Privacy Policy

Last updated: 27 June 2026

This Privacy Policy explains how Mento (“Mento”, “we”, “us”, or “our”) collects, uses, shares, and protects your personal data when you use the Mento mobile application and related services (the “Service”).

Mento is operated by Daniil Diachenko, Praça São João Bosco, 1350-296 Lisbon, Portugal, which is the data controller responsible for your personal data. If you have any questions, contact us at [email protected].

By using the Service you agree to the practices described in this Policy. If you do not agree, please do not use the Service.

Who this Policy applies to

This Policy applies to everyone who uses Mento. We provide a single, global standard of protection and additionally honor the rights described in the Your privacy rights section below for users in the European Economic Area (EEA), the United Kingdom, and the State of California, among others.

What data we collect

We collect the following categories of data, most of which you provide directly by using the app:

• Journal entries. The text of the entries you write, along with any title, and optional attributes you choose to attach.
• Chat history. The messages you exchange with the Mento AI companion and the AI’s responses.
• Voice recordings (audio). When you dictate an entry or message, the audio you record is sent for speech-to-text transcription. We use the resulting text; see Third-party service providers for how audio is processed.
• Search embeddings. To power semantic search and the AI companion, we generate numeric vector representations (“embeddings”) of your entries and chat messages. Embeddings are derived from your content and stored alongside it.
• Location and weather metadata. If you enable the optional “Capture location” and “Capture weather” settings, new entries silently record the approximate place and weather conditions in which they were written. You can turn these off at any time in the app’s Profile settings.
• Account information. When you sign in with Google, we receive basic profile information from your Google account (such as your name, email address, and profile picture) through our authentication provider. We do not receive your Google password.
• Usage and diagnostic data. We collect limited technical information needed to operate and debug the Service, such as error reports and basic device and app-version information (see Error monitoring below).

We do not intentionally collect special categories of sensitive data. Please keep in mind that journals are personal — anything you choose to write may include sensitive information, and it is processed as described in this Policy.

How we use your data

We use your data to:

• Operate the AI companion, including answering your questions and writing entries on your behalf when you ask.
• Provide semantic (“RAG”) search over your journal entries and past conversations.
• Consolidate long-term memory — periodically summarizing your recent conversations and entries into a private, per-user memory summary that helps the AI respond with context.
• Generate reflections and summaries (for example, weekly and monthly summaries) and journaling prompts.
• Transcribe your voice recordings into text.
• Provide customer support and respond to your requests.
• Maintain, secure, and improve the Service, including diagnosing errors and preventing abuse.

Legal bases for processing (EEA / UK)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service you request (for example, processing your entries and chat so the AI can respond).
• Consent — for optional features you switch on, such as location and weather capture. You may withdraw consent at any time.
• Legitimate interests — to secure the Service, prevent abuse, debug errors, and improve our product, balanced against your rights.
• Legal obligation — where we must process data to comply with the law.

Third-party service providers (sub-processors)

We do not sell your personal data. We share it only with the service providers (“sub-processors”) that make the Service work, and only as needed:

• OpenAI — processes your prompts, journal entries used as context, chat messages, and voice audio to generate AI responses, embeddings, summaries, prompts, and transcriptions. We access OpenAI through its API. Per OpenAI’s API data-usage policy, data submitted through the API is not used to train OpenAI’s models.
• Supabase — provides our database (PostgreSQL) hosting and authentication. Your entries, chat history, embeddings, summaries, and account data are stored in our Supabase project.
• Sentry — provides error monitoring. Sentry is configured to not send personally identifying information by default (SendDefaultPII is off), and sensitive request headers such as Authorization and Cookie are stripped before any event leaves our servers, so access tokens are never transmitted to Sentry.

Each provider acts as a processor on our behalf and is bound by appropriate data protection terms. We may also disclose data where required by law or to protect the rights, safety, and security of our users and the Service.

International data transfers

Our service providers may process and store data in countries outside your own, including the United States. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Data retention and deletion

We retain your personal data for as long as your account is active or as needed to provide the Service. Operational diagnostic data is kept only for a short period. When you delete your account, we delete or de-identify your personal data, except where we must retain it to comply with a legal obligation or to resolve disputes.

Your privacy rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”).
• Restrict or object to certain processing.
• Port your data — receive it in a structured, machine-readable format.
• Withdraw consent at any time for processing based on consent.

California residents (CCPA/CPRA)

If you are a California resident, you also have the right to know what personal information we collect and how we use it, the right to delete your personal information, the right to correct inaccurate information, and the right to opt out of the “sale” or “sharing” of personal information.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising any of your privacy rights.

How to exercise your rights

You can manage and delete your data, including deleting your account, from within the app, or by contacting us at [email protected]. We will respond within the timeframes required by applicable law. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

Security

We use technical and organizational measures to protect your data, including encryption in transit, authenticated access, and per-user data isolation in our database. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children’s privacy

Mento is not directed to children. You must be at least 16 years old (or the minimum age required to consent to data processing in your country, whichever is higher) to use the Service. We do not knowingly collect personal data from children below that age. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app. Your continued use of the Service after an update means you accept the revised Policy.

Contact us

Questions about this Policy or your personal data? Email us at [email protected] or write to Daniil Diachenko, Praça São João Bosco, 1350-296 Lisbon, Portugal.