Privacy Policy

This Privacy Policy explains what personal data MindForge collects, why, and the rights you have over it, including under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. What We Collect

• Account data: name, email, password hash, avatar.
• Usage data: course progress, quiz attempts, lab sessions, wiki/project activity, and proctoring events during assessments.
• Content you create: diary entries, learning journal entries, habits and tasks, calendar events, notes, and files you upload as captures (screenshots, PDFs, links) together with the text extracted from them.
• AI interactions: prompts and responses from lab hints and feedback features, and the actions an AI assistant takes on your account if you connect one.
• Public test candidates: name, email and phone entered to take a public test.
• Payment data: purchase amount, currency, and status — card/UPI details are handled directly by our payment processors (Stripe, Razorpay); we never see or store them.
• Technical data: a truncated IP address (first three octets) and device hint, kept only for session security and fraud detection.

2. Why We Collect It

To operate your account and deliver course content, to secure sessions and detect suspicious sign-ins, to process payments, to respond to support requests, and to meet legal obligations (e.g. maintaining a record of your consent to these policies).

3. Your Rights

You can review and correct your profile at any time from your account settings. You can download a copy of your personal data or request deletion of your account from Settings → Privacy. Deleting your account deletes your diary, journal, captures (including the stored files), habits, notes, calendar, revision cards, AI-assistant connections and action history, anonymizes your name, email, avatar and password, and signs you out of every device. We keep what the law or other people depend on: payment records, your consent records, assessment and enrolment records held by your organization, and content you authored that others rely on (such as a published course module), all disassociated from your identity.

AI processing consent

AI features that send your own content to an AI provider (reading captures, analysing diary and journal entries, Fix English) are off until you turn on AI processing in Settings → Privacy. You can withdraw consent there at any time; it applies to your next request.

Nominee

You can name a nominee in the same place, a person who may exercise your rights on your behalf if you die or become incapacitated. We store their name, relationship and contact details only for that purpose.

Age requirement

MindForge is for people aged 18 or older. When you register you declare that you are 18 or over, and we record when you made that declaration.

4. Data Sharing and Processors

We share data only with the processors needed to run the platform, listed below. We do not sell personal data. Several processors are outside India (see Location).

• Neon: Primary database. Data: All account and content data. Location: Singapore.
• Render: API hosting and application logs. Data: API traffic, IP addresses, logs. Location: Singapore.
• Vercel: Web app hosting. Data: Requests, IP addresses, cookies. Location: Singapore and global edge.
• Backblaze B2: File storage. Data: Screenshots, PDFs and other files you upload. Location: United States.
• Anthropic / Google (Gemini): AI features (hints, feedback, diary and journal analysis, capture reading), only when enabled. Data: The text or image you submit to an AI feature. Location: United States.
• Brevo: Transactional email. Data: Email address, name, message body. Location: European Union.
• Razorpay / Stripe: Payments. Data: Name, email, amount; card and UPI details go directly to the processor. Location: India / United States.
• Google, GitHub: Social sign-in, when you choose it. Data: Email and basic profile. Location: United States.
• GitLab: Ticket linking and code review, when your organization connects it. Data: Connection tokens (encrypted), merge request and issue content. Location: Your GitLab instance.
• Your AI assistant (Claude, ChatGPT): AI Connector, only if you connect it. Data: The diary, journal, calendar, habit and course data the scopes you approve allow. Location: United States.

AI features send the text or image you submit to the AI provider named above; they are used only for the feature you invoked.

5. Data Retention

We keep account and usage data for as long as your account is active. Some records are deleted automatically after a fixed period:

• Security events (sign-ins, password and passkey changes, data exports): 365 days.
• Audit logs: 730 days. Actions taken by a connected AI assistant: 180 days.
• Assessment proctoring events and XP history: 730 days.
• Lab AI hints and feedback: 180 days.
• Name, email and phone of public test candidates: 180 days.

Payment records are kept as the law requires. Consent records (see below) are kept as an audit trail even after account deletion, since they contain no personal data once your account has been anonymized.

6. Consent Records

We record which version of this Privacy Policy and the Terms of Service you accepted, and when. If we materially change either document, you will be asked to review and accept the new version before continuing to use MindForge.

7. Contact and Grievances

Questions about this policy or a data request can be raised through the in-app support ticket system.