Privacy

In effect from 2026-10-01. Data controller: Ömer Genç, Türkiye. info@mindpalaceai.me

What is held

Everything below is private to your account and readable only by you and, where the operator has technical access to the database, by Ömer Genç.

• Your thoughts. Everything you capture, as written. Voice captures are kept as both the recording and its transcript.
• What the AI inferred. Titles, summaries, categories, sentiment, the people and projects named in a thought, the threads they cluster into, and the proposed connections between them — each with the reasoning that produced it.
• Numeric representations. A vector per thought, used to find related material. It is derived from your text and is not readable as text.
• Your account. Your email address, your display name if you set one, your timezone, your digest preferences, and — if you arrived by one of our own links, such as one posted in a forum — which one.
• What was resurfaced. Which thoughts were brought back to you on which day, and whether you dismissed them — this is how the service avoids repeating itself.
• Days you used the app. The dates, not the times or what you did — so the operator can tell whether people come back, and so the nightly jobs skip accounts nobody opens.
• Capture keys and link previews. If you make a capture key for your phone, a scrambled fingerprint of it (never the key itself). If a thought contains a link, the public title and description of the linked page.
• Notification subscriptions. If you turn on the evening prompt, the address your browser gave for delivering notifications to it, and the hour you chose. Turning it off stops them; removing the app from your phone ends the subscription.
• Emails sent to you. Whether each of the two first-week emails has gone out, so neither is ever sent twice, and whether you have turned them off.
• Error reports. When something breaks, a technical description of the error and which part of the app it happened in, linked to your account. Kept for thirty days, then deleted.
• What the AI cost. Token counts per request, so both you and the operator can see what analysing your thinking actually costs. Visible to you in Settings.

Why it is held

To provide the service you asked for: storing what you capture, analysing it, and bringing it back to you. Under KVKK this rests on the performance of a contract with you and, for keeping the service secure and working, on the operator’s legitimate interest. Under the GDPR the corresponding bases are Article 6(1)(b) and 6(1)(f).

Your thoughts are not used to train any AI model. The companies below process them to answer a request and return a result. If you write something to us that reveals health, beliefs, or other special-category information, it is processed only as part of the thought it appears in, and the operator asks you not to capture material you would not want stored on a third-party server.

You decide what is sent. Any thought can be marked private, when you capture it or later: it is then stored and searchable by its words but never sent to any of the AI companies below, and anything already derived from it is removed. A voice note is transcribed before it is saved, so a thought meant for no AI at all should be typed. And Pause analysis, in Settings, stops everything that sends your thoughts anywhere until you turn it back on. A thought read before you marked it private was read; that cannot be undone.

Who else sees it

This list is generated from the service’s live configuration rather than maintained by hand, so it cannot fall out of date while the system changes underneath it.

Most of these are outside Türkiye and outside the European Economic Area, principally in the United States. Using this service necessarily involves transferring your thoughts abroad, and by using it you are aware of that transfer. If that is not acceptable to you, this service is not suitable for you and the operator would rather say so plainly than bury it.

Emails

Besides the sign-in and password codes you ask for, and a note if someone tries to create an account with your address when you already have one, MindPalace sends at most two emails, both in your first weeks: a day after you sign up, only if you have not come back, what it made of your first thought; and, when it exists, a note that your first rediscovery is ready. Then none. They carry the titles of a few thoughts, never their text, and nothing from a private thought. Opens and clicks are not tracked. Each has a link that stops them without signing in, and the same switch is in Settings.

Cookies

One kind only: the cookie that keeps you signed in. There is no analytics service, no advertising technology, no tracking pixel, and no third-party script. When you arrive by one of our own links (one ending in ?ref=, as in a forum post), your browser remembers that link’s label and we add one to a daily count for it, and again if you reach the sign-up form: how many people each link brought, never who, with no cookie, no address and no identifier. Even the typefaces are served from this site, so loading a page tells no font company who is reading. Because the sign-in cookie is strictly necessary to deliver a service you asked for, no consent banner is required and none is shown — an interruption that asks permission for tracking that does not exist would be theatre.

How long it is kept

For as long as your account exists. Nothing expires on its own, because a service whose purpose is to return to you what you wrote years ago cannot quietly discard it. Voice recordings are kept alongside their transcripts for the same reason: transcription improves, and tone carries meaning that text loses.

You can destroy all of it yourself, from Settings, without asking anyone. It happens immediately. That removes your account and every record derived from it, your voice recordings, and, if you were invited, the invitation — so returning later means starting a new account from nothing.

One thing deliberately survives: the record of what the AI processing cost, in tokens. Your identifier is stripped from it, leaving a model name, two numbers and a date, which refer to nobody. Deleting these instead would mean that closing an account retroactively changed what last quarter cost to run, and the operator would rather keep honest accounts than claim a completeness that serves no one.

Backups held by the database provider roll off on that provider’s own cycle and are not separately searchable; nothing is restored from them after a deletion.

Your rights

Under Article 11 of the KVKK, and Articles 15 to 21 of the GDPR where it applies to you, you may ask to:

• Know whether your data is held, and obtain a copy of it.
• Have anything inaccurate corrected.
• Have it all deleted.
• Object to processing, or ask that it be restricted.
• Receive it in a portable, machine-readable form.

The first and the last of those do not require asking. In Settings you can download everything held about you as a single file, and you can delete the account outright. The export is assembled by reading the database’s own structure rather than a list someone maintains by hand, so it cannot quietly omit a category of data that was added later.

For anything else — correction, objection, restriction — email info@mindpalaceai.me from the address you signed up with. You will get an answer within 30 days. There is no charge for any of this.

How it is protected

• Sign-in is by email and password. The password is stored by the sign-in system only as a salted hash, so nobody, the operator included, can read it. Your email address is confirmed with a one-time code when you create the account, and a forgotten password is replaced the same way.
• Every table is protected by row-level security in the database, which scopes reads and writes to your own account at the database itself rather than relying on the application to remember.
• Voice recordings sit in a private store, in a folder per account, reachable only through short-lived signed links.
• Traffic is encrypted in transit; the database is encrypted at rest by the provider.

No system is beyond compromise. If one occurs and it puts you at risk, you will be told, and so will the Turkish authority, within the time the law requires.

Children

This service is not intended for anyone under 18 and accounts are not knowingly created for them.

Changes

The date at the top changes when the substance does. If a change materially affects you — a new company receiving your thoughts, a new purpose — you will be emailed before it takes effect, rather than left to notice a date.

Complaints

Please write to info@mindpalaceai.me first. If that does not resolve it, you may complain to the Turkish Personal Data Protection Authority (KVKK), or, if you are in the European Economic Area or the United Kingdom, to your own supervisory authority.