Privacy, in plain words

01Who we are

MindZone AI is built and run by Aiora Technologies LLC, a company registered in Wyoming, USA. For anything in this document, email aioraownr@gmail.com. There is no support department. The person reading that inbox is the person who wrote the code.

Age and minors. MindZone is for people 13 and over. Anyone under 18 needs a parent or guardian's permission to take part. The Start Testing action records the tester's agreement that this permission exists; we do not separately collect or verify the guardian's identity. We don't knowingly collect anything from a child under 13; if you believe we have, email us and we'll delete it.

02What we store, and why

• Your account. A username and a password hash. One-click tester accounts receive a random password that is never shown or used by the tester; administrators and manually created accounts use their chosen password. We never store a plaintext password.
• Your browser-profile credential. When you press Start Testing, we set a random 256-bit value in an HttpOnly cookie named mz_browser. It lets that browser profile return to the same tester account even when its network or IP changes. We store only a SHA-256 digest of the value, linked to the account, with creation, last-seen, expiry, and revocation times. It identifies a browser profile, not a physical device or a person. Another browser, private browsing profile, or cleared cookies creates a separate tester account.
• Your session prompts. The sentences you type ("45 minute deep work session") are kept, up to the last 200 per account. They power your history view and let us investigate abuse. Write them accordingly: a prompt is the one place where you decide how much of your life to tell us.
• Rendered audio. Generated files live on the server for about an hour so you can play and download them, then they are deleted automatically.
• Biometric readings. Only if you connect a wearable or type readings in yourself. We keep daily summaries (HRV, resting heart rate, readiness, sleep score), at most the last 90 per account, to compute your personal baseline.
• Wearable account keys. If you connect Oura or another provider, the access tokens are stored encrypted. We can read your recovery data with them; we cannot see your provider password.
• The live heart stream. During a session, beat data flows through the server and straight back out as a breathing pace. It is never written to disk. When the session ends, it's gone.
• Alpha tester agreement and feedback. Starting is one click, with no name, email, device, occupation, or age form. We record that the tester accepted the safety, age, data, Privacy, and Terms notice, together with timestamp, IP address, browser user-agent, and account ID. Feedback is stored with its related session, account, timestamp, and IP address.
• A security log. Logins, failed logins, joins, browser revocations, and admin actions, with IP address and the browser's user-agent string. This supports abuse prevention and incident investigation. IP and user-agent are not used to decide which account belongs to a browser.

03Cookies, browser storage, and what we don't do

We use two first-party, necessary authentication cookies:

• mz_session keeps you logged in for up to 7 days. It contains a random session token; only its SHA-256 digest is stored on our server.
• mz_browser recognizes one tester browser profile for up to 12 months. It is set only when Start Testing is pressed. It is not sent to other companies and is not used for advertising, analytics, or cross-site tracking.

Both are HttpOnly, SameSite=Lax, Secure cookies in production. Logout removes the session cookie but keeps browser continuity for the next explicit Start Testing press. “Forget browser” revokes and removes both. Clearing site data has the same browser-side effect, but cannot revoke a copied value; use “Forget browser” when possible.

Local browser storage remembers interface choices: mz-theme, mz-lang, mz-landing-view, and whether this data notice was shown. MindWave also stores the user's biometric-toggle choice and local warning or cooldown state. These values are not account credentials and are not sent to us merely because they exist.

No advertising. No analytics scripts, trackers, or pixels. No selling or renting data. No reading your contacts, precise location, photos, or other device files. No device fingerprinting: we do not combine fonts, canvas, GPU, screen size, timezone, user-agent, or similar signals to identify you. Those attributes change and could merge different people or split one person incorrectly.

We also don't pretend. When the audio can't adapt to your heart rate (it's fixed once rendered), we say so, and only the visuals and breathing guide adapt. The same rule applies to this document: nothing here is aspirational. It describes the system as it is built.

04Where your data travels

Everything lives on a single server we rent from Hetzner, a European hosting company. There is no data warehouse and no analytics pipeline. Three things leave that server, and only when you use the matching feature:

• Your prompt goes to NVIDIA when you generate with the AI strategy. NVIDIA's hosted NIM API processes it to plan your session. If you'd rather your prompts never leave our server, switch the strategy to Heuristic. It works offline and nothing is sent anywhere.
• Your browser fetches fonts from Google Fonts, which means Google sees your IP address made a font request. We plan to self-host the font and close even this.
• Wearable providers (Oura, Garmin, Strava, Polar) see that MindZone is requesting your recovery data, because you authorized exactly that.

05How it's protected

Traffic is encrypted (HTTPS). Passwords are hashed with bcrypt. Login-session and browser-profile credentials are stored only as SHA-256 digests, so the database does not contain the raw cookie values needed to replay them. Wearable tokens are encrypted at rest. The database and application files are readable only by the service itself. Logins are rate-limited and accounts lock after repeated failures. Every security-relevant event is logged.

06When things go wrong

Honest software plans for its own bad days. Here is ours:

• A data breach. If someone gets our database despite the measures above, the worst realistic exposure is: usernames, prompt history, daily biometric summaries, and the security log. Not your password (hashed), not your active sessions (digested), not your wearable password (we never had it). If a breach happens, we will notify the competent authority and affected people when the law requires it, using the site and any contact details we actually have. One-click tester accounts do not provide email addresses, so we cannot promise direct email notice to those accounts.
• Flickering light. Parts of MindField and MindSight can flash. Flicker can trigger seizures in people with photosensitive epilepsy. It is off for everyone by default and only turns on after you read the warning and consent. If you or anyone in your family has a seizure history, leave it off. If you feel unwell during any session, stop.
• This is not medicine. MindZone is an experimental cognitive optimization prototype. It is not a medical device, and its sessions are not clinical treatments. Don't use it to replace care, and don't use it while driving or operating anything dangerous.
• Loud audio. You control the volume. Start low, especially with headphones. Prolonged loud listening damages hearing regardless of what is playing.
• Wrong biometric readings. Wearable data is noisy. A bad sensor night can make the engine think you're exhausted when you're fine. We only use these readings to nudge session settings. We never diagnose, score your health, or make decisions with consequences beyond one audio session.
• Server loss. If the server dies, rendered audio and anything not yet backed up may be lost. We treat your data as yours, not as an asset to hoard, so we keep as little as possible in the first place.
• Our mistake. If we ever mishandle your data ourselves, the policy is the same as for a breach: we tell you, quickly and specifically, and we fix the process that allowed it.

07What we keep, and for how long

08What we value

Minimal collection. Every stored field exists because a feature needs it. There is no "collect now, find a use later".

Honesty over polish. If a limitation exists, we name it. That's why this page lists our failure modes instead of hiding them in clause 14(b).

A real exit. Leaving should be as easy as joining. One email deletes everything.

Calm by design. The product exists to lower nervous-system load. Software that spies on its users raises it. Those two things can't coexist, so we chose.

09Your rights

Wherever you live, we treat GDPR as the floor. Email aioraownr@gmail.com. One-click tester accounts have no email address, so include the displayed username and be prepared to verify control of the current browser session. You can:

• See everything we hold about you (we'll send a copy within 30 days);
• Correct anything wrong;
• Delete your account and its associated browser credentials, biometrics, prompts, and feedback. Security and agreement records may be retained only where law or the establishment or defence of legal claims requires it;
• Disconnect a wearable at any time from the MindSync page, which also deletes its stored tokens;
• Forget this browser from the app, which revokes browser continuity and signs out immediately. A later Start Testing press creates a new tester account.

If you're in the EU or UK and unhappy with our answer, you can complain to your local data protection authority - the supervisory body for the country you live in.

10Changes

If this policy changes in a way that matters, we'll say so on the site and, for anything significant, by email, before it takes effect. The date at the top always tells you when it last moved. This page is currently published in English only; if any translation ever conflicts with it, the English text governs.