MindShift

Privacy Policy

Last updated: 23 September 2026

Who we are

MindShift is an independent app built by Sage Arbor. It is a pre-launch project, not a company. You can reach a human at sagearbor@gmail.com.

This policy covers the MindShift Android app (com.sagearbor.mindshift.app), the iOS app, the web version at arborfam-hub.web.app, and the MindShift Wear OS companion app (com.sagearbor.gauge.wear), which has no privacy policy of its own. Where one of these behaves differently, it says so below.

You need an account — but you can start without one

Sign-in is handled by Google Firebase Authentication. Depending on how you sign in we receive your email address, and if you use "Continue with Google" or "Sign in with Apple", your display name. We never see your password.

You can also tap "Continue as guest". That creates a real but anonymous account: we receive no email, no name and nothing that identifies you. A guest session works like any other — the app says so in a bar across the top of every screen — with two differences you should know about before you rely on it:

• It lives only on this device. There is no email or password to sign back in with, so logging out, reinstalling, or losing the phone loses everything recorded under it. Nobody, including us, can recover it. Tap "Create account" in that bar to add an email or Google sign-in; your existing sessions stay, because it attaches to the same account rather than starting a new one.
• It is capped. A guest gets 3 live coaching sessions a day, up to 10 minutes each. This is a cost limit, not a data one — every session spends money on speech recognition and AI, and an anonymous account is free to create.

Your account — guest or not — is identified internally by a Firebase user ID. Everything you store is filed under that ID, and every read, write and delete on our server is scoped to it, which is what stops one account from ever reaching another's data. Deleting a guest account works exactly like deleting any other (see Deleting your data).

What we handle, and why

Microphone audio

During a live coaching session your phone streams audio to our server continuously, and our server streams it to Deepgram, a speech-to-text service, which turns it into text in real time.

A live session keeps its audio by default. While it runs, our server holds a rolling 90-second buffer in memory to re-examine the tone of the sentence you just said, but the phone also writes the session's microphone audio to a file, and once you save the session that file is uploaded and stored — transcoded to a compressed copy, the same way an uploaded recording is — so you can replay and re-analyse it later and so MindShift can keep learning your voice. You can turn this off: in Live Coach, switch Keep audio off, and nothing is written down for that session — the live stream is only ever transcribed as it goes, the 90-second buffer disappears the moment the session ends or the connection drops, and no audio file is ever created or uploaded.

To be plain about one thing that is easy to get wrong: MindShift also runs a fast coaching loop on your phone, and the app has a toggle for whether the phone or the server does the coaching. That toggle does not stop the audio upload. Audio goes to our server on every live session either way; Keep audio is the separate control for whether that audio is kept. If we ever change any of this, this page changes with it.

Heart rate (Wear OS)

If you pair a MindShift Wear OS watch to your account, the watch reads your heart rate from its optical sensor and sends it to our server. In an active watch session it sends a reading about once a second; in Companion mode, where your phone does the listening and the watch just sits alongside it, the watch still sends a reading roughly every 5 seconds for as long as that connection stays open. Either way it is an extra input alongside your voice — a heart-rate jump can contribute to the wearer's own in-the-moment nudge — and the full series is stored with the session, not just the moments it spiked, so we can tell honestly whether heart rate is adding anything at all.

Heart rate is stored inside that session's record on our server and is never sent to Deepgram, Anthropic, or anyone else, and it is never shown to another user — a partner's shared standing card shows a calm score, never a number. It exists only if you pair a watch and grant it the body -sensor permission; decline that permission and the watch still works, it just has one fewer signal. Deleting the session deletes its heart-rate data with it; deleting your account deletes all of it.

Tone (arousal and valence)

Our server also scores the sound of a live session's audio for how heated it sounds — two numbers, called arousal and valence, computed every second from a short rolling window of your voice. This is a second opinion alongside loudness, so a session that is loud but happy is not mistaken for one that is loud and angry. The models run on our own server — nothing is sent to an outside emotion-detection company — and the resulting series is stored with the session for the same reason the heart-rate series is: so it can be checked, and used only for your own nudges and after-the-session recap. It is not shared with anyone else and is deleted along with the session, or your whole account.

The Wear OS watch's microphone

A paired watch listens for you in one of a few modes, chosen in the watch app. In Battery Saver and Standard mode, the watch's microphone stays off until it detects something worth nudging on, and then streams your voice to our server in one-second pieces, together with a 5-to-10-second buffer of audio from just before that moment so the nudge doesn't lose context. Session mode streams continuously in the same one-second pieces for as long as it is on, with no trigger at all. Companion mode is different from all three: the watch never opens its microphone at all — your phone listens instead, and the watch only receives heart rate and nudges. A live watch session keeps up to 30 minutes of whatever audio it streamed with the session record; past 30 minutes, the audio stops being kept while the watch keeps nudging.

Two more things you can trigger from the watch:

• Save last 2 min — tap the chip, confirm the dialog, and the last two minutes of the watch's rolling buffer is uploaded and kept until you delete it.
• Journal — an opt-in toggle, off by default, that when turned on uploads a short snapshot of your own voice every five minutes. We filter it down to spans that match your own enrolled voice before keeping anything, and every journal snapshot is deleted automatically after 48 hours, whether or not you turn the toggle off.

Transcripts and coaching suggestions

The transcribed text is sent to Anthropic (Claude), which generates the suggestions, the tone read and the after-the-fact analysis. We send the transcript text as spoken — we do not strip out names, places or anything else, because removing them would break the coaching. Assume that whatever is said out loud in a session reaches Anthropic as text.

A live session's transcript is held in memory only. It becomes stored data when the session finishes and your phone saves it, or when you upload a recording with the consent box ticked.

Your voiceprint

If you enrol a voice — yours, or someone you tag as "Mom" — MindShift turns a few seconds of speech into a voice signature: 192 numbers. That is what gets stored. The audio it was derived from is not kept.

A voice signature is biometric data: it exists to recognise a specific person. We treat it that way. It is never sent to Deepgram, to Anthropic, or to any other outside party — the only place it ever leaves our server is back to your own phone, so the phone can match speakers without uploading anything. One tap in Settings → Voice → Forget my voice erases it for good; there is no tombstone and no backup copy.

Recordings and video

When you record or upload something to analyse, it is processed and discarded by default. It is kept only if you tick the consent box on that upload. When it is kept, we store a compressed copy — AAC audio, and a small 360p video if there was video — never the original file. Videos you record in the app are also saved to your own camera roll on your phone; that copy is yours and we never touch it.

Diagnostics

When a session ends with an error, the app automatically sends us a diagnostic report so we can find out why. It contains your user ID and email address, your phone's model and manufacturer, the OS and app version, and statistics about the session that failed (how many turns, how slow, which error). It does not contain your transcript or your audio. You can also send one deliberately from Settings → Diagnostics → Send diagnostics.

We do not use any third-party analytics or crash-reporting service. These reports go to our own server and nowhere else.

What we never touch

MindShift does not request or collect your location, your contacts, your calendar, your messages, your browsing history, your files (other than the audio or video you deliberately pick), or any advertising identifier. The app does not contain an advertising SDK, an analytics SDK or an attribution SDK of any kind.

Who else sees your data

Six outside services are involved. Each one gets only what it needs to do its job.

• Deepgram — speech-to-text. Receives your microphone audio and the audio of anything you upload, plus the text of coaching suggestions when you have the spoken-coach option on (so it can read them aloud). Deepgram's privacy policy.
• Anthropic — the Claude model that writes the coaching. Receives your conversation transcript as text. Anthropic's privacy policy.
• Google — Firebase Authentication — sign-in. Receives your email and, if you use Google or Apple sign-in, your display name.
• Google Cloud — Cloud Run, Cloud Storage and Firestore run our server and hold everything you chose to save. Data is stored in the United States and is encrypted at rest by Google.
• Cloudflare — when two phones on an in-app call cannot reach each other directly, Cloudflare's TURN service relays the call. It forwards encrypted packets it cannot read; it receives no transcripts and no account data.
• Expo — the app checks u.expo.dev for an update every time it launches. That request carries your app version, platform, release channel and IP address. It carries none of your content.

Your heart rate and the tone (arousal/valence) score described above are not on this list — the models that compute tone run inside our own server, not at any of these companies, and neither figure is ever included in what we send to Deepgram or Anthropic.

On top of those, when the app transcribes on your phone it uses your phone's own speech recogniser — Android System Intelligence on Android, Apple's Speech framework on iOS. MindShift explicitly asks for on-device recognition and, on Android, pins the request to the on-device service. But that recogniser belongs to Google or Apple, not to us, and we cannot promise on their behalf that it never contacts them. On the web version there is no ambiguity at all: browser speech recognition sends audio to Apple (Safari) or Google (Chrome), and we say so here rather than pretend otherwise.

We do not sell your data. We do not share it for advertising. There are no ads in MindShift.

Sharing a session with someone else

This is the one way your data reaches another person, and it only ever happens because you asked for it.

• Naming a therapist. You can type a therapist's email address to link your account to theirs. They must already have a MindShift account. From that point on, each new session you save is automatically shared with them. Sessions from before the link are never shared retroactively. You can turn the automatic sharing off, or unlink entirely, at any time.
• What they can see. A therapist who has been granted a session can read its full transcript and analysis, and play back its stored audio or video if you saved any. They can write private notes on it. They cannot delete anything of yours and cannot edit your sessions.
• What they can keep. Anyone you grant a session to — the therapist you linked, or one person you handed a single session to — can also download that session as a document, a text file or a PDF, to put in a patient file. The document is the whole session in writing: your email address, the session's title, date and length, the full transcript turn by turn with its tone labels and scores, the turns flagged as escalations, the "what you could have said" coaching, the record of how and when the session reached them together with the consent wording you were shown, and their own private notes. It does not contain your audio or video — it is text only. Once it is downloaded, it is theirs. Removing the share stops any further download straight away, because every request is checked against the grant — but a file already saved on their computer is outside MindShift, and neither un-sharing the session nor deleting your whole account can reach it. That is what a patient file is for, and it is the one part of sharing you cannot take back.
• Sharing one session. You can also grant a single session to one email address from the session's own screen, without any link.
• In-app calls. On a call, every member sees the shared transcript of what everyone said. Each person's coaching suggestions are private to them — you never see the suggestions written for the other person — except that a therapist joining as an observer sees everyone's, which is the point of having them there. At the end of a call, each participant's session is shared with the therapist who was on it.
• Taking it back. Removing a share revokes access immediately for anything requested from then on. One caveat we will not hide: a media playback link that was already handed out stays valid for up to 15 minutes, and unlinking a therapist does not retroactively un-share the sessions already granted to them — you have to remove those grants individually from each session.

In-app calls

In-app calls are audio only — there is no video. Call audio travels directly between the phones over WebRTC, encrypted end to end by the platform. It does not pass through our server and is never recorded. Our server only introduces the phones to each other and merges the text each phone transcribes for itself. If a direct connection cannot be made, the encrypted audio is relayed by Cloudflare's TURN service, which cannot read it.

How it is protected

• Everything in transit is encrypted with TLS — the app to our server (HTTPS and secure WebSockets), and our server out to Deepgram, Anthropic and Cloudflare.
• Everything at rest is encrypted by Google Cloud with Google-managed AES-256 keys. We do not add a second layer of our own encryption on top of that, so we are not claiming end-to-end encryption for stored sessions — the developer operating the service can technically reach stored data, and does so only to keep the service running.
• Every stored object is filed under your account ID and every request is checked against your sign-in token before it is read.

How long we keep it

Live transcripts: not kept until you save the session. Live audio: kept with the session by default once you save it — turn off Keep audio and it is never written down at all. Everything you do save — sessions, transcripts, analysis, audio and video derivatives, heart-rate and tone series, voiceprints, therapist links and notes — is kept until you delete it. There is no automatic expiry on any of that, and we would rather say that plainly than invent a retention period we do not enforce.

Two exceptions, both on the Wear OS watch: a live watch session keeps at most 30 minutes of streamed audio, and a Journal snapshot is deleted automatically after 48 hours regardless of when you turn the Journal toggle off.

Deleting your data

In the app, right now:

• Recordings → swipe or tap a session → Delete. Removes its audio, video, transcript and analysis, and tears down every share on it.
• Settings → Voice → Forget my voice. Erases your voice signature. You can also delete individual enrolled people and individual voice samples.
• Settings → People → delete a person you enrolled.
• A session's share list → remove a recipient. Access ends immediately.
• The therapist card → Unlink.

To delete your whole account and everything under it: go to Settings → Account → Delete my account, read the list of what will go, type DELETE, and confirm. It happens immediately — no email, no waiting period, no human in the loop — and you are signed out at the end because the account no longer exists. The same control is in the web app at arborfam-hub.web.app. Full instructions are at arborfam-hub.web.app/delete-account, which also covers what to do if you can no longer sign in.

Deleting your account erases: every stored recording and session (audio, video, transcripts, analysis, titles, speaker labels, and any heart-rate or tone series recorded with it); your voiceprint and every person you enrolled; every share you granted and every session shared with you; your therapist link in both directions and your private notes; your unfinished uploads and analysis jobs; your watch pairing, live sessions (including their streamed audio and heart rate), captures — including a "Save last 2 min" or Journal capture — and group memberships; your diagnostic reports; your saved relationships and text-tool sessions; and your sign-in account itself.

Sessions you shared with a therapist. Sharing grants a view; it never transfers ownership. The session stays yours, so deleting your account deletes the session itself and every grant that let anyone see it — and the private notes that therapist wrote about that session go with it, because a note is an annotation on your conversation and we will not leave a record of it sitting under someone else's account. Notes they wrote about anyone else's sessions, and everything else in their account, are untouched.

What deletion cannot reach. Videos the app also saved to your phone's own photo library are yours on your device — delete those from your gallery. Anything another person exported or screenshotted is beyond us — that includes the session document a therapist downloaded, which holds the full transcript of that conversation. Operational server logs (timestamps, status codes, request ids and account identifiers — never transcripts, audio or analysis) persist briefly before rotating out. Telemetry sent by a paired watch identifies the device and carries no account id at all, so there is nothing in it to attribute to you.

Children

MindShift is for adults. It is not directed to children, it is not designed for anyone under 18, and it is listed on Google Play for an 18-and-over audience. We do not knowingly collect data from anyone under 13. If you believe a child has used MindShift and given us data, email sagearbor@gmail.com and we will delete it.

Your rights

Wherever you live, you can ask us what we hold about you, ask for a copy, ask us to correct it, and ask us to delete it. Email sagearbor@gmail.com and we will answer within 30 days. We do not sell personal information, so there is nothing to opt out of on that front.

Changes to this policy

If MindShift starts doing something different with your data, this page and its "last updated" date change in the same release. The product is early and it moves; the commitment is that this page keeps describing what the code actually does, not what would be convenient to say.

Change log

• 23 September 2026. Said something this page had only hinted at: a therapist, or anyone else you grant a session to, can download that session as a text file or PDF — transcript, tone, escalations, coaching and the consent record — and a copy they have already downloaded is beyond un-sharing and beyond account deletion. Removing the share still stops any further download. Also corrected two tap paths that pointed at a screen that does not exist: forgetting your voice is Settings → Voice, and sending a diagnostic report is Settings → Diagnostics, not "Settings → Advanced".
• 20 September 2026. Corrected two statements that had gone stale: a live coaching session now says plainly that it keeps its audio by default (with the Keep audio toggle to turn that off), instead of claiming it keeps none. Added: heart rate from a paired Wear OS watch; the tone (arousal/valence) score our server computes from a session's audio; and a full description of what a paired watch's microphone does in each of its modes, including "Save last 2 min" and the Journal toggle.
• 25 August 2026. Previous version.

Contact

Questions, deletion requests, or anything on this page that does not match what you are seeing in the app: sagearbor@gmail.com.