Privacy Policy
Mental Offload ("the App", "we", "us", or "our") helps couples manage household responsibilities. This policy explains what personal data we process, why we process it, who receives it, how long it is kept, and your rights.
The App stores a working copy of your data on your device and synchronizes supported data with our cloud service so it is available across your devices and, where you choose, with your partner.
1. Data Controller
Name: Adam Khelifi
Location: Denmark
Contact: [email protected]
Contact us at that address to ask a privacy question or exercise a data-protection right.
2. Data We Process
2.1 Data kept on your device
The App stores a local working copy of data such as:
| Data | Examples and purpose |
|---|---|
| Names and preferences | Your name, partner name, language, appearance, default owner, view mode, and notification choices used to personalize the App. |
| Tasks and subtasks | Titles, descriptions, due dates, status, ownership, work type, estimates, actual time, completion state, and recurrence. |
| Responsibilities and categories | Titles, descriptions, category, ownership assignments, and active/archive state. |
| Routines and routine blocks | Titles, descriptions, schedules, reminder settings, start times, durations, owners, order, and notes. |
| Appointments | Titles, descriptions, location, time, all-day state, audience/owner, recurrence, and reminder preferences. |
| Offload data | Quick-capture items, notes, and task-draft metadata used before an item becomes a synced task or other supported entity. |
| Technical state | Session, queue, migration, analytics-choice, diagnostics-queue, and other app-operating state. |
Offload items and unfinished drafts synchronize privately across devices signed in to the same Mental Offload account. They are not visible to the linked partner. Converting an item into household work applies that entity's selected visibility. Data exports include the requester's eligible cloud Offload data and the current device snapshot.
2.2 Account, profile, and couple data
The service uses Sign in with Apple. We process:
- Apple-provided user identifier, identity token, and email when Apple makes it available;
- account ID, account email, session tokens, and session expiry;
- couple and membership identifiers, role, and status;
- your name and partner name;
- invited partner email, invite token, expiry, status, and acceptance details.
Sign-in tokens are stored securely on your device. Our authentication provider receives the information needed to verify your Apple sign-in and establish your account session.
2.3 Cloud-synchronized household data
The current active sync set includes:
- categories;
- responsibilities and responsibility assignments;
- recurrence rules;
- routines and routine blocks;
- tasks and subtasks;
- appointments and per-member appointment reminder preferences;
- work-follow records used for notification delivery.
These records include identifiers, content and scheduling fields, timestamps, deletion state, and who made a change. We keep a history of changes, including earlier values, so changes can synchronize and be reviewed.
2.4 Notifications
If you enable notifications, the App sends Supabase:
- the APNs device token and push environment;
- notification enablement and delivery modes;
- digest, quiet-hours, daily-brief, and partner-brief preferences;
- time zone, language, your name, and partner name.
Apple Push Notification service receives notification payloads and device tokens. Partner notifications use limited details, such as the acting partner's name and identifiers needed to open the relevant screen.
2.5 Billing
When you buy a subscription through Apple, we process:
| Data | Purpose |
|---|---|
| Apple transaction and original-transaction identifiers | Validate the purchase and follow its lifecycle. |
| Subscription plan, status, period, grace, and revocation state | Determine entitlement. |
| Billing account and user/couple linkage | Apply the subscription to the correct account or couple. |
Apple receives a random account identifier so purchases are linked to the correct Mental Offload account. We do not receive payment-card details or Apple account credentials.
2.6 YAP voice processing
YAP is active and runs only when you choose the voice action, grant microphone access, record, and submit audio.
Before your first YAP recording for an account on this device, the App asks you to allow sharing the recording and transcript with OpenAI. You can decline and continue using text Offload. Microphone permission is requested separately.
The App sends our cloud service:
- the temporary audio recording;
- transcription language;
- a stable installation identifier;
- account authentication when you are signed in.
Our cloud service sends your recording and chosen language to OpenAI for transcription, then sends the transcript to OpenAI to suggest Offload items. Your existing responsibility titles are not included. OpenAI may process this data in the United States; the transfer safeguards are described in Section 4.
We do not keep raw audio or the full transcript on our servers. The temporary recording on your device is deleted after processing or cancellation. Suggested titles, or a short excerpt when no item is suggested, become private Offload items and can synchronize to your other devices. Review suggestions before relying on them.
OpenAI does not use API content to train its models by default. Its current transcription endpoint lists no stored application state or abuse-monitoring content. We disable stored Responses application state for task extraction. Separate abuse-monitoring logs may retain transcript content for up to 30 days, or longer where required by law or reasonably necessary to protect the service or others from harm.
2.7 Optional first-party usage analytics
The App does not record or send product/performance analytics until you explicitly enable them. If enabled, it sends allowlisted events to Supabase to understand feature use, onboarding, and performance.
| Data | Examples |
|---|---|
| Product interaction | Screen/flow/step, task created or completed, routine/appointment action, YAP outcome, paywall view, auth/invite/sync/export action. |
| Performance | Measurement name, duration, threshold, counts, and whether a path was slow. |
| Technical context | App version/build, OS, device family, locale, environment, timestamp, and session ID. |
| Pseudonymous identity | Server-side keyed hashes derived from installation, verified user, and verified couple identifiers. |
Raw installation and reported couple identifiers travel to Supabase so the server can validate and hash them; authenticated requests also expose the verified account to Supabase. Analytics rows store keyed hashes rather than raw installation/user/couple identifiers. Raw IP addresses are used transiently to derive rate-limit hashes.
Analytics rejects sensitive property names and redacts common bearer tokens, JWTs, token query values, and email patterns. It is designed not to include names, task/description content, notes, responsibility/routine titles, invite tokens, YAP audio, or transcripts. You can disable analytics in Settings; disabling stops capture and clears pending local analytics events.
2.8 First-party error, crash, and hang diagnostics
Diagnostics are separate from optional usage analytics and are enabled for reliability and security. The App can send Supabase:
- error message, type, domain, code, fingerprint, severity, handled/fatal state, and source location;
- bounded stack data, underlying errors, context, breadcrumbs, and tags;
- app version/build/bundle, OS/device model, locale, time zone, session ID, and stable installation ID;
- verified user and couple identifiers for some signed-in handled errors;
- MetricKit crash, termination, exception/signal, and hang-duration summaries.
MetricKit reports omit the current user/couple attribution, current breadcrumbs, and bearer token, but still include installation/session and device diagnostics. Automated client/server sanitizers remove credential-shaped keys and common bearer/JWT/query-token/email patterns and truncate payloads. We do not intentionally include household content, but automated redaction cannot guarantee removal of every arbitrary name, title, note, transcript fragment, or other value if a failing code path placed it in an error, context, or breadcrumb.
2.9 Website visits, hosting, and cookies
The public website is hosted by OpenAI through ChatGPT Sites. When you visit it, the hosting service receives the information needed to deliver and protect the site, including your IP address, request date and time, requested page, browser and device information, and security or diagnostic data. Mental Offload does not add third-party analytics, advertising pixels, or cross-site tracking to the website, and its site code does not read these host-set cookies or combine them with your App account.
The ChatGPT Sites origin uses these first-party cookies before the website code runs. Mental Offload's customer-controlled Cloudflare edge filters the undocumented visitor cookie from the public response:
| Cookie | Provider and purpose | Duration observed on 11 August 2026 |
|---|---|---|
__cf_bm | Cloudflare, acting through the hosting service, uses this cookie for bot detection and website security. Cloudflare describes it as strictly necessary. | About 30 minutes. |
__Host-appgarden-visitor | ChatGPT Sites uses a unique visitor identifier as part of operating the hosted site. Mental Offload does not use it for advertising or its own analytics. A customer-controlled Cloudflare Worker removes it from origin requests and responses and sends a deletion instruction when an older copy is presented. | About 90 days at the origin; not retained after the verified public response. |
No cookie preference is currently available because the website does not intentionally use optional cookies. A consent banner would be required before any analytics, advertising, personalization, or other non-essential storage is added. A banner implemented in Mental Offload's page code cannot prevent cookies that the hosting layer sets before that code runs. The customer-controlled Cloudflare edge was verified on 12 August 2026: clean requests retained no __Host-appgarden-visitor, and a synthetic older copy received the exact deletion cookie.
2.10 Website waitlist
The current public website does not provide a waitlist form. If a waitlist form is made available again and you choose to join it, we process your email, consent record, browser locale, signup source, page path, request/confirmation timestamps, request count, and confirmation status. IP and email-domain values are used transiently to derive rate-limit hashes. Resend receives the email address and confirmation message when confirmation delivery is enabled.
An address previously removed from the waitlist is not reactivated merely by another form submission. Confirmation through support is required.
2.11 Data exports
A full export requires a signed-in session and fresh Sign in with Apple authorization. Our cloud service generates a private ZIP containing your eligible account/profile, couple, billing, household, current or historical Offload, item-history, notification-delivery, analytics, and diagnostic records, including relevant records from earlier versions of the service.
After the cloud ZIP is downloaded, the App creates a JSON snapshot of the current device's local work, preferences, actual Offload queue/drafts, and routine occurrence completions/owner overrides. The App packages that JSON beside the untouched cloud ZIP and a top-level manifest in one ZIP; the local JSON is created on-device and is never uploaded during export preparation.
The export excludes authentication/session/APNs/invite bearer tokens, partner-private task, appointment, reminder, history, and notification data, pending task graphs whose current cloud visibility cannot be proven, other members' notification-delivery rows, service secrets, internal quota and sync-repair rows, provider retry details, raw Apple event payloads, diagnostic stacks/context/breadcrumbs, and selected external billing identifiers. The App requires a fresh successful visibility refresh before it packages device data. The signed cloud download link lasts 15 minutes; the private server file expires after 72 hours and is removed by server cleanup. App-managed temporary cloud/full ZIP copies become eligible for deletion after 72 hours and are removed during a later download/export cleanup pass. Copies you save or share outside the App remain under your control.
2.12 In-app feedback and support
When you submit the in-app Feedback form, we process the selected topic, your message, a submission identifier and timestamp, and your authenticated account identity. Supabase handles the request and Resend delivers the message to our support address in Resend Receiving with your account email as the reply address. No household content or diagnostics are attached automatically. The database stores a retry and abuse-prevention receipt containing account/submission identifiers, timestamps, a keyed content hash, and processing status, but no message body or email address. Receipt cleanup uses a 30-day cutoff. Support correspondence is retained only as needed to respond, follow up, or handle a related dispute.
2.13 Data we do not collect or use
- We do not access your device's location, contacts, or health/fitness services, or collect your browser/search history. Information you enter or record may contain such details; the App processes it as user content.
- We do not receive payment-card details.
- We do not use IDFA, advertising SDKs, data brokers, targeted advertising, or cross-app/cross-website tracking.
- We do not sell or rent personal data.
- We do not use third-party analytics or crash-reporting SDKs. We do use the first-party analytics and diagnostics disclosed above.
- Mental Offload does not add website analytics or advertising cookies. The host-set website cookies and hosting data are disclosed in Section 2.9. Visual assets are served from the Mental Offload website origin.
3. Why We Process Data
| Activity | GDPR Article 6 basis | Reason |
|---|---|---|
| Account, synchronized household features, preferences, notifications, exports, requested support, and billing | Contract performance, Art. 6(1)(b) | Needed to provide the App features you request. |
| YAP voice processing | Contract performance, Art. 6(1)(b) | Processing is necessary to provide voice-to-task conversion when you actively request and submit a recording. Microphone permission is a device permission, not a separate GDPR consent record. |
| Website delivery, security, and technical diagnostics | Legitimate interests, Art. 6(1)(f) | Needed to deliver and protect the public website, prevent abuse, and diagnose failures. Any non-essential cookie or similar technology requires prior consent. |
| Website waitlist and launch emails | Consent, Art. 6(1)(a) | You choose to join and receive the messages. |
| Optional usage analytics | Consent, Art. 6(1)(a) | No capture occurs until you explicitly enable it; you can disable it in Settings. |
| First-party error/crash/hang diagnostics and abuse prevention | Legitimate interests, Art. 6(1)(f) | Needed to secure, diagnose, and improve service reliability, with minimization and redaction controls. |
| Content-free deletion markers | Legitimate interests, Art. 6(1)(f) | Needed to honor deletion by preventing an old offline device from recreating erased records, without retaining the deleted content. |
| Couple invitation email | Legitimate interests, Art. 6(1)(f) | Delivers an invitation that you specifically ask us to send. |
| Legal, tax, dispute, and fraud records | Legal obligation, Art. 6(1)(c), or legitimate interests, Art. 6(1)(f), as applicable | Needed to comply with law or establish, exercise, or defend legal claims. |
The GDPR is supplemented in Denmark by the Danish Data Protection Act. If processing genuinely requires consent, you may withdraw it without affecting earlier lawful processing.
4. Recipients and Processors
Supabase
- Receives: account/authentication data, synchronized household/couple data, item history, notification tokens/preferences, billing/entitlement records, waitlist records, transient YAP requests, optional analytics, first-party diagnostics, data-export requests, and in-app feedback requests/receipts.
- Purpose: account authentication, cloud database/storage, sync, notifications, analytics/diagnostics, abuse prevention, and exports.
- Region configured for Mental Offload: AWS eu-west-1, Ireland.
- Privacy: https://supabase.com/privacy
Apple
- Receives: Sign in with Apple requests and credentials, purchase requests and app-account token, and APNs notification payloads/device tokens.
- Purpose: authentication, payments/subscriptions, and push delivery.
- Privacy: https://www.apple.com/legal/privacy/
Apple acts as an independent controller for its payment services.
OpenAI Ireland Ltd for YAP
- Receives: YAP audio/language for transcription and the transcript for structured extraction, without responsibility-title context.
- Purpose: voice transcription and task extraction.
- Privacy: https://openai.com/policies/privacy-policy
OpenAI Ireland Ltd, ChatGPT Sites, and Cloudflare
- Receives: website requests, IP address, request time, requested page, browser/device information, security and diagnostic data, and host-set cookie identifiers.
- Purpose: hosting, delivering, maintaining, securing, and diagnosing the public website. Cloudflare provides security and delivery infrastructure within the hosting service.
- Hosting and transfer: OpenAI Ireland Ltd provides hosting under the Sites Terms and Sites DPA. Website hosting data may be processed outside the EEA under the safeguards described below.
- Privacy and terms: https://openai.com/policies/privacy-policy and https://openai.com/policies/chatgpt-sites-terms/
- Cloudflare cookie information: https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/
Resend
- Receives: partner invitation, waitlist, operational-alert, and support email addresses and the email content required for delivery or receipt.
- Purpose: transactional invitation, waitlist, operational email delivery, and receipt of messages sent to
[email protected]. - Region selected for sending: AWS eu-west-1, Ireland. This controls routing and sending, not storage. Resend stores message content, delivery logs, webhook payloads, and account records in the United States.
- Privacy: https://resend.com/legal/privacy-policy
- DPA: https://resend.com/legal/dpa
Incoming support messages and in-app feedback remain in Resend. The operator reads messages and sends replies using Resend's command-line interface. New messages are not forwarded to another mailbox. Attachments remain in Resend Receiving. Mental Offload stores only a minimal webhook-delivery record containing provider identifiers, event type, processing status, and timestamps, not the support message body or addresses. Completed records are eligible for cleanup after 30 days; unresolved records follow the retention criteria below.
Google Gmail, historical support copies
- Data: older copies of support sender addresses, subjects, and bounded plain-text message bodies previously forwarded from Resend may remain in the operator's private Gmail inbox. Attachments were not forwarded.
- Purpose: handling retained copies of earlier support correspondence.
- Privacy: https://policies.google.com/privacy
New support messages and in-app feedback are no longer forwarded to this inbox. Stopping forwarding does not delete historical copies; Google remains a recipient for any copies that are retained. This inbox uses Google's consumer account terms and privacy policy. Google's published transfer frameworks describe how it handles information processed outside the EEA. We do not represent this inbox as a Google Workspace service.
International transfers
Providers and their subcontractors may process information outside the EEA, including in the United States. An EU hosting region does not mean that every provider operation takes place in the EU.
OpenAI's API and Sites agreements require its EEA entity to use Standard Contractual Clauses or an applicable European Commission adequacy decision for onward transfers. Resend's agreement incorporates Standard Contractual Clauses where an adequacy decision does not cover a transfer. Supabase publishes its transfer safeguards in its data-processing agreement. Google describes its reliance on adequacy decisions, including the EU-US Data Privacy Framework for Google LLC, and Standard Contractual Clauses where needed, in its consumer privacy terms. Apple's privacy policy identifies Standard Contractual Clauses for EEA data transfers and explains how to request a copy.
You can read the OpenAI API DPA, Sites DPA, Resend DPA, Supabase DPA, and Google transfer frameworks. Contact [email protected] to request further information or a copy of applicable safeguards. We do not sell, rent, or trade personal data.
5. Retention
| Data | Retention |
|---|---|
| Local App data | Until you delete it through the App or remove the App, subject to copies you export or share. |
| Active cloud data | While your account/service relationship is active and as needed to provide the service. |
| Deleted cloud content | Becomes eligible for erasure 45 days after deletion. Daily cleanup removes eligible content and related history copies in batches. Processing backlogs, active dependencies, or temporary failures can delay removal; account deletion uses the separate flow below. |
| Deletion markers | Content-free keyed fingerprints of deleted record identifiers are retained indefinitely to prevent an old offline device from recreating erased records. They contain no titles, notes, account identifiers, or couple identifiers. |
| Invite tokens | Default expiry is 72 hours; expired rows may remain until operational cleanup. |
| Waitlist | Until you withdraw, unsubscribe, request deletion, or the waitlist is no longer needed. |
| Website host cookies | __cf_bm lasts about 30 minutes. __Host-appgarden-visitor was observed at the origin with an expiry of about 90 days, but the customer-controlled public edge now suppresses it and deletes an older copy. |
| Website hosting and security logs | Retained by the hosting provider under the ChatGPT Sites agreement and data-processing terms for as long as needed to host, maintain, secure, and support the site. OpenAI does not publicly specify a fixed operational log period for Sites. |
| Billing/legal records | As needed for subscription administration, dispute resolution, tax, fraud prevention, or legal obligations. |
| Purchase recovery after account deletion | A keyed fingerprint of the Apple sign-in identity, purchase token and previous app-account identifier expires 90 days after deletion begins and then becomes eligible for removal. It is used only to verify purchase recovery and prevent competing ownership. The fingerprint is removed after successful recovery; the token/current-account link then remains until that account is deleted. Hourly cleanup removes expired evidence; temporary operational failures can delay physical removal, but cannot extend the recovery window. No app content, email, name or raw Apple sign-in identifier is kept in this recovery record. |
| Usage analytics | Up to 13 months, then deleted or aggregated. |
| Diagnostics | Scheduled cleanup removes entries older than six months. |
| Notification event history | Completed delivery history is eligible for cleanup after 90 days. Unresolved delivery records are retained as needed to investigate or prevent duplicate messages, with personal details removed separately where appropriate. |
| Item-change history | Scheduled cleanup removes entries older than 12 months. Related content copies are also removed when deleted content is erased. |
| Email content and logs at Resend | Resend's current Pro plan retains email and log data for 30 days; its backups persist for seven days. Contact us for an earlier message-deletion request, which may require Resend's assistance. This is separate from support correspondence and webhook-receipt retention. |
| Completed email webhook receipts | Eligible for cleanup after 30 days. Failed or unresolved receipts remain as needed for safe retries and investigation. Message bodies and addresses are not stored in this ledger. |
| YAP audio/transcript in Mental Offload systems | Temporary processing only; raw audio and full transcript are not persisted in Supabase. Local temporary audio is deleted after processing/cancellation. OpenAI's endpoint/project retention rules apply to data sent to OpenAI. |
| Data-export ZIPs | Server cloud file expires after 72 hours and is removed by server cleanup; signed cloud link lasts 15 minutes. App-managed temporary cloud/full ZIPs become eligible after 72 hours and are removed during a later download/export cleanup pass. |
| Authentication session | Until expiry, sign-out, account deletion, or revocation. |
Account deletion has role-specific shared-data effects:
- A partner who deletes their account deletes that Auth account and their couple-scoped private tasks, private appointments, Offload data, settings, and membership. Shared work assigned to that partner remains for the owner as shared work without an assigned member.
- An owner who deletes their account deletes that Auth account and the complete couple data graph, including both members' couple-scoped private data. The linked partner's Auth account is not deleted, but it is disconnected from the deleted couple.
- Pending export files are deleted as part of account or couple deletion. A failure leaves the deletion operation available for retry.
- Sign in with Apple token revocation is attempted for the requesting user when fresh authorization is supplied. App Store subscription cancellation remains a separate action managed through Apple.
Deleting an account does not cancel an Apple subscription. If you create a new account with the same Sign in with Apple login, Restore Purchases can recover an active purchase when we can verify that its previous app account was deleted and no other account owns it. This does not restore deleted app content or a former partner connection. Contact support if restoration fails; do not buy again to resolve a restore problem without checking with support.
Backups may retain deleted records for a limited recovery period and are not restored to bypass a valid deletion request.
6. Your Rights
Subject to the GDPR and applicable law, you may have rights to:
- access your personal data;
- correct inaccurate data;
- delete data;
- restrict processing;
- receive portable data;
- object to legitimate-interest processing;
- withdraw consent;
- complain to a supervisory authority.
Use Home menu > View profile > Data > Request Data Export for the full cloud-plus-device export. Use the in-app account deletion control, or contact [email protected]. For optional analytics, disable it in Settings. For YAP, do not submit another recording. For waitlist mail, reply to the confirmation message or contact [email protected].
For Denmark, the supervisory authority is Datatilsynet: https://www.datatilsynet.dk.
7. Security
We use encryption in transit, iOS device data protection, secure session storage, access controls that limit each account to the data it is allowed to see, private export storage, short-lived download links, rate limiting, and checks that reduce sensitive information in diagnostics.
No security measure eliminates all risk. Contact [email protected] if you believe data or an account has been compromised.
8. Children
Mental Offload is intended for adults aged 18 or older. We do not knowingly collect personal data from children. Contact us if you believe a child has supplied data so we can investigate and delete it where appropriate.
9. Additional regional information
For California and other US residents, the categories processed can include identifiers (name, email, user, installation, and device-token identifiers), commercial information (subscription and transaction state), internet/electronic activity (optional product and performance analytics), audio information (YAP recordings), diagnostics (errors, crashes, and hangs), user content (household records), and inferences shown as product summaries. We do not sell or share personal information for cross-context behavioral advertising.
Residents of the UK, Switzerland, Canada, Australia, and other jurisdictions may have comparable access, correction, deletion, objection, portability, or complaint rights under local law. Contact [email protected] and we will assess the request under the law that applies.
10. Changes
We may update this policy when the product, processors, law, or data practices change. We will update the date above and provide additional notice or request renewed consent where required.
11. Contact
Email: [email protected]
Location: Denmark
We aim to respond to data-rights requests within one month, subject to lawful extensions.