Your first conversation is one Daily Fuse awayGet the app

Privacy Policy

Last Updated: 12/10/2026

1. Who we are

Mindfuse is operated by Joeri Bonnevits in the Netherlands, who is the controller of your personal data under the EU General Data Protection Regulation (GDPR). Contact: [email protected].

This policy covers the Mindfuse app and the mindfuse.io website. It explains what we process, why, who helps us, how long we keep it, and what your rights are.

2. The short version

  • Your calls are not recorded. We do not store or analyse what is said.
  • You sign up with your phone number. We use it as the key of your account, to prevent abuse and for safety. The people you talk to never see it.
  • We ask your date of birth to make sure you are 18 or older.
  • We keep some information about calls (when they happened, how long they lasted, technical quality), but not their content.
  • If someone is reported, we keep safety records, even after an account is deleted, to protect other people.
  • We do not sell your data, and we do not show ads.
  • You can delete your account in the app at any time.

3. What we collect and why

A. Your account

  • Your phone number. You sign up by entering it and confirming a code we send by text message (through Firebase Authentication, a Google service). Your phone number is the key of your account record. We also use it to stop abuse (for example, so a free trial can only be used once per number), and in safety and moderation records. It is never shown to the people you talk to.
  • Your date of birth, which you enter once at sign-up so we can check that you are 18 or older. If you are under 18, you cannot use Mindfuse. In that case we keep a record that this phone number is not eligible, so the block cannot be avoided by signing up again.
  • Optionally, why you want to use Mindfuse (your usage intent), including any text you type in the "other" option. You can skip this question.
  • Basic account status, such as whether you have had a conversation, when you were last active, and your notification settings.

B. Calls and matching

  • Calls are not recorded, and audio is not stored or analysed. The app does check, as a technical signal, whether audio is flowing in a call (not what is said), so we can tell real conversations from failed connections.
  • Calls are peer-to-peer: the audio goes directly between your device and the other person's device, encrypted by the WebRTC standard. To set up a direct connection, the two devices exchange network information, including IP addresses. When a direct connection is not possible, the audio is relayed through Cloudflare's TURN service, which then processes your IP address. Google's STUN servers are used to help devices find a route to each other.
  • Matching is anonymous. To match people and run calls, we process temporary matching and connection records with an internal account id.
  • Call information (metadata): match ids, when a call connected and ended, how long it lasted, the countries of both people (worked out from the country code of each phone number), and a rough time-zone offset so the app can show the other person's time of day.
  • Call diagnostics, such as connection type, platform (iOS or Android), app version, whether a relay was used, and why a connection failed. We use these to make calls more reliable.
  • A record of which accounts have been matched with each other (by internal id, not phone number), with when they were matched and connected. We use it to confirm, when someone is reported, that the two people really did talk.

C. Reports, blocks and safety

  • When you report someone, the report contains the category you chose, the reason you typed, your phone number, the internal id of the person you reported, the time and, where available, the match id.
  • When you block someone, we store the block so you are not matched again.
  • For serious reports, we keep a safety record with the non-content facts about the match (for example when it happened and how long it lasted), both people's phone numbers and countries, and the outcome. The founder is alerted about serious reports and reports that someone may be at risk.
  • Records of suspensions and bans, and counts of how often an account has been reported and by how many different people.

D. Notifications

  • If you allow notifications, we store your device's push token (Firebase Cloud Messaging) and your notification settings. We use them to tell you when someone is looking for a conversation, to send Daily Fuse and event reminders, and to send occasional reminders to come back. We avoid sending them during night-time quiet hours, based on an estimate of your local time from your country.
  • You can turn notifications off in the app or in your phone's settings at any time.

E. Payments

  • Purchases are handled by the Apple App Store or Google Play. We never see your card or bank details.
  • We use RevenueCat to manage subscriptions. RevenueCat receives your internal Mindfuse account id and your purchase records (such as which product, when it started and when it renews or ends), and we keep a copy of your current access status.

F. App analytics, crash reports and security

  • Our own usage events (for example: which onboarding step you reached, that you started a search and how it ended, that you saw an offer). These are stored in our own database with an install id and, once you are signed in, your account id. Before sign-up they can include the country calling code you selected.
  • Crash reports through Firebase Crashlytics, which include technical information about your device, the app version and what went wrong.
  • Firebase App Check, which uses Google Play Integrity (Android) and Apple App Attest (iOS) to check that requests come from the real Mindfuse app. This protects against fraud, such as abuse of text-message sign-up codes.
  • Usage counters to prevent abuse, such as limits on how often an account can be matched or use the call relay.

G. Feedback and support

  • If you send feedback in the app, we store your message, the category, your platform and app version, your account id and, if you give it, your email address so we can reply.
  • If you email us, we keep the email to answer you.

We do not use your location from your phone's GPS, your contacts or your photos. The "country" we use comes from your phone number's country code.

4. What the other person sees

The person you talk to hears your voice. They do not see your name, phone number, photo or a profile. In some screens, such as the post-call screen and The Weave keepsake card, the app shows them the country you are in (based on your phone number) and your time of day, and shows you theirs. If you choose to share The Weave card, it goes wherever you share it.

5. Our legal bases

  • Contract (providing the service you signed up for): your account, phone verification, matching and calls, call metadata needed to run calls, payments and your access status.
  • Legitimate interests (keeping people safe and the service working): the age check and the under-18 block, reports, blocks, moderation and safety records, anti-abuse and anti-fraud measures (including the trial record, App Check and usage limits), security, call diagnostics, crash reports and our own usage analytics to improve Mindfuse. We have weighed these interests against your privacy; you can object (see section 10).
  • Consent: push notifications (which you allow in your phone and can turn off at any time), and analytics cookies on our website. You can withdraw consent at any time; this does not affect what happened before.
  • Legal obligation: for example keeping records the law requires, and responding to lawful requests from authorities.

6. Who we share data with

We do not sell your data. We share it only with:

  • Google (Firebase and Google Cloud): sign-in and text-message codes, our database, server functions, push notifications, Crashlytics and App Check. Also Google's STUN servers for call setup.
  • Cloudflare: the TURN relay for calls that cannot connect directly, and hosting of our website.
  • RevenueCat: managing subscriptions and purchases.
  • Stripe: processing payments for subscriptions bought on our website (name, email or phone number entered at checkout, and payment details, which we never see).
  • Apple and Google, as app stores: they process your purchases and app store account under their own privacy policies.
  • Website services: Google Analytics (only with your consent), Formspree (our website sign-up and application forms) and Featurebase (our public feedback board). See section 11.
  • Authorities, when the law requires it, or when it is needed to protect someone's life or safety, for example in cases of child exploitation.

The person you talk to is not someone we "share" data with, but they do hear your voice and may see your country and time of day (see section 4).

7. Data outside the EU

Some of the service providers above are based in, or process data in, the United States and other countries outside the European Economic Area. Where that happens, we rely on the safeguards the GDPR allows, such as the EU-US Data Privacy Framework where the provider is certified under it, and/or the European Commission's Standard Contractual Clauses. You can email us for more information about these safeguards.

8. How long we keep data

  • Your account data: until you delete your account.
  • Live call and matching records: deleted automatically shortly after the call, in most cases within about a day.
  • Safety and moderation records (reports, safety records, suspensions and bans): for as long as needed for safety and legal reasons, and reviewed periodically. These are kept even after the accounts involved are deleted, so that people who harm others cannot simply start again.
  • The under-18 record and the free trial record for a phone number: kept after account deletion so these protections cannot be bypassed. Neither contains your date of birth.
  • Diagnostics, analytics and feedback: kept while they are useful to improve Mindfuse. We review these periodically.
  • Purchase records: kept by Apple, Google and RevenueCat under their own rules, and as long as tax and accounting law requires.

9. Deleting your account

You can delete your account in the app under Account, then Delete. For your security we ask you to confirm with a code sent to your phone. When you delete your account, we delete:

  • your profile, including your date of birth and notification settings;
  • our copy of your access status;
  • blocks you made, and blocks others made of you;
  • your call and connection records and your presence status;
  • your app usage events;
  • your sign-in account, including your phone number in Firebase Authentication.

We keep:

  • safety and moderation records, as described in section 8;
  • the free trial record for your phone number;
  • if you were blocked for being under 18, a record that the number is not eligible;
  • records that contain only an internal id (or no identifier at all) and no longer link to your phone number once your sign-in account is deleted, such as call diagnostics, records of past matches, event sign-ups and feedback you sent;
  • purchase records held by Apple, Google and RevenueCat.

Deleting your account does not cancel a subscription. Cancel it in your App Store or Google Play settings to stop future payments.

10. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you and get a copy;
  • have incorrect data corrected;
  • have your data erased;
  • restrict how we use your data;
  • receive your data in a portable format;
  • object to processing based on legitimate interests;
  • withdraw your consent at any time, where we rely on consent;
  • not be subject to a decision based only on automated processing that significantly affects you, and to ask for a person to review it (see section 12).

To use any of these rights, email [email protected] from any address and tell us the phone number of your account. We may ask you to confirm it is really you. We will respond within one month. Some rights have limits, for example we may keep safety records where we have a strong reason to.

You can also complain to a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). If you live elsewhere in the EU, you can also contact the authority in your country.

11. Our website

  • Hosting. mindfuse.io is hosted by Cloudflare, which processes your IP address and basic request information to deliver and protect the site.
  • Analytics. We use Google Analytics to understand how the site is used, for example which pages are visited and which app store links are clicked. Analytics cookies are only set if you click Accept in the banner. Until then, Google Analytics runs in a restricted mode without analytics cookies. You can change your choice by clearing this site's data in your browser.
  • Google News button. Our pages load a script from Google News that shows a button to add Mindfuse as a preferred source in Google. Loading it means Google receives your IP address and browser information.
  • Forms. If you sign up for our email letter or apply to our affiliate program, what you enter (such as your email address and, for affiliates, your name, channel and audience) is sent to Formspree, which forwards it to us. Our contact form does not send anything itself: it opens your own email app with a message to [email protected].
  • Feedback board. Our feedback page shows a board hosted by Featurebase, under its own privacy policy.
  • Live numbers. Some pages fetch anonymous statistics from our server, which means our server (on Google Cloud) receives your IP address.
  • Browser storage. The site stores your light or dark theme choice and your analytics choice in your browser's local storage. These are not sent to us.

12. Automated safety measures

To protect users quickly, some safety measures happen automatically based on reports, for example a temporary suspension from matching while a serious report is reviewed, or a ban when several different people who we can confirm actually spoke with someone report them. These measures are reviewed by a person. If one affects you, you can explain your side and ask for a review by emailing [email protected].

13. Children

Mindfuse is only for people aged 18 and older. We ask for your date of birth at sign-up and block anyone under 18, tied to their phone number so it cannot be reset by reinstalling the app. We do not knowingly process data of minors beyond what is needed to keep them out. If you believe a minor is using Mindfuse, please tell us at [email protected] or report them in the app.

14. Security

We protect your data with measures such as encrypted connections, encrypted call audio, access rules on our database, and App Check. No system is perfectly secure, so we cannot guarantee absolute protection. If something goes wrong, we will act on it and inform you and the authorities where the law requires.

15. Not a crisis service

Mindfuse is not therapy or an emergency service. If you or someone else is in danger, contact your local emergency number. The app lists helplines you can call.

16. Changes to this policy

We will update this policy when what we do changes. The date at the top shows the latest version. If a change matters for how we use your data, we will tell you in the app or by other reasonable means before it takes effect.

17. Contact

Questions, requests or concerns? Email [email protected].

Add Mindfuse as a preferred source on Google