Privacy Policy

Who we are

Mind Over Scroll is made by DePappa Capital LLC (“we”, “us”), a Florida limited liability company. This policy covers the Mind Over Scroll app for iPhone, this website and What’s Next, the board in the app where readers suggest and vote on what we add next. We decide how the information described here is used, which makes us its controller under European law.

The app has no ads, tracking or analytics of our own, and you never need an account to read. Most of this policy is about what does leave a device: your account, if you make one; purchases; mail you send us; and What’s Next.

On your iPhone

Your reading progress, saved and liked cards, quiz answers and XP, your streak, level, quests and badges, where you left each full text, and your settings, including reminder times, are stored on your iPhone. If you sign in, only your reading progress, quiz answers, and saved and liked cards sync to your account (see Your account). Your XP, streaks and badges stay on your iPhone for now, with your level, quests, settings and where you left each full text. The app leaves all of it out of iCloud and computer backups, so deleting the app deletes it from your iPhone for good.

• Reminders are scheduled by your iPhone: one each morning if you turn it on, and one before a free trial ends if you ask for it. There’s no push server, so nothing about them reaches us.
• Sharing a card hands its text to the app you pick in the share sheet, under that app’s own policy.
• Contact support and Send feedback open a short form, then Mail with our address, your message and, unless you switch it off, the app version, your version of iOS and your iPhone model filled in. Nothing is sent until you send it from Mail (see Email).
• Rate the app shows Apple’s rating prompt. Apple handles your rating; we see only totals and the reviews people publish, never who rated.
• This policy and the Terms open from this website, and Manage subscription opens Apple’s own subscriptions page.

The only permission the app asks for is notifications, for those reminders. You can turn it off at any time in your iPhone’s Settings.

Your account

You don’t need an account to read. If you’d like your progress on any iPhone, you can sign in with Apple, with Google, or with a link we email you. Accounts run on Supabase Auth, the sign-in service of Supabase, which runs our database. The app suggests an account only where one would help, and you can delete it in the app at any time.

The age question

Before any sign-in starts, we ask when you were born, month and year. If you’re under 13, nothing is sent and no account is made: your iPhone keeps a note not to offer accounts again, and you can keep reading. Otherwise the answer is checked once and discarded. We keep only the date the check passed.

Signing in

• Sign in with Apple gives us an ID Apple makes for you and an email address. With Hide My Email, that’s a private relay address, and Apple forwards our emails to you without showing us your own. We don’t ask Apple for your name.
• Sign in with Google gives us your Google Account’s ID and email address. Google also sends your name and profile photo, which we discard before they’re stored. Google’s sign-in software, which runs in the app only if you choose Sign in with Google, collects device and usage data for Google, along with what it needs to sign you in, such as your IP address and the general location it suggests, under Google’s Privacy Policy.
• A link by email signs you in without a password. We email you a link and a code (see Email).

Signing in with Google or by email with your account’s address adds it as another way into the same account, so you have one account however you sign in. Apple’s relay addresses don’t match any other.

What your account keeps

• your email address, the ways you sign in, and Apple’s or Google’s ID for you;
• when the account was made and last signed in, and the date it passed the age check;
• your reading progress (the cards you’ve read, the Plain English versions you’ve opened and the full texts you’ve read), your quiz answers, and your saved and liked cards, with when you last changed each;
• if you use What’s Next, your votes, suggestions, reports and blocks there (see What’s Next);
• short-lived records that limit how often progress saves.

Your XP, streaks and badges aren’t part of it: they stay on your iPhone for now. We use this information only to keep your progress on any iPhone you sign in on, to run What’s Next, and to keep your account secure. We never use your email address for marketing, and never give it to RevenueCat: Premium stays with your Apple Account. A sign-in nobody finishes is deleted the next day.

Sessions and logs

Supabase keeps the IP address and the browser or app version of each signed-in session, and clears them 30 days after the session was last used. Its logs of requests and sign-ins hold the IP address, browser or app version, request and time, for up to 90 days depending on the Supabase plan, and its copy of the sign-in audit log is deleted after 30 days. We use these only to keep accounts and What’s Next running and secure.

Signing out and deleting

Sign out, in Profile, keeps everything on your iPhone. Delete account, in the same place, deletes your account at once, with everything it keeps. If you signed in with Apple, Apple asks you to confirm, and we ask Apple to stop Sign in with Apple for Mind Over Scroll; if you signed in with Google, we remove the app’s access to your Google Account. What’s on your iPhone stays until you delete the app.

Purchases

Premium is sold through the App Store. Apple takes the payment and handles your Apple Account under Apple’s Privacy Policy; we never see your name, email address or card.

To know whether Premium is on, the app uses RevenueCat, a subscription service. Whenever the app checks your subscription, and when you buy or restore, it sends RevenueCat:

• a random customer ID made on your iPhone, which isn’t tied to your name, your email address, your account or your Apple Account;
• the App Store’s record of your purchases: product, price and currency, purchase, renewal and expiry dates, trial and renewal status, and transaction IDs;
• with every request, your device model, iOS and app versions, preferred languages, App Store country, the identifier iOS shares only among one developer’s apps on your iPhone, and your IP address.

We use this to unlock and restore Premium, show the right price and trial, prevent fraud, and see totals such as how many people subscribe. It isn’t linked to your identity and is never used for advertising. It’s kept until you ask us to delete it, or we stop using RevenueCat. Deleting it doesn’t cancel a subscription: to cancel, go to Settings › your name › Subscriptions.

What’s Next

What’s Next is the board in the app where readers vote on what we add next and suggest ideas. Anyone can read it without an account. Voting and suggesting are part of Premium and need an account, and blocking someone needs an account. It’s the account Your account describes, with the same age question before it’s made.

What it keeps

For What’s Next, your account holds:

• your votes;
• your suggestions: a title and optional details, in plain text. Links, web and email addresses, handles, phone numbers and markup are refused;
• the reports you send and the people you block, and short-lived records that limit how often anyone can suggest, vote, report or block.

A moderator reads every suggestion before anyone else can see it. Moderators also review reports, and remove ideas and suspend accounts that break the rules; each decision is recorded. Ideas on the board appear without a name, and someone you block is never told.

You can report an idea with or without an account. A report holds the idea, the reason you chose and, if you’re signed in, which account sent it. Your iPhone remembers the ideas you’ve reported, so they stay hidden for you.

Deleting it

Delete account deletes your votes, suggestions and blocks with the rest of your account. Ideas already on the board stay, linked to no one, and reports stay without saying who sent them.

Email

Signing in

If you sign in by email, Supabase sends you a link and a code through our email provider, which keeps the message and whether it was delivered for 30 days. The link and the code work once, and expire within the hour. These emails don’t track whether you open them or what you click.

When you write to us

Mail you send us holds your email address, any name your mail app adds, your message, its attachments and, if you left it on in the app’s form, the app version, your version of iOS and your iPhone model. Our mailbox, hello@mindoverscroll.com, is hosted by Apple iCloud Mail. We keep your mail there to answer you, for 24 months after the last message, then delete it. Writing to us never adds you to a mailing list.

Email updates

We don’t send marketing email, and this website has no sign-up form. If we start, you’ll get it only if you sign up. Every email will have an unsubscribe link, and won’t track whether you open it or what you click. We’ll keep your address until you unsubscribe, and after that only on a do-not-email list, so we never write to it again.

This website

Every font, script and image on this website is served from the site itself. There are no cookies, forms, analytics, ads, third-party scripts or font services, and the site stores nothing in your browser.

Cloudflare, which hosts the site on Cloudflare Pages, handles each request to it, with your IP address, browser, the page and the time, to deliver the site and protect it from attacks, and keeps these request logs as long as it needs them to run and protect the site. We don’t use Cloudflare’s Web Analytics or export its logs, so all we see are totals, such as how many requests the site served.

What we never collect

• Your name or phone number. We have your email address only if you sign in or write to us.
• Your location, contacts, photos, camera, microphone, health data, calendars or nearby devices.
• The advertising identifier. The app never asks to track you, and nothing here is used to track you across other companies’ apps or websites.
• Analytics events of our own. The app has no analytics or advertising SDK, and this website has no analytics script or cookie. Google’s sign-in software, which runs only if you choose Sign in with Google, collects device and usage data for Google (see Your account).
• Session replays or keystrokes, in the app or on this website.
• Crash logs. The app has no crash reporter. If you turn on Share With App Developers in Settings › Privacy & Security › Analytics & Improvements, Apple shares crash reports and usage statistics with us, under Apple’s Privacy Policy.

The only numbers we look at are totals: how many people subscribe, from RevenueCat’s purchase records; the App Store’s own statistics, which Apple shares only from people who turn on Share With App Developers; and Cloudflare’s count of requests to this website.

We don’t sell personal information, share it for advertising, or use it to train AI models.

Who handles it for us

• AppleRuns the App Store, sells the subscription and takes payment, and offers Sign in with Apple. Privacy policy
• GoogleLets you sign in with your Google Account, if you choose to, and its sign-in software then collects device and usage data for Google. Privacy policy
• RevenueCatChecks App Store purchases and tells the app whether Premium is on. Privacy policy
• SupabaseRuns the database, sign-in and logs for your account and the What’s Next board. Privacy policy
• Cloudflare PagesHosts this website, including this policy and the Terms the app opens. Privacy policy
• Apple iCloud MailHosts our mailbox, hello@mindoverscroll.com, where the mail you send us arrives. Privacy policy
• Our email providerSends sign-in emails, and will hold the email updates list once there is one.

Apple and Google handle sign-in, and Apple purchases and our mailbox, under their own privacy policies. RevenueCat, Supabase, Cloudflare and our email provider work for us under contracts that let them use this information only to provide their services. We may also disclose information when the law requires it, to protect someone’s safety or our rights, or to a company that takes over Mind Over Scroll, which would then be bound by this policy.

How long we keep it

Deleted account and board data can stay in Supabase’s backups until they expire, within 30 days.

Children

Mind Over Scroll is for a general audience and isn’t directed to children under 13, and we don’t knowingly collect their personal information. Reading never needs an account. Before any sign-in starts, including one for What’s Next, the app asks everyone’s month and year of birth. It makes no account for anyone under 13, and keeps no one’s answer.

If you think a child under 13 has sent us personal information, for example by email, write to us and we’ll delete it.

Your choices

• On your iPhone. Delete the app to delete everything it keeps. Turn the daily reminder off in Profile, notifications off in your iPhone’s Settings, and crash reports off with Share With App Developers.
• Your account. Sign out or delete it in Profile; deleting removes everything it keeps. You can also stop Sign in with Apple for the app in Settings › your name › Sign-In & Security › Sign in with Apple, and Google’s access in your Google Account’s connections to third-party apps.
• Your subscription. Manage or cancel it in Settings › your name › Subscriptions.
• Purchase records. Write to us with the order ID from your Apple receipt, and we’ll delete your record at RevenueCat.
• What’s Next. Unblock everyone at the foot of the board, or delete your account to remove your votes, suggestions and blocks.
• Email. Unsubscribe with the link in any email, or ask us to delete the mail you’ve sent us.

Your rights

Wherever you live, you can ask us what personal information we hold about you, for a copy of it, and to correct or delete it. Write to hello@mindoverscroll.com with “Privacy request” in the subject. We answer within one month, and tell you if we need longer, as the law allows.

Delete account removes everything your account keeps. If you write to us about your account, write from its email address or tell us which address it uses; with Hide My Email, that’s the relay address shown in Settings › your name › Sign-In & Security › Sign in with Apple. Purchase records aren’t tied to your account, so for those we need the order ID on your Apple receipt. What’s Next shows you your own votes and suggestions, and Delete account removes them.

Europe and the UK

If you’re in the European Economic Area, the United Kingdom or Switzerland, these apply too.

Why we may use your information

• To provide what you ask for (contract): your account and the progress it keeps, Premium and restoring it, your votes and suggestions on What’s Next, and answers to your messages.
• Our legitimate interests: keeping accounts and What’s Next safe and fair, with the age question, moderation, reports, limits, sessions and logs; preventing fraud; keeping this website secure; and knowing how many people subscribe. You can object to any of these.
• Your consent: reminders, which you allow in iOS, and email updates, if you sign up. You can withdraw it at any time.
• Legal obligations: when the law requires us to keep or disclose information.

Your rights

You can ask for access to your personal information, a copy to take elsewhere, its correction or deletion, or limits on its use, and you can object to how we use it. You can also complain to your data protection authority, or in the UK to the Information Commissioner’s Office.

Transfers

We’re based in the United States, and our providers may process information there and in other countries. When information leaves the EEA, the UK or Switzerland, we rely on adequacy decisions, including the EU–U.S. Data Privacy Framework and its UK and Swiss extensions where a provider is certified, or on the Standard Contractual Clauses, and their UK equivalent, in our providers’ data processing agreements.

US state laws

California, Colorado, Connecticut, Virginia, Texas and other states give their residents rights over personal information. We offer the rights above to everyone. In addition:

• We don’t sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising or for profiling with legal or similarly significant effects. We treat a Global Privacy Control signal as an opt-out, though there’s nothing to opt out of.
• We don’t use sensitive personal information to infer characteristics about you.
• We won’t treat you differently for using your rights.
• You can use an authorized agent; we’ll ask them to show that you authorized them.
• If we turn down a request, you can appeal by replying to our answer, and contact your state attorney general if you disagree with the outcome.

In the past 12 months, in the categories California law uses, we collected identifiers (account email addresses and IDs, Apple’s and Google’s IDs for account holders, random customer IDs, and IP addresses); commercial information (purchase records); internet or other electronic network activity (logs, the reading progress accounts keep, and your votes, suggestions and reports on What’s Next); and, from people who wrote to us, their email address and messages. We also checked month and year of birth once, without keeping it. This came from you, your device and Apple, was used for the purposes in this policy, kept as How long we keep it describes, and disclosed only to the service providers in Who handles it for us. We don’t disclose personal information to anyone for their own marketing.

Security

The app, this website and What’s Next use encrypted connections. The database lets each account reach only its own data, and moderation tools only moderators. The app contains no secret keys. Only the people who run Mind Over Scroll can sign in to these services, with two-step verification. No system is perfectly secure; if a breach affects your information, we’ll tell you as the law requires.

Changes

When this policy changes, we’ll post the new version here with its date. If a change affects what we collect or how we use it, we’ll say so in the app or on this site before it takes effect, and ask for your consent where the law requires it.

Contact

For a privacy request, write to us with “Privacy request” in the subject. You can also write from the app, in Profile › Contact support.