Privacy Policy

ThinkMint (“we”, “us”, “our”) is a study companion service operated from Sweden. We are the data controller for personal data collected through app.thinkmint.se.

Contact: study@thinkmint.se

• Account data — your name, email, and a hashed password. We use this to identify you and let you log in.
• Study content you create — photos of your notes, transcripts, summaries, flashcards, and answers you type into the app. This is yours; we store it so you can come back to it.
• Usage events — streak counts, last active day, and aggregated counts of features used. We use this to operate the service and prioritise improvements.
• Marketing consent — if you check the newsletter box on signup, we record the date, time, and IP address as proof of your opt-in (GDPR Article 7).
• Technical metadata — basic request logs (IP, user-agent, timestamps) kept for security and abuse prevention.

• Contract — to provide the ThinkMint service you signed up for.
• Legitimate interest — to secure the service, prevent abuse, and improve features based on aggregated usage.
• Consent — for the marketing newsletter, where applicable.

When you analyse notes, generate a summary, build flashcards, or answer in a Boss Battle, your content is sent to our AI provider (OpenAI) for processing. They process the content as our sub-processor and do not use it to train models. We do not sell or share your content with third parties for advertising or unrelated purposes.

During the beta, ThinkMint is free and we do not collect payment information. After the beta, paid subscriptions will be processed by Stripe; we never see or store card details — Stripe acts as a separate data controller for payment data subject to its own privacy policy.

We use only strictly necessary first-party storage (localStorage) to keep you logged in. We do not use any third-party analytics, advertising, or tracking cookies. See the Cookie Policy.

• OpenAI — LLM/AI processing (United States, EU SCCs)
• SendGrid (Twilio) — transactional email delivery
• Stripe — billing (post-beta only)
• MongoDB Atlas — encrypted database hosting
• Emergent — application hosting infrastructure

Your account and study data are kept for as long as your account is active. If you delete your account, all personal data is removed within 30 days, except where we are legally required to retain it.

You have the right to access, correct, delete, restrict, or port your personal data, and to object to processing or withdraw consent. To exercise any of these rights, email study@thinkmint.se. We will respond within 30 days. You can also lodge a complaint with the Swedish data protection authority, IMY.

Some sub-processors are located outside the EEA (notably the United States). Where required, transfers are protected by the EU Standard Contractual Clauses (SCCs).

ThinkMint is not intended for children under 16. We do not knowingly collect personal data from minors. If you believe we have, please contact us so we can delete it.

If we make material changes we will update the “Last updated” date above and notify users by email or in-app banner.