Privacy Policy

Placeholder text — replace with your final, lawyer-reviewed wording before launch.

This policy explains what personal information mindfrombooks collects, why, and your rights under Canadian privacy law, including PIPEDA and Quebec's Law 25.

What we collect

• Account details: your name, email address, timezone and reminder settings.
• Your course activity: the courses you enroll in and the responses you write.
• Payment records: what you bought, the amount, and Stripe reference IDs. Card details are handled by Stripe and never reach our servers.
• How you found us: see “Attribution cookie” below.

Analytics

We use Vercel Web Analytics to count page visits and a few product events (for example, “course viewed” or “task submitted”). It is cookieless and does not track you across other websites or build an advertising profile.

Attribution cookie

If you arrive through a link that contains campaign information (for example from an Instagram post), we set one first-party cookie named mfb_attr. It stores the campaign source, medium and name, the first page you landed on, the referring address and the time. It lasts 30 days. When you create an account, this is saved with your profile so we can tell which posts bring people here. It is not shared with advertisers.

Essential cookies

We use cookies that keep you signed in. The site can't work without them.

Who we share it with

• Supabase — database and sign-in
• Stripe — payments and refunds
• Resend — sending email
• Vercel — hosting and analytics
• Google — only if you choose “Continue with Google”

These providers may process data outside your province or outside Canada. We do not sell personal information.

Emails

We send account and purchase emails, and daily reminders if you leave them on. Every reminder has an unsubscribe link, and you can turn reminders off in Settings.

Your rights

You can see and correct your information in Settings, and delete your account there at any time, which removes your profile and responses. We keep payment records as required for accounting. You may also ask for a copy of your data or withdraw consent by contacting us.

Contact

The person responsible for the protection of personal information is [name], reachable at [email].