. It excludes diagnostics consent, store receipts and the separate purchase-verification cache. Export opens the system share sheet: save a copy to a destination you choose. The app removes its temporary export afterward; copies you save or share remain under your control and that destination’s handling.

Restore from file replaces the app’s current records and settings rather than merging them. Export any current records you want to keep first. Restoring a backup is separate from restoring paid access and does not import diagnostics consent or grant Health permission. The app attempts to reconcile reminders, device search and widget copies after restore or erasure; if it reports incomplete cleanup, reopen Data & backup to retry. Erasure does not remove exported copies, operating-system backups or records already in Apple Health.

Support Correspondence & Provider Records

When you email us, we receive your email address, any name you provide, message contents, attachments, and email delivery information. Support and privacy correspondence is handled through Google Workspace. Share only what is needed to explain the issue; please do not send your complete app records, health information, payment-card details, or passwords. We may ask for limited order or technical information when necessary to investigate a purchase or fault. Providing optional detail is your choice, although we may be unable to resolve an issue without information relevant to it. Contacting support does not subscribe you to marketing.

We keep correspondence for the time needed to handle the request and any related follow-up. Where a legal obligation or an actual or reasonably anticipated dispute requires evidence, we retain only the relevant information for that obligation or dispute, then delete it. Retention required by law relies on GDPR Article 6(1)(c); establishing, exercising, or defending legal claims relies on our legitimate interest in protecting legal rights (Article 6(1)(f)). Deleted email may remain temporarily in provider recovery or backup systems under its deletion process. Purchase records are needed for verification, restoration, and resolving purchase disputes; uninstalling the app does not instruct RevenueCat or the store to erase those records. Diagnostic reports already received by Sentry follow the service's retention and deletion arrangements, separately from the on-device reporting switch. Contact us for access or deletion requests concerning information processed on our behalf.

8. Your Data Protection Rights

Where the GDPR applies, you may request access, correction, erasure, restriction of processing, and portability, subject to the conditions in the law. You may also object to processing based on legitimate interests and withdraw consent at any time.

For local app records, use the app's editing, export, and erase tools. An expired pass does not block access to Data & backup from the in-app access screen. Local erasure does not delete exported files, operating-system backups, Apple Health records, or information already held by purchase or diagnostic providers. Disabling diagnostics stops future reporting; it does not itself delete reports already received by Sentry.

To exercise rights concerning information processed by the developer or on the developer's behalf, contact [email protected]. We normally respond without undue delay and within one month. If the law permits an extension because of complexity or the number of requests, we will explain the reason within that first month; the extension is no more than two further months. We may request information proportionate to confirming your identity when necessary. Requests are normally free of charge; any refusal or charge must meet the conditions in applicable law and will be explained. For processing by a store provider for its own purposes, you may also contact that provider directly. You do not need to send us your app records or a backup to make a request. We process correspondence needed to respond to service requests under Article 6(1)(b), and to comply with data protection requests under Article 6(1)(c). For other enquiries, we rely on our legitimate interest in responding to people who contact us (Article 6(1)(f)).

You have the right to complain to a data protection supervisory authority, includingthe Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). You may also complain to the authority in the EU/EEA country where you habitually live, work, or believe an infringement occurred. Contacting us first is not a condition of that right.

9. Children’s Privacy (Age Policy)

MindCitadel is intended for general audiences interested in discipline, focus, and Stoic philosophy. It is not directed at or designed for children under 13 years of age (or under 16 years of age in the European Economic Area and United Kingdom). These limits describe our intended audience and do not replace the rules on a minor's contractual capacity or consent. If you believe a child below these limits has sent us personal information, contact us so we can investigate and take appropriate action.

10. Optional Technical Error & Crash Reporting (Sentry)

Automatic crash and error reporting is strictly optional and disabled by default. You can enable or disable reporting via Settings > Data & backup > Send diagnostics. If a pass has expired, choose MANAGE DATA & PRIVACY on the access screen to reach Data & backup and withdraw consent without purchasing or restoring a pass. The legal basis is your consent (GDPR Article 6(1)(a)). You can use the app without enabling diagnostics. Withdrawal does not affect processing that was lawful before withdrawal. Diagnostics are collected solely to resolve technical app failures and stability issues; they are never used for user profiling, advertising, or behavioral analytics.

When enabled, reports are processed by Functional Software, Inc. (Sentry). Reports contain technical runtime failure information: error messages, stack traces with build debug IDs, application version and build number, operating system version, device architecture/model, and a random event identifier.

• Diagnostic Filtering: App records, exported backups, purchase receipts, and HealthKit data are not sent as structured diagnostic data. The app removes user details, request data, and breadcrumbs, and redacts common email and token patterns from error text. Runtime error messages and stack traces are included and may contain other text emitted by app code.
• Reporting Configuration: Automatic performance tracing, session tracking, screenshots, view hierarchy, and breadcrumbs are disabled. This filtering does not mean reports are anonymous; Sentry also receives the network information needed to deliver a report.
• Revocation & Local Cleanup: Toggling diagnostics off stops future reporting, closes the reporting transport, and attempts to remove cached native crash reports from the device. Erase all data also withdraws reporting consent and attempts this cleanup. If cleanup fails, the app reports an error so you can retry. These actions do not erase reports already received by Sentry.

11. Data Controller & Service Providers

The data controller and operator of MindCitadel is Bohuslav Semenov, a sole trader (enskild näringsidkare) established in Sweden. MindCitadel is the product name. The business is not a separate legal person. Postal address: Berguvsgatan 4B, 215 59 Malmö, Sweden. Further trader identification is provided in our Terms of Service.

RevenueCat processes end-user purchase information on our behalf; its published documentation identifies US hosting. Our Sentry organization uses EU event storage; this does not mean all provider operations occur only in the EEA. Providers may process information outside the European Economic Area. Their privacy information describes their processing and international operations. Contact us for information about your purchase or diagnostic data and applicable transfer safeguards.

For any privacy inquiries or legal correspondence, contact our data protection contact:

[email protected]

12. Changes to This Policy

The revision date identifies this policy version. We will explain material changes through an appropriate active notice, such as an in-app notice, before the changed processing begins. Where a notice must be retained, we will provide it in a form you can save. A revised policy is information about processing, not consent to a new purpose: we will obtain a separate choice where consent is required. Withdrawing optional consent remains possible through the controls described above.