Privacy policy
The short version: we collect as little as possible, we never sell or share it, and you can delete everything at any time.
Last updated: 30 September 2026
Using MindHealthy without an account
You can use every tool without signing up. What you enter (mood check-ins, journal entries, thought records, self-check results and your safety plan) is saved only in your browser’s local storage on your device. It never reaches our server. Clearing your browser data will delete it, so export or sync anything you want to keep.
If you create an account
An account lets you sync your entries across devices. We store:
- Your email address, used to sign in and to send password reset emails. We don’t send marketing.
- A hashed password. We never store your actual password.
- Your entries. These are encrypted before they’re saved to our database, and they’re only decrypted when you view them while signed in.
- Sign-in records (IP address and time of sign-in attempts), kept to protect accounts from being guessed.
Information about your mental health is special category data under UK GDPR. We process it only with your explicit consent, which you give when you create an account, and only to provide the service to you. You can withdraw consent at any time by deleting your account.
Your rights
- Access and portability: download everything we hold from your account page, as a JSON file.
- Erasure: delete your account from the same page. Your account and all entries are permanently deleted straight away.
- Correction: edit or delete individual entries in each tool.
You also have the right to complain to the Information Commissioner’s Office.
Cookies and tracking
We don’t use advertising, analytics or tracking cookies, and we don’t load third-party scripts, fonts or embeds. If you sign in, we set two strictly necessary cookies: one to keep your session and one to keep you signed in on that device. We also save your theme and text size preferences in your browser.
Where your data is stored
Our website and database are hosted on a server we manage. Server logs (including IP addresses) are kept for a short time for security and are not used to identify you.
Sharing
We don’t sell, rent or share your personal data. We would only disclose information if the law required us to.
Contact
For privacy questions, email [email protected].