Privacy Policy

Last updated September 2026

Mental is a private mood journal. The short version: your journal lives on your device and your own iCloud — we can't read it. There's no account to create, we never sell your data, and we don't track you across other apps or websites. The detail is below.

Prefer a shorter overview? Read the plain-language map of Mental’s data flows.

What we collect, and where it lives

As you use Mental, the app stores: your check-ins (the mood you log, any note you write, and your tags), the name you enter during setup, and — only if you choose to add them — your sex and year of birth. If you use the Mirror, it also stores your reflections, chapter names, and prompt answers.

All of this is kept on your device and synced through your own private iCloud (Apple's CloudKit), tied to your Apple ID — we keep no copy of your journal and have no way to read it. Mental has no login and no account. The optional AI relay described below temporarily processes only the data you choose to send for an AI request; it does not keep a lasting copy of your journal.

Analytics

To understand how the app is used and to fix problems, we use PostHog for product analytics. It records anonymous usage events — for example, that a check-in started, a streak milestone was reached, or a screen was opened — tied to a random identifier, not to your identity.

Analytics never include the text of your notes, your name (only the length of the name you entered is recorded), your mood content, or your sex or year of birth. Analytics are on by default; you can turn them off at any time in Settings.

Website campaign measurement

When someone opens our homepage through a tagged TikTok link, we count that page load in Cloudflare as an aggregate campaign event. This count is not a count of unique people. The campaign dataset contains no visitor ID, IP address, journal content, or full page URL. To keep App Store links attributed while you move between pages on our site, your browser tab temporarily keeps a campaign marker for 30 minutes from the first tagged visit. This uses session storage, not a cookie or a third-party tracking pixel. Apple separately reports eligible App Store campaign activity in aggregate; we cannot use these reports to identify an individual visitor or match a website visit to a particular download.

Apple Health (optional)

If you connect Apple Health, Mental can save your check-ins to Health as State of Mind, and read your sleep, steps, time in daylight, workouts, and any moods you've logged in other apps to show context in your journal. This stays on your device and is governed by Apple's Health permissions. Your exact Health values never leave your device, and Health data is never included in analytics. One opt-in exception: if you separately turn on “Include Health context in AI reflections” (off by default), Mental sends only coarse ranges — broad sleep, steps, daylight, and workout buckets, never exact figures — through Mental's Cloudflare relay to DeepInfra, the AI provider, so your reflections can take your rhythms into account. This data carries no name or account identifier and is handled as part of the temporary AI request processing described below. You can revoke Health access, or that AI opt-in, at any time.

AI features (optional)

Mental's daily reflections, tag suggestions, and Mirror reflections are generated using DeepInfra, a third-party AI service. Before an AI feature sends data for the first time, the app identifies DeepInfra and Mental's Cloudflare relay, explains what will be sent, and asks for your permission. When you enable an AI feature, the relevant journal text and supporting check-in context (such as dates, moods, and tags) are sent through the Cloudflare relay to DeepInfra solely to generate the requested feature. The request does not include your profile name or an account identifier. If you separately enable Health context, the coarse Health ranges described above may also be included.

To process an AI request, the Cloudflare relay temporarily keeps an encrypted request payload in Cloudflare Queue and temporary job status, result, and limited metadata in Cloudflare KV. This data expires within 24 hours. DeepInfra processes the request under its own privacy and data-handling terms. You can turn AI features off in Settings to stop future submissions; already-submitted work cannot be recalled. Reflective prompts that run on your device send nothing. AI features are off until you turn them on (Settings → AI) and aren't available in every region.

Purchases

If Mental offers a paid subscription and you buy one, the payment is handled entirely by Apple — we never see your card details. Subscription status is managed through RevenueCat, tied to an anonymous identifier, not to your name or identity.

What we don't collect

Mental does not collect your email, password, phone number, postal address, payment card numbers, precise location, contacts, or photos. We use no advertising identifiers and do not track you across other apps or websites.

Your control

From within the app you can export your full journal as a file, and delete your check-in history and summaries at any time. Deleting on your device removes them from your iCloud sync too.

Children

Mental is not directed at children under 13, and we do not knowingly collect information from them.

Changes

We may update this policy as the app evolves; the date at the top reflects the latest version.

About Mental

Return to the Mental mood tracker overview, or read about Mental's product purpose and editorial approach.

Contact

Questions? [email protected].