Privacy Policy

1. Data We Collect

We collect three categories of information. First, account data you provide at sign-up or in your profile, such as your name, email address, and password hash. Second, content data, meaning the paragraphs, documents, and revision history you submit to the Service. Third, usage and technical data, such as IP address, browser type, pages visited, feature interactions, and timestamps collected through cookies and server logs. We do not knowingly collect sensitive categories of personal data unless you voluntarily include them in submitted content.

2. How We Use Data — AI Training Disclaimer

We use your data to operate and improve the Service, process payments, provide customer support, and send service-related communications such as password resets and billing receipts. We do not use your submitted content to train or fine-tune AI models, either our own or those of any third party. Aggregated and anonymized usage statistics may be used to improve product quality, but never in a form that identifies you or reproduces your original text. We will only process your personal data for purposes disclosed in this Policy or with your explicit consent.

3. Cookies and Tracking

We use strictly necessary cookies to keep you signed in and to remember your language and interface preferences. We also use privacy-respecting analytics to understand aggregate usage patterns, such as which features are used most. We do not sell advertising inside the Service and we do not use cross-site tracking cookies for advertising purposes. You can control cookies through your browser settings, but disabling strictly necessary cookies may prevent you from signing in.

4. Third-Party Services

We rely on the following third-party providers to deliver the Service, and each receives only the minimum data necessary for its role. Supabase — database hosting and user authentication. Resend — transactional email delivery for sign-up confirmations, receipts, and reminders. Stripe — payment processing and subscription billing. Anthropic, OpenAI, and Google (Gemini) — large language model providers that power the Duc Lin coach and generate revision suggestions from the text you submit. These providers act as data processors under our instructions and are contractually bound to appropriate confidentiality and security standards.

5. Data Retention

We retain your account data for as long as your account is active, and for a reasonable period afterward to comply with legal, accounting, and dispute-resolution obligations. Content data is retained while your account is active and deleted within thirty days of account deletion, except where longer retention is required by law. Server logs are retained for up to ninety days for security and debugging purposes. You can request deletion of your data at any time by contacting us at the addresses listed below.

6. Your Rights — GDPR and CCPA

If you are located in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) grants you the following rights: (1) right of access to the personal data we hold about you; (2) right to rectification of inaccurate or incomplete data; (3) right to erasure, sometimes called the right to be forgotten; (4) right to data portability in a structured, commonly used format; and (5) right to object to or restrict certain processing activities. If you are a California resident, the California Consumer Privacy Act (CCPA) also grants you the right to opt-out of the sale or sharing of personal information, the right to know what categories of data we collect, and the right not to be discriminated against for exercising these rights. To exercise any of these rights, or to reach our Data Protection Officer, please contact privacy@doublemind.ai and we will respond within the statutory time limits.

7. International Data Transfers

The Service is operated by Doublemind LLC from the United States, and our third-party processors may be located in the United States, the European Union, and other jurisdictions. By using the Service you acknowledge that your personal data may be transferred across borders, including outside your country of residence. Where required by applicable law, we rely on appropriate safeguards for such transfers, including the European Commission's Standard Contractual Clauses and, where available, adequacy decisions. We apply the same security standards to your data regardless of where it is processed.

8. Children's Privacy

The Service is not directed to children, and we do not knowingly collect personal data from anyone under 13 years of age, or under 16 years of age where the GDPR applies. If you are a parent or guardian and believe that a child has provided us with personal data without proper consent, please contact us and we will delete the information promptly. Users who are minors under local law must obtain parental or guardian consent before using the Service.

9. Contact

For general questions about the Service you can reach us at talk@ppvs.org. For privacy-specific questions, data-subject requests, and communications with our Data Protection Officer, please use privacy@doublemind.ai. We will acknowledge your request within a reasonable time and respond within any deadline required by applicable law.

10. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, third-party services, or applicable law. When we make material changes we will notify affected users by email and update the effective date shown below. We encourage you to review this Policy periodically; your continued use of the Service after an updated Policy takes effect constitutes acceptance of the revised terms.

Analytics Data

We collect anonymous usage data to improve the product: visitor/session identifiers (random UUIDs in browser local storage, not cookies), pages you view and actions you take, your device type and browser, and a hashed, daily-rotated representation of your IP address (we never store your raw IP).

We do not collect: your email, phone, address, payment details, or any content of your paper or chats with the coach for analytics purposes.

When you delete your account, your usage data is dissociated from your identity within 24 hours. Aggregated, anonymous analytics may be retained indefinitely for product improvement.