Privacy Policy

LeanMind AI ("LeanMind," "we," "us") is a behavioral wellness coaching service operated by [PLACEHOLDER: Austin Zyr Group LLC], based in [PLACEHOLDER: state/country]. You can reach us at [PLACEHOLDER: privacy@yourdomain.com].

This is not medical care. LeanMind provides general behavioral coaching content. It does not diagnose, treat, or prescribe. If you are in crisis, contact your local emergency number or a crisis line listed in your country.

• Account information. Your email address (used as your login) and a salted, bcrypt-hashed password. We never see your plaintext password.
• Profile data. Your selected goal (e.g., "sleep," "stress"), preferred language, and unit system.
• Chat content. The messages you send to the coach and the responses generated, plus metadata (timestamps, citation references).
• Billing data. If you subscribe, we receive a Stripe customer ID and subscription status. Stripe stores your card details — we do not.
• Operational data. Error logs, performance metrics, and request data necessary to keep the service running.

• To provide the coach: process your messages, retrieve relevant evidence, generate responses.
• To improve safety: run a classifier on every message to detect crisis content.
• To bill you (if you subscribe) and prevent payment fraud.
• To debug and operate the service.
• To send transactional emails (welcome, password reset, subscription receipts). We do not send marketing emails.

We use the following third-party processors. Each is bound by their own privacy terms, which you can review on their sites.

• OpenAI — your message content is sent to OpenAI for generation and moderation. OpenAI may retain content for up to 30 days for abuse monitoring, then deletes it. [LAWYER REVIEW]
• Neon — Postgres database hosting (US, AWS us-east-1).
• Qdrant Cloud — vector storage for the evidence library (US, AWS us-east-1).
• Fly.io — application hosting (US, Ashburn VA).
• Vercel — frontend hosting and CDN (multiple regions).
• Stripe — payment processing (if you subscribe).
• Resend — transactional email delivery.
• Sentry — error monitoring. Sentry receives error stack traces and request metadata, not chat content.

We do not sell your data and we do not share it with advertisers or analytics brokers.

You have the right to:

• Access the data we hold about you.
• Export your data in a portable format.
• Correct any inaccurate data.
• Delete your account and all associated data.

To exercise any of these rights, email us at [PLACEHOLDER: privacy@yourdomain.com]. We'll respond within 30 days.

If you are located in the EU/EEA, UK, or California, you have additional rights under GDPR / UK GDPR / CCPA respectively, including the right to lodge a complaint with your local data protection authority. [LAWYER REVIEW]

Our primary infrastructure is hosted in the United States. If you are located outside the US, your data will be transferred to and processed in the US. We rely on [LAWYER REVIEW: e.g., Standard Contractual Clauses; mention specific transfer mechanism] for cross-border transfers. [LAWYER REVIEW]

• Active accounts: retained while your account is open.
• Chat history: retained while your account is open; deleted when you delete your account.
• Billing records: retained for [PLACEHOLDER: 7 years] as required by tax law. [LAWYER REVIEW]
• Error logs (Sentry): 30-day rolling window.

We use browser localStorage to store your authentication token so you stay signed in. We do not use third-party tracking cookies or analytics cookies.

LeanMind is not intended for and is not designed for anyone under 18. We do not knowingly collect data from minors. If you believe a minor has signed up, please contact us and we will delete the account.

We will post any changes to this policy on this page with an updated date. For material changes, we will also notify active users by email.

Questions about this policy or about your data? [PLACEHOLDER: privacy@yourdomain.com]