Privacy Policy

Written by us, not by a lawyer. This notice is in force and we mean every line of it, but it has not yet been reviewed by a qualified Indian advocate and nothing here is legal advice to you. A review is booked before we take any payment. If anything below is unclear, or is not true about what we actually do, tell the Grievance Officer and we will correct it.

THE SHORT VERSION: we collect your email, the name you choose, a few optional details, and how you play. We use it to run your account and show you your own progress. We do not sell your data and we do not advertise to you. A few activities can optionally use your microphone so you can answer out loud — nothing is ever recorded or stored, no voiceprint is created, and every one has a full typed alternative. We never use your camera, and never infer emotion from anything. You can export or delete everything by asking. The optional "adapt for me" answers are stored only to change how games feel, are never treated as medical data, and can be deleted on their own at any time. If an organisation gave you a seat, it can see the report from drills you take on that seat and you see the same document at the same time — section 8. On a personal account, no employer ever sees anything.

1. Who we are and what this covers

MindSolv is an online arcade of cognitive games and problem-solving cases, operated from India and available at mindsolv.co. For India's Digital Personal Data Protection Act, 2023 (DPDP) we are the Data Fiduciary and you are the Data Principal; for the GDPR/UK GDPR we are the controller. This notice covers the website, the installable app (PWA), and any related support channels. It forms part of our Terms.

2. What we collect, why, and on what basis

We practise data minimisation: if we do not need it to run the product, we do not ask for it.

3. Adaptation preferences — the sensitive one, handled carefully

During setup we may ask, optionally, whether you would like the games adapted — for example calmer pacing, reduced flashing, colourblind-safe palettes, or larger targets. Some of those options mention things like focus differences or sensitivity to flashing, which can be health-adjacent. So we treat this question with extra care:

• It is entirely optional and always skippable.
• It carries its own separate consent tick, distinct from accepting the Terms.
• It is used for one purpose only: adjusting how games look and feel.
• It is never a diagnosis, never verified, never clinical, and never used to judge, score, rank or profile you.
• It is never sold, never shared, never used for advertising, and never included in leaderboards, exports or population statistics.
• You can view, change or delete it on its own from your Account, at any time, without affecting the rest of your account. Withdrawing this consent does not stop you using MindSolv.

If you would rather not tell us anything, skip the question — nothing about your experience is worse for it.

4. Microphone — optional, per-activity, never recorded

A few activities can optionally use your microphone, because saying words aloud is the natural way to do them: a word-fluency round, a naming round, a read-aloud passage. Every one of them has a full typed or tap alternative, and nothing in MindSolv — no score, rank, streak or reward — is out of reach without a microphone.

• Permission is asked only at the moment an activity needs it, never at signup, never in the background, and the microphone is released the instant the activity ends.
• We do not record, store, upload or retain any audio. Nothing reaches our servers or our database. Only the recognised words — text — are scored, and they are discarded when the round ends.
• No voiceprint, ever. We do not create or store a biometric identifier from your voice and never use it to identify or authenticate you, so this is not biometric processing under DPDP or the GDPR.
• No emotion or affect inference from voice or camera, in any circumstance — a permanent product rule, not a setting.
• Your browser may do the transcription. Where speech recognition is provided by your browser or operating system, that step is governed by your browser or device vendor's privacy terms rather than ours, and the audio may leave your device to reach their service. We say so before you enable a spoken activity. Prefer not to? Use the typed version.
• Revocable at any moment in your browser or device settings, mid- activity or after, with no loss of access or history. Because nothing is retained, there is no audio to export or delete.

5. What we never collect

No photographs, no video, no eye-tracking, no face data, no fingerprints, no voiceprints — no biometric identifiers of any kind. No emotion or affect inference. No contact lists. No precise location. No browsing activity on other sites. No advertising identifiers. We do not run third-party advertising or tracking pixels, we do not sell or "share" personal data as those terms are defined under CCPA/CPRA, and we do not build profiles for advertisers. Camera is not used by any current activity; if that ever changes it will follow the same per-activity, nothing-retained, full-alternative rules as the microphone.

6. Cookies and local storage

We use strictly necessary cookies for authentication (keeping you signed in) — these are essential and cannot be switched off while you are logged in. We also store small preferences in your browser's local storage: your chosen card theme, colourblind mode, and a queue that saves your scores if you go offline mid-game. We do not use advertising or cross-site tracking cookies. Clearing your browser storage signs you out and clears those preferences.

7. Who else touches your data

We keep the list short and name them plainly. Each is bound by its own contractual data-protection terms and processes data only on our instructions:

• Supabase — database and authentication (hosted in the Asia-Pacific region), with row-level security so your rows are readable by your account alone.
• Vercel — website hosting and delivery.
• Google — only if you choose "Continue with Google", to verify that sign-in.
• Our payment partner — when paid plans go live, to process payments and issue invoices. Card numbers never reach our servers.

Data may be processed outside your country by these providers. Where the law requires it, transfers rely on appropriate safeguards such as standard contractual clauses. We disclose data to authorities only where legally compelled, and we will tell you unless we are legally barred from doing so.

8. Organisation accounts — when an employer can see a result

Organisations can now buy MindSolv seats for their own people. This section is here because it is the one change that adds a new recipient of personal data, and a notice that left it out would be a notice that misled you.

If you have a personal account, none of this applies to you. No employer sees anything. Nobody can attach you to an organisation unless you claim a key that organisation issued you, and if you never claim one, nothing here touches your data.

If you do take a drill on a seat an organisation issued you, then for that drill the organisation is the Data Fiduciary under DPDP and we process the results on its instructions. It can see the results and the report from drills you take on its seat — and you see the same document, at the same time. There is no manager's edition and we will not build one. It cannot see anything from before you joined its account or after you leave, anything you type anywhere in the product, how you played moment to moment, or anything health-related; those are enforced in the database, not in the interface. You are given a separate Employee Notice before you start, naming the organisation and the single purpose it chose, and that purpose is stamped on every report so it cannot quietly become a different one. Consent to a wellbeing programme is not consent to a hiring input.

Your own copy of your results stays yours. The organisation's copy is deleted after its contract ends, on the schedule in the corporate agreement. The rest of the arrangement — retention, exit, sub-processors and breach notification between us and the organisation — sits in a separate corporate pack that cannot reduce anything promised to you here.

9. How long we keep it

Your account and gameplay history are kept for as long as your account exists — that lifetime trendline is the point of the product. Product event logs are pruned on a rolling basis (typically 12 months). Support conversations are kept for up to 3 years. Billing and tax records are kept for as long as Indian tax law requires (currently up to 8 years). When you ask for deletion, we delete or irreversibly anonymise your personal data within 30 days, except records we are legally required to retain.

10. Your rights

Under DPDP (and, where they apply, GDPR/UK GDPR and CCPA/CPRA) you can: get a copy of your data; correct anything wrong or out of date; delete your account and data; withdraw a consent you gave — including the adaptation preferences alone; ask us how your data is used; and nominate someone to exercise these rights if you cannot. We do not make automated decisions that produce legal or similarly significant effects about you (difficulty adjustment inside a game is not one). You will never be charged, denied service or given a worse experience for exercising a right.

How: use the Delete or Export controls in your Account page, or write to the Grievance Officer below. We acknowledge within 48 hours and complete within 30 days.

11. Security and breaches

We use encrypted connections (HTTPS), database row-level security, least-privilege service keys kept off the public internet, and we never store payment card data. No system is perfectly secure, and we do not claim otherwise. If a personal-data breach occurs, we will notify the Data Protection Board of India and affected users as required by DPDP, and equivalent regulators where other laws apply, without undue delay.

12. Children

MindSolv is for adults aged 18 and over and we do not knowingly collect data from anyone under 18. If we learn that an account belongs to a minor, we suspend it and delete the personal data. A MindSolv Junior edition, if launched, will use verifiable parental consent, no behavioural tracking and no advertising, as DPDP and children's privacy law require. If you believe a minor has created an account, tell the Grievance Officer and we will act promptly.

13. Changes to this policy

If we make a material change we will tell you in-app or by email before it takes effect, and where the change needs your consent we will ask for it again rather than assume it. Every version we publish is dated, and your acceptance is recorded against your account with its version and timestamp.

14. Grievance Officer and complaints

If we cannot resolve your concern, you may complain to the Data Protection Board of India, or to your local supervisory authority where other data-protection laws apply. We would always rather hear from you first.

MindSolv is cognitive entertainment and skills practice — not a medical, diagnostic or treatment tool. See also our Terms and Health & Safety notice.