Privacy Policy — MindBuy

Last updated: 29 August 2026 · applies from app version 2.0

1. Controller

The controller responsible for data processing within the meaning of the GDPR is:

Contact for data protection inquiries: support@mindbuy.app

2. Scope

This Policy applies to the app MindBuy in its respective current version, as well as to the associated pages at mindbuy.app.

MindBuy is distributed via the Google Play Store. A version for iOS (Apple App Store) is in preparation; the differences that will apply there have already been taken into account in this Policy.

3. What changed with version 2.0

Earlier versions of this Policy stated that MindBuy works without an account, without a server and without the cloud. This is no longer the case as of version 2.0. The key changes:

• Using the app now requires a user account.
• In addition to local storage, your entries are also saved as a backup copy in the cloud.
• There are now push messages from a server (announcements), in addition to the reminders, which remain purely local.
• The premium features now run on a subscription instead of a one-time purchase.

What has not changed: there are still no analytics, tracking, or crash-reporting services, and your entries are neither sold nor evaluated for advertising purposes.

4. User account

Using MindBuy requires an account. The app cannot be used without one. The reason is the cloud backup: it needs a fixed association so your data can be found again after switching devices.

Sign-in methods: sign-in with Google or with Apple. There is no sign-in with e-mail address and password.

Data processed: e-mail address, display name (if provided by the sign-in service), a user identifier (UID) assigned by Firebase, the timestamps of account creation and last sign-in, as well as technical connection data such as the IP address.

If you use "Sign in with Apple", you can choose at Apple to hide your e-mail address. In that case we only receive the forwarding address generated by Apple, not your real one.

Technical service: Firebase Authentication (Google Ireland Limited).

Legal basis: Article 6(1)(b) GDPR — performance of the usage agreement.

Storage period: until the account is deleted (see section 19).

5. Data stored on your device

This data is kept in an SQLite database and in the app settings, in the protected app directory of your device:

Content

• Title, description and notes of your entries
• Price and currency
• Optional product link and shop name
• Category and status (waiting, released, purchased, discarded, planned)
• Timestamps: creation, end of waiting period, purchase or discard, planned date
• Savings goals with target amount and progress
• Monthly budgets
• Statistics, achievements and decision streak

Settings

• Language, currency and colour theme
• Notifications on or off
• Consent to personalised advertising
• Subscription or trial status
• Progress through onboarding and hint texts
• Timestamp of the last backup and the last version check

Legal basis: Article 6(1)(b) GDPR.

Storage period: until you delete the data or uninstall the app. On uninstall, the operating system removes this directory completely — the cloud backup is not affected.

6. Cloud backup

MindBuy stores a copy of your database in your account. This happens when you back up manually in settings, on first sign-in on a device, and automatically at most once every 24 hours.

The backup is free for all users and is not tied to the subscription.

Data processed: the full content from section 5 — entries, savings goals, budgets, statistics and achievements.

Storage: as a file under users/<UID>/backup/mindbuy.db in Firebase Storage. Access is restricted by security rules to your own account; other users have no technical access.

Storage location: a data centre in the region europe-west3 (Frankfurt am Main).

Transmission: encrypted via TLS.

Legal basis: Article 6(1)(b) GDPR.

Storage period: until the account is deleted, or until you create a new backup in the app that replaces the previous one.

7. Trial period marker

Every new account receives the additional features for seven days. To prevent this period from being reset by reinstalling the app, the start time is stored once in your account — as the file users/<UID>/trial/start.json.

Data processed: a timestamp only.

Legal basis: Article 6(1)(f) GDPR — legitimate interest in granting a free trial period only once.

Storage period: until the account is deleted.

8. Reminders and announcements

Reminders (local). When an entry's waiting period expires, the app reminds you. These notifications are scheduled and triggered exclusively on your device. No data transmission takes place. So that reminders survive a restart, they are rescheduled after the device boots up.

Announcements (push). In addition, MindBuy can send occasional information about the app — for example about major new features. For this, the device is registered with Firebase Cloud Messaging for the "all" channel.

Data processed: a device identifier assigned by Google (FCM token). The channel is topic-based; the message is not attributed to you personally.

Legal basis: Article 6(1)(a) GDPR — consent given by granting the notification permission. You can withdraw it at any time in app or system settings.

9. Version check

MindBuy checks at most once every 24 hours whether a newer version is available. For this, the app downloads a small configuration file (config/app_version.json) from Firebase Storage. Only the technically unavoidable connection data is transmitted, in particular the IP address. A user identifier is not sent.

Legal basis: Article 6(1)(f) GDPR — legitimate interest in an up-to-date, functioning version.

10. Advertising

In the free version, MindBuy shows advertising via Google AdMob:

• Banners on the overview, calendar and statistics screens
• a full-screen ad on app start, at most every four hours

During an active subscription and during the trial period, no advertising is shown.

Personalisation is off by default. On first launch you are asked whether personalised advertising should be allowed; the setting can be changed at any time under Settings → Personalised advertising.

• Consented: AdMob may use your device's advertising ID and related usage data.
• Not consented: only non-personalised advertising is delivered.

Data processed by AdMob: advertising ID, device model and operating system version, approximate location based on IP address (no GPS), app version, and — where personalisation is enabled — interactions with ads.

You can reset or delete the advertising ID at any time in your device's system settings.

Legal basis: for personalised advertising, Article 6(1)(a) GDPR (consent); otherwise Article 6(1)(f) GDPR (legitimate interest in financing the free version).

11. Subscription and payments

The additional features ("MindBuy Plus") are offered as a subscription. Payment is processed exclusively via the Google Play Store, and on iOS via the Apple App Store.

• We receive no payment data — neither card nor account numbers.
• We only learn whether a subscription is active, in order to unlock the features. This check happens on the device.
• The seven-day trial period is app-native: it requires no payment data and does not automatically convert into a subscription.

Legal basis: Article 6(1)(b) GDPR.

12. Importing a product link from other apps

If you share a product link with MindBuy from another app, the app fetches that page once, directly from your device, in order to read out the title and price. There is no detour via a server of ours.

As with any page visit, the website being accessed sees your IP address and technical details of your device. We have no influence over their processing of that data.

Legal basis: Article 6(1)(b) GDPR.

13. Export and import as a file

In addition to the cloud backup, you can export your data as a file and read it back in.

• The file contains all content from section 5.
• It is not encrypted.
• Where it goes — a local folder, e-mail, a third-party cloud storage — is up to you. From that point it lies outside our sphere of influence.

14. Permissions

Each of these permissions can be revoked in your system settings.

15. No analytics or tracking services

MindBuy uses no analytics, statistics or crash-reporting services. In particular, Firebase Analytics and Firebase Crashlytics are not integrated, even though other Firebase components are used.

What you record, buy or discard is not evaluated. There is no profiling and no automated decision-making.

Should this change in a future version, this Policy will be amended beforehand, and you will be informed in the app.

16. Recipients and processors

A data processing agreement under Article 28 GDPR is in place with Google for the Firebase services.

Your data is not sold, and there is no disclosure to third parties for their own advertising purposes.

16.1 Transfers to third countries

The Google services named above are provided via Google Ireland Limited, but may technically be processed in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the basis for the transfer is therefore the European Commission's adequacy decision of 10 July 2023 (Article 45(3) GDPR). In addition, Google has implemented the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR).

The same applies to Apple.

You should be aware: under certain conditions, US authorities can access data processed by US companies. The Data Privacy Framework provides a complaint mechanism for this via the Data Protection Review Court.

Further information: policies.google.com/privacy · firebase.google.com/support/privacy · apple.com/legal/privacy

17. Storage periods at a glance

18. Data security

• Local data is kept in an app-specific directory that the operating system shields from access by other apps.
• The local database is not additionally encrypted. If a device is lost unencrypted, the data is technically readable — the operating system's device encryption should be active.
• The cloud backup is kept in an area separated by account; the access rules permit only the respective own account.
• All of the app's network connections run over TLS.

19. Your rights

You have the right to access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21 GDPR). You can withdraw a consent you have given at any time with effect for the future (Article 7(3) GDPR).

You can take care of much of this yourself, directly:

• Access and portability: you can see all content in the app; under Settings → Data → Export you get it as a file.
• Erasure: Settings → Delete account. This removes the account, the cloud backup and the trial period marker. You delete the data on your device by uninstalling the app or resetting the app data.
• Objecting to personalised advertising: toggle in settings.

For anything else, an e-mail to support@mindbuy.app is enough.

You can also lodge a complaint with a supervisory authority, generally the data protection authority of your federal state.

20. Children

MindBuy is not aimed at children and is intended for use from the age at which a person may independently consent to data processing under the law of their country (16 years in Germany, Article 8 GDPR).

21. Changes to this Policy

This Policy is amended when features or the legal framework change. For material changes, you will be informed on next app launch. The version at mindbuy.app/datenschutz/ is always authoritative.

Last updated: 29 August 2026