Privacy Policy

Last updated: 01 August 2026

1. Who We Are

Mind Archive is operated by Barrel of Sunshine Ltd, a company registered in Scotland. In this policy "we", "our" and "us" mean Barrel of Sunshine Ltd.

You can reach us at hello@barrelofsunshine.com. We are the data controller for the personal data described here. Our ICO registration number is ZB927300.

2. What We Collect

2.1 Account information

• Your email address (for email/password sign-in).
• A hashed password (we never see the plain-text password).
• Your Firebase user ID (uid).
• If you sign in with Google or Apple (where wired), your display name and email as provided by that identity provider. We do not receive your contact list, calendar or other profile fields.

2.2 Your content

Mind Archive lets you keep notes, books, journals, recipes, photo albums, voice memos, PDFs, files, posters, links and notice boards. This content is:

• Stored locally on your device by default.
• Mirrored to Firebase (Firestore for metadata, Cloud Storage for attachments) only if you are signed in, have an active Pro subscription, and have cloud sync enabled.

Attachments are capped at 50 MB per file and 2 GB per user in the cloud.

2.3 Subscription information

• A RevenueCat App User ID linking your account to your subscription state.
• Transaction receipts and entitlement status, provided by Apple or Google via RevenueCat.
• Plan (7-day free trial, monthly, yearly or lifetime) and its expiry date.

Billing (card details, address) is handled by Apple or Google. We never see your payment details.

2.4 Diagnostics

We collect crash logs via the platform's built-in reporting (Apple / Google Play). We do not run Firebase Analytics or any other analytics tracking. We do not use advertising identifiers, and we do not track your location.

3. How We Use It

• To deliver the app and let you read, write and organise your content.
• To sync your content across your devices and the web app.
• To honour your subscription entitlements (unlock Pro, enter read-only mode when a subscription lapses).
• To respond to support requests you send us.
• To keep the service secure and diagnose crashes.

We do not use your content to train machine-learning models. We do not sell your data.

4. Legal Basis for Processing (UK/EU GDPR)

• Contract — processing needed to provide the app and sync you paid for.
• Legitimate interest — keeping the service secure, preventing abuse, diagnosing crashes.
• Consent — where required, e.g. enabling cloud sync. You can withdraw consent at any time by turning cloud sync off in Settings.
• Legal obligation — retaining transaction records for tax and accounting.

5. Storage and Retention

• Cloud data is stored on Google Cloud infrastructure, primarily in the EU multi-region (eur3), with some Google-managed services routed via the US. Google Cloud may replicate data across regions for durability.
• Your content is kept until you delete it or delete your account.
• Deleting your account wipes your Firebase Auth record, all Firestore documents under users/{your-uid}/, and all Cloud Storage objects under your uid.
• Inactive account cleanup. To keep our storage bill sustainable, accounts that have not signed in for 180 days and do not have an active Mind Archive subscription are deleted automatically, along with all associated Firestore documents and Cloud Storage attachments. Paying subscribers are never touched by this cleanup, even during periods of low usage. To keep a free / lapsed account active, open the app or sign in once every six months.
• Anonymised transaction records may be retained where required by tax law. They cannot be linked back to a deleted account.

6. Third Parties (Data Processors)

We share the minimum data necessary with the following processors, each under a data-processing agreement:

• Google Ireland Ltd / Google LLC (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions) — auth, sync, storage. Firebase privacy.
• RevenueCat, Inc. — subscription management and entitlement checks. RevenueCat privacy.
• Apple Inc. — App Store in-app purchases and Sign in with Apple. Apple privacy.
• Google LLC — Google Play in-app purchases and Google Sign-In. Google privacy.
• Native image picker — when you attach photos, the OS's native photo picker is used. No data is transmitted to us until you choose an item.

7. Sharing

We do not sell personal data. We do not share personal data with anyone other than the processors listed in section 6, unless required by law (for example a valid court order).

8. Your Rights

Under UK GDPR, EU GDPR and (where applicable) the California Consumer Privacy Act, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate personal data.
• Delete your account and all associated data.
• Export your content (built-in from Settings → Data Management → Export).
• Restrict or object to certain processing.
• Withdraw consent at any time (for example by turning cloud sync off).
• Complain to a supervisory authority — in the UK, the Information Commissioner's Office; in the EU, your local data protection authority.

To exercise any of these rights: delete your account in Settings, or email hello@barrelofsunshine.com. We aim to respond within 30 days.

9. Children

Mind Archive is not directed at children. We do not knowingly collect information from anyone under 13 (US COPPA) or under 16 (EU). If you believe a child has provided us personal information, please email us and we will delete it.

10. International Transfers

Because our processors operate globally, your data may be transferred to and processed in the United States and other countries outside the UK/EEA. Where this happens, we rely on the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum to safeguard your data.

11. Security

• In transit: all traffic between the app and our servers uses HTTPS/TLS.
• At rest: Firestore and Cloud Storage data are encrypted at rest by Google Cloud's default server-side encryption.
• Access control: Firestore and Storage security rules restrict reads and writes under your uid to your own signed-in session — no other user can access your data.
• Passwords: stored only as salted hashes by Firebase Authentication.

Mind Archive is not end-to-end encrypted. Google, as our infrastructure provider, has technical access to cloud-stored data.

12. Cookies (Web App)

The web app at mindarchive.io uses only functional cookies and local storage required to keep you signed in and to remember UI preferences. We do not set analytics, advertising or third-party tracking cookies.

13. Changes to This Policy

We may update this policy from time to time. If we make material changes, we'll notify you via an in-app banner and, where we have your email, by email. The "Last updated" date at the top always reflects the current version.