MindShift

Privacy Policy

Last updated: 29 August 2026

The short version. MindShift listens to your conversation so it can coach you through it. To do that it sends your microphone audio to Deepgram to turn into text, and sends that text to Anthropic (Claude) to write the suggestions you see. A live coaching session keeps its audio by default so you can replay it, re-analyze it and teach the app your voice from it — turn Keep audio off on the Live Coach screen and the session is transcribed as it streams and nothing is written down. Recordings you upload are saved only when you tick the consent box, and only you can see them until you deliberately share a session with a therapist you name by email. There are no ads, no advertising or analytics SDKs, and nothing is sold to anyone. You can delete any of it, and you can delete all of it — see Deleting your data.

Who we are

MindShift is an independent app built by Sage Arbor. It is a pre-launch project, not a company. You can reach a human at sagearbor@gmail.com.

This policy covers the MindShift Android app (com.sagearbor.mindshift.app), the iOS app, and the web version at arborfam-hub.web.app. Where the web version behaves differently, it says so below.

You need an account — but you can start without one

You can tap "Continue as guest" to start without giving us an email or a name; a guest account lives only on that device and is capped at 3 coaching sessions a day, 10 minutes each. Otherwise sign-in is handled by Google Firebase Authentication. Depending on how you sign in we receive your email address, and if you use "Continue with Google" or "Sign in with Apple", your display name. We never see your password.

Your account is identified internally by a Firebase user ID. Everything you store is filed under that ID, and every read, write and delete on our server is scoped to it, which is what stops one account from ever reaching another's data.

What we handle, and why

Data	Why	Where it goes	Kept?
Microphone audio	To transcribe what is said so the coach has something to work with	Streamed to our server, and on to Deepgram for transcription	No during live coaching. Only if you record or upload something and tick consent
Transcripts & coaching suggestions	The working material of the coach, and the session you look back at	Sent to Anthropic (Claude) to generate suggestions; stored on our server when you save a session	Yes, when saved — until you delete it
Voiceprint (a "voice signature")	So the app knows which voice is yours and which is your partner's, across sessions	Our server only. Never sent to Deepgram, Anthropic or anyone else	Yes, if you enrol a voice — until you delete it
Video	Only if you choose to record or upload a video to analyse	Our server; the audio inside it goes to Deepgram for transcription	Only if you tick consent — and then only a small 360p copy
Email & display name	Your account; naming a therapist; showing who is on a call	Firebase, our server, and people you deliberately share with	Yes, while you have an account
Diagnostics	To find out why a session broke	Our server only	Yes — error reports and device details

Microphone audio

During a live coaching session your phone streams audio to our server continuously, and our server streams it to Deepgram, a speech-to-text service, which turns it into text in real time.

Our server never writes that audio down. It holds a rolling 90-second buffer in memory purely so it can re-examine the tone of the sentence you just said, and that buffer disappears the moment the session ends or the connection drops. Nothing goes to a disk, a bucket or a database.

To be plain about one thing that is easy to get wrong: MindShift also runs a fast coaching loop on your phone, and the app has a toggle for whether the phone or the server does the coaching. That toggle does not stop the audio upload. Audio goes to our server on every live session either way. If we ever change that, this page changes with it.

Transcripts and coaching suggestions

The transcribed text is sent to Anthropic (Claude), which generates the suggestions, the tone read and the after-the-fact analysis. We send the transcript text as spoken — we do not strip out names, places or anything else, because removing them would break the coaching. Assume that whatever is said out loud in a session reaches Anthropic as text.

A live session's transcript is held in memory only. It becomes stored data when the session finishes and your phone saves it, or when you upload a recording with the consent box ticked.

Your voiceprint

If you enrol a voice — yours, or someone you tag as "Mom" — MindShift turns a few seconds of speech into a voice signature: 192 numbers. That is what gets stored. The audio it was derived from is not kept.

A voice signature is biometric data: it exists to recognise a specific person. We treat it that way. It is never sent to Deepgram, to Anthropic, or to any other outside party — the only place it ever leaves our server is back to your own phone, so the phone can match speakers without uploading anything. One tap in Settings → Advanced → Forget my voice erases it for good; there is no tombstone and no backup copy.

Recordings and video

When you record or upload something to analyse, it is processed and discarded by default. It is kept only if you tick the consent box on that upload. When it is kept, we store a compressed copy — AAC audio, and a small 360p video if there was video — never the original file. Videos you record in the app are also saved to your own camera roll on your phone; that copy is yours and we never touch it.

Diagnostics

When a session ends with an error, the app automatically sends us a diagnostic report so we can find out why. It contains your user ID and email address, your phone's model and manufacturer, the OS and app version, and statistics about the session that failed (how many turns, how slow, which error). It does not contain your transcript or your audio. You can also send one deliberately from Settings → Advanced.

We do not use any third-party analytics or crash-reporting service. These reports go to our own server and nowhere else.

What we never touch

MindShift does not request or collect your location, your contacts, your calendar, your messages, your browsing history, your files (other than the audio or video you deliberately pick), or any advertising identifier. The app does not contain an advertising SDK, an analytics SDK or an attribution SDK of any kind.

Six outside services are involved. Each one gets only what it needs to do its job.

Deepgram — speech-to-text. Receives your microphone audio and the audio of anything you upload, plus the text of coaching suggestions when you have the spoken-coach option on (so it can read them aloud). Deepgram's privacy policy.
Anthropic — the Claude model that writes the coaching. Receives your conversation transcript as text. Anthropic's privacy policy.
Google — Firebase Authentication — sign-in. Receives your email and, if you use Google or Apple sign-in, your display name.
Google Cloud — Cloud Run, Cloud Storage and Firestore run our server and hold everything you chose to save. Data is stored in the United States and is encrypted at rest by Google.
Cloudflare — when two phones on an in-app call cannot reach each other directly, Cloudflare's TURN service relays the call. It forwards encrypted packets it cannot read; it receives no transcripts and no account data.
Expo — the app checks u.expo.dev for an update every time it launches. That request carries your app version, platform, release channel and IP address. It carries none of your content.

On top of those, when the app transcribes on your phone it uses your phone's own speech recogniser — Android System Intelligence on Android, Apple's Speech framework on iOS. MindShift explicitly asks for on-device recognition and, on Android, pins the request to the on-device service. But that recogniser belongs to Google or Apple, not to us, and we cannot promise on their behalf that it never contacts them. On the web version there is no ambiguity at all: browser speech recognition sends audio to Apple (Safari) or Google (Chrome), and we say so here rather than pretend otherwise.

We do not sell your data. We do not share it for advertising. There are no ads in MindShift.

Sharing a session with someone else

This is the one way your data reaches another person, and it only ever happens because you asked for it.

Naming a therapist. You can type a therapist's email address to link your account to theirs. They must already have a MindShift account. From that point on, each new session you save is automatically shared with them. Sessions from before the link are never shared retroactively. You can turn the automatic sharing off, or unlink entirely, at any time.
What they can see. A therapist who has been granted a session can read its full transcript and analysis, and play back its stored audio or video if you saved any. They can write private notes on it. They cannot delete anything of yours and cannot edit your sessions.
Sharing one session. You can also grant a single session to one email address from the session's own screen, without any link.
In-app calls. On a call, every member sees the shared transcript of what everyone said. Each person's coaching suggestions are private to them — you never see the suggestions written for the other person — except that a therapist joining as an observer sees everyone's, which is the point of having them there. At the end of a call, each participant's session is shared with the therapist who was on it.
Taking it back. Removing a share revokes access immediately for anything requested from then on. One caveat we will not hide: a media playback link that was already handed out stays valid for up to 15 minutes, and unlinking a therapist does not retroactively un-share the sessions already granted to them — you have to remove those grants individually from each session.

In-app calls

Call audio travels directly between the phones over WebRTC, encrypted end to end by the platform. It does not pass through our server and is never recorded. Our server only introduces the phones to each other and merges the text each phone transcribes for itself. If a direct connection cannot be made, the encrypted audio is relayed by Cloudflare, which cannot read it.

How it is protected

Everything in transit is encrypted with TLS — the app to our server (HTTPS and secure WebSockets), and our server out to Deepgram, Anthropic and Cloudflare.
Everything at rest is encrypted by Google Cloud with Google-managed AES-256 keys. We do not add a second layer of our own encryption on top of that, so we are not claiming end-to-end encryption for stored sessions — the developer operating the service can technically reach stored data, and does so only to keep the service running.
Every stored object is filed under your account ID and every request is checked against your sign-in token before it is read.

How long we keep it

Live audio: not kept at all. Live transcripts: not kept until you save the session. Everything you do save — sessions, transcripts, analysis, audio and video derivatives, voiceprints, therapist links and notes — is kept until you delete it. There is no automatic expiry, and we would rather say that plainly than invent a retention period we do not enforce.

Deleting your data

In the app, right now:

Recordings → swipe or tap a session → Delete. Removes its audio, video, transcript and analysis, and tears down every share on it.
Settings → Voice → Forget my voice. Erases your voice signature. You can also delete individual enrolled people and individual voice samples.
Settings → People → delete a person you enrolled.
A session's share list → remove a recipient. Access ends immediately.
The therapist card → Unlink.

To delete your whole account and everything under it: go to Settings → Account → Delete my account, read the list of what will go, type DELETE, and confirm. It happens immediately — no email, no waiting period, no human in the loop — and you are signed out at the end because the account no longer exists. The same control is in the web app at arborfam-hub.web.app. Full instructions are at arborfam-hub.web.app/delete-account, which also covers what to do if you can no longer sign in.

Deleting your account erases: every stored recording and session (audio, video, transcripts, analysis, titles, speaker labels); your voiceprint and every person you enrolled; every share you granted and every session shared with you; your therapist link in both directions and your private notes; your unfinished uploads and analysis jobs; your watch pairing, live sessions, captures and group memberships; your diagnostic reports; your saved relationships and text-tool sessions; and your sign-in account itself.

Sessions you shared with a therapist. Sharing grants a view; it never transfers ownership. The session stays yours, so deleting your account deletes the session itself and every grant that let anyone see it — and the private notes that therapist wrote about that session go with it, because a note is an annotation on your conversation and we will not leave a record of it sitting under someone else's account. Notes they wrote about anyone else's sessions, and everything else in their account, are untouched.

What deletion cannot reach. Videos the app also saved to your phone's own photo library are yours on your device — delete those from your gallery. Anything another person exported or screenshotted is beyond us. Operational server logs (timestamps, status codes, request ids and account identifiers — never transcripts, audio or analysis) persist briefly before rotating out. Telemetry sent by a paired watch identifies the device and carries no account id at all, so there is nothing in it to attribute to you.

Children

MindShift is for adults. It is not directed to children, it is not designed for anyone under 18, and it is listed on Google Play for an 18-and-over audience. We do not knowingly collect data from anyone under 13. If you believe a child has used MindShift and given us data, email sagearbor@gmail.com and we will delete it.

Your rights

Wherever you live, you can ask us what we hold about you, ask for a copy, ask us to correct it, and ask us to delete it. Email sagearbor@gmail.com and we will answer within 30 days. We do not sell personal information, so there is nothing to opt out of on that front.

Changes to this policy

If MindShift starts doing something different with your data, this page and its "last updated" date change in the same release. The product is early and it moves; the commitment is that this page keeps describing what the code actually does, not what would be convenient to say.

Contact

Questions, deletion requests, or anything on this page that does not match what you are seeing in the app: sagearbor@gmail.com.

MindShift is not therapy. It is a communication coaching tool. It does not diagnose, treat or provide medical or mental-health advice, and it is not a substitute for a qualified professional. If you or someone else is in crisis, contact a professional or your local emergency services.