Privacy Policy

1. Who is responsible and how to contact us

Mindex is operated by Diego Felipe Pineda Leiva (pinedapps), c/o MDC Management#4996, Welserstraße 3, 87463 Dietmannsried, Germany. Contact our privacy contact at datenschutz@pinedapps.de or write to this address. Support: support@pinedapps.de. This notice covers the Mindex apps, website and associated account services.

2. Data we process and why

• Account: email address, account ID, optional display name/photo, sign-in provider, authentication/session information, preferences and records of policy acknowledgement. Firebase Authentication handles sign-in credentials; Mindex does not store your sign-in password in workspace documents.
• Your content: links, citation metadata, notes, snippets, labels, tags, categories, map layouts, spaces, projects and supported images; existing accounts may also have stored attachments. Free and Pro store this content differently as explained below.
• Purchases: product, transaction/customer identifiers, entitlement, renewal and expiry information from Apple/Google and RevenueCat. Mindex does not receive your full payment-card or bank details.
• Operation and security: request information, IP address/user agent, timestamps, rate-limit records and security events (including hashed request identifiers). Hashing does not necessarily make data anonymous. Support requests contain the contact details and content you send. Account services, requested imports, Pro synchronization and subscription verification support our contract with you (Art. 6(1)(b) GDPR). Security, fraud/abuse prevention and service reliability serve our legitimate interests (Art. 6(1)(f)); we balance these against your rights. Legally required accounting and responses to lawful orders use Art. 6(1)(c). Where optional processing requires consent, Art. 6(1)(a) applies and you may withdraw it. Acknowledging this notice is not blanket consent to optional processing.

3. Free, Pro and data on your device

For reports of unlawful or prohibited content, we may process the reporter's contact information, content/location identifiers, submitted evidence, relevant hosted content and our decisions or appeal correspondence. Access is limited to what is necessary for assessment, safety, enforcement and legal claims. We rely on the legal bases above as applicable; limited disclosure to the affected person, professional advisers or competent authorities occurs only where necessary and lawful. We do not routinely upload local-only library content for moderation. Report records and narrowly necessary evidence are retained only for the relevant purpose, legal requirement or dispute, then deleted or anonymized; an entire library is not retained merely because a report was made.

Free workspace changes are stored locally on each device/browser, not synchronized to your cloud library or other devices. Signing in, account/security services, purchase checks, requested remote metadata lookups and supported image uploads can still contact our services. Free does not mean that the entire app is offline. When Pro ends, previously synchronized text remains in your account as a readable cloud archive. You can choose a device copy to edit with Free. Local edits, new cards and local deletions do not alter that archive or appear on other devices. Reactivating Pro allows synchronization again; review the device content and any conflicts before syncing. Local workspace data, import progress, selected/unselected entries and prepared citations are stored on the device/browser so an interrupted import can resume. Articles can include a fingerprint of the original citation for duplicate detection; this is not an anonymous usage identifier. Clearing app/browser storage or losing the device can lose local content. Keep an external backup. App account deletion clears the current device's app workspace; remove copies on other devices, downloads and backups separately.

4. Requested external lookups, images and AI

BibTeX parsing and duplicate selection happen locally. For requested DOI/link metadata and optional PDF discovery, Mindex sends the relevant DOI, URL and citation fields to its server and may query Crossref, OpenAlex, Unpaywall or the linked publisher/website. These recipients can receive the lookup identifier and connection information. Links and previews loaded directly on your device can disclose its IP address to the destination. Unselected entries are not sent for import enrichment. A linked PDF is opened from its external source, not copied into Firebase by the bibliography importer. Profile photos and custom card previews can use Firebase Storage even with Free; this is separate from text synchronization. New workspace file/PDF attachment uploads are not offered in this release. Existing attachments have the lifecycle below. The current bibliography importer and link-metadata path do not use generative AI. If a separate AI feature is offered, its interface must explain the provider, data sent and any required choice before sending your content. We do not use your private library to train our own AI models or make solely automated decisions with legal or similarly significant effects.

5. Recipients and international processing

Google Firebase/Google Cloud provides authentication, database, image/file storage and hosting. RevenueCat processes purchase and entitlement information. The app store used for your purchase processes purchases under its own privacy notices. Our email/support infrastructure processes messages you send. Requested metadata services and external websites process lookups as described above. We may disclose necessary information to authorities when legally required or to professional advisers for legal claims. We do not sell personal information or share it for cross-context behavioural advertising, and the current product has no advertising-tracking SDK. Providers may process data in the United States and other countries outside your country of residence. Such processing must use the safeguards required by applicable law: an applicable adequacy decision, or approved contractual safeguards (such as EU standard contractual clauses and any necessary UK/Swiss adaptations) and supplementary measures where needed. Contact us for the recipients, applicable transfer safeguards or a copy of them. Purchasing through a store or opening an external site also subjects that interaction to its privacy notice.

6. Storage periods, deletion and security

Account and synchronized text are kept while your account exists, unless you delete them; ending Pro alone does not delete the text archive. Local data remains until cleared, removed or replaced on the device/browser. Existing Pro workspace attachments have a 30-day recovery period after Pro ends and are then scheduled for permanent cloud deletion unless Pro is restored before cleanup starts. Profile photos and custom previews are separate from this attachment rule. Account deletion removes the Firebase account, user database tree, private Storage objects and user-linked security/recovery records. Store purchase records and processor-held records may require separate handling; deleting Mindex or its account does not cancel a store subscription. Support, infrastructure/security and legally necessary records are retained only for the relevant purpose, required legal period or resolution of a dispute, then deleted or anonymized. Accounting records, where applicable, can require 6, 8 or 10 years depending on the record. No universal 30-day erasure promise is made for all provider logs or backups. We use authenticated access controls, encrypted network connections and infrastructure protections. Mindex is not end-to-end encrypted. The privacy-password feature restricts app access; it is not end-to-end encryption of cloud content. Local protection also depends on your device lock, browser and operating-system backups.

7. Your choices and rights

In Settings you can export workspace content and delete your account. This product export is not a complete privacy access response: request account, purchase or security information from our privacy contact. Without app access, follow account deletion instructions or email us. We verify requests proportionately to protect your data; do not send identity documents unless specifically needed through an agreed secure channel. Under GDPR, applicable rights include access, correction, erasure, restriction, portability, objection to legitimate-interest processing, and withdrawal of consent without affecting prior lawful processing. We normally respond within one month; where legally permitted an extension is explained. You may complain to your local supervisory authority, including the Bavarian data protection authority. Depending on applicable law, residents of US states including California may also request access/knowledge, correction, deletion, portability, opt-out of sale/sharing or targeted advertising, restriction of certain sensitive-data uses, and appeal a refusal. We do not carry out sale or advertising sharing. You may use an authorized agent where the law permits; exercising rights will not lead to unlawful discrimination. Request or appeal by emailing our privacy contact. Statutory scope, exceptions and deadlines apply; this notice does not assert that every state law applies to Mindex. UK and Swiss residents may exercise applicable access, correction, deletion and other privacy rights and complain to the ICO or FDPIC. In Brazil, applicable LGPD rights include confirmation, access, correction, deletion/portability and consent-related rights, with complaints to ANPD. In Canada and Australia, applicable access, correction and complaint rights may be exercised through us and the relevant privacy authority. Mandatory rights under other countries' laws remain available; contact us about your request.

8. Age and updates

Mindex is intended for people aged 16 or older, subject to local capacity and age requirements. We do not knowingly solicit children's personal data. Contact us if you believe a child has supplied data so we can investigate and take appropriate action. We publish the current notice with its date, explain material changes and request a separate choice where new processing requires consent. Neither this notice nor accepting the Terms waives statutory privacy rights.