Privacy

In effect from 2026-09-16. Data controller: Ömer Genç, Türkiye. info@mindpalaceai.me

What is held

Everything below is private to your account and readable only by you and, where the operator has technical access to the database, by Ömer Genç.

• Your thoughts. Everything you capture, as written. Voice captures are kept as both the recording and its transcript.
• What the AI inferred. Titles, summaries, categories, sentiment, the people and projects named in a thought, the threads they cluster into, and the proposed connections between them — each with the reasoning that produced it.
• Numeric representations. A vector per thought, used to find related material. It is derived from your text and is not readable as text.
• Your account. Your email address, your display name if you set one, your timezone, and your digest preferences.
• What was resurfaced. Which thoughts were brought back to you on which day, and whether you dismissed them — this is how the service avoids repeating itself.
• What the AI cost. Token counts per request, so both you and the operator can see what analysing your thinking actually costs. Visible to you in Settings.

Why it is held

To provide the service you asked for: storing what you capture, analysing it, and bringing it back to you. Under KVKK this rests on the performance of a contract with you and, for keeping the service secure and working, on the operator’s legitimate interest. Under the GDPR the corresponding bases are Article 6(1)(b) and 6(1)(f).

Your thoughts are not used to train any AI model. The companies below process them to answer a request and return a result. If you write something to us that reveals health, beliefs, or other special-category information, it is processed only as part of the thought it appears in, and the operator asks you not to capture material you would not want stored on a third-party server.

Who else sees it

This list is generated from the service’s live configuration rather than maintained by hand, so it cannot fall out of date while the system changes underneath it.

Most of these are outside Türkiye and outside the European Economic Area, principally in the United States. Using this service necessarily involves transferring your thoughts abroad, and by using it you are aware of that transfer. If that is not acceptable to you, this service is not suitable for you and the operator would rather say so plainly than bury it.

Cookies

One kind only: the cookie that keeps you signed in. There is no analytics, no advertising technology, no tracking pixel, and no third-party script beyond the font files noted above. Because the sign-in cookie is strictly necessary to deliver a service you asked for, no consent banner is required and none is shown — an interruption that asks permission for tracking that does not exist would be theatre.

How long it is kept

For as long as your account exists. Nothing expires on its own, because a service whose purpose is to return to you what you wrote years ago cannot quietly discard it. Voice recordings are kept alongside their transcripts for the same reason: transcription improves, and tone carries meaning that text loses.

You can destroy all of it yourself, from Settings, without asking anyone. It happens immediately. That removes your account and every record derived from it, your voice recordings, and the invitation that let you sign up — so returning later means being invited again.

One thing deliberately survives: the record of what the AI processing cost, in tokens. Your identifier is stripped from it, leaving a model name, two numbers and a date, which refer to nobody. Deleting these instead would mean that closing an account retroactively changed what last quarter cost to run, and the operator would rather keep honest accounts than claim a completeness that serves no one.

Backups held by the database provider roll off on that provider’s own cycle and are not separately searchable; nothing is restored from them after a deletion.

Your rights

Under Article 11 of the KVKK, and Articles 15 to 21 of the GDPR where it applies to you, you may ask to:

• Know whether your data is held, and obtain a copy of it.
• Have anything inaccurate corrected.
• Have it all deleted.
• Object to processing, or ask that it be restricted.
• Receive it in a portable, machine-readable form.

The first and the last of those do not require asking. In Settings you can download everything held about you as a single file, and you can delete the account outright. The export is assembled by reading the database’s own structure rather than a list someone maintains by hand, so it cannot quietly omit a category of data that was added later.

For anything else — correction, objection, restriction — email info@mindpalaceai.me from the address you signed up with. You will get an answer within 30 days. There is no charge for any of this.

How it is protected

• Sign-in is by emailed link. There is no password, so there is no password of yours to leak.
• Every table is protected by row-level security in the database, which scopes reads and writes to your own account at the database itself rather than relying on the application to remember.
• Voice recordings sit in a private store, in a folder per account, reachable only through short-lived signed links.
• Traffic is encrypted in transit; the database is encrypted at rest by the provider.

No system is beyond compromise. If one occurs and it puts you at risk, you will be told, and so will the Turkish authority, within the time the law requires.

Children

This service is not intended for anyone under 18 and accounts are not knowingly created for them.

Changes

The date at the top changes when the substance does. If a change materially affects you — a new company receiving your thoughts, a new purpose — you will be emailed before it takes effect, rather than left to notice a date.

Complaints

Please write to info@mindpalaceai.me first. If that does not resolve it, you may complain to the Turkish Personal Data Protection Authority (KVKK), or, if you are in the European Economic Area or the United Kingdom, to your own supervisory authority.