MentalDeload Home

Legal

Privacy Policy

Diese Datenschutzerklärung auf Deutsch lesen

Publisher: MentalDeload (Riccardo Riedl)
Website: www.mentaldeload.com/home/
Last updated: October 21, 2026

Summary: MentalDeload Home is an ad-free, offline-first household planner. An account is optional. Without an account, planning records stay on the device; optional weather and holiday requests still contact external services. Home Start, Family, or Max, or an inherited household plan, enables online backup and sync through Google Firebase. Optional attachments, photo and voice assistants, and place search process further data only when used. Reminders are local and opt-in. Approximate location is used only for optional weather or an explicitly started drive-time calculation; holiday import uses country, region, and year. Personal data is never sold.

1. Publisher / Data Controller

Riccardo Riedl
MentalDeload (Individual Developer)
Mühlgraben 20a
91320 Ebermannstadt
Germany
Email: mentaldeload@gmail.com

For questions about data protection, contact the email address above.

2. Scope

This privacy policy applies only to the MentalDeload Home Android app and the related pages under www.mentaldeload.com/home/. It does not apply to MentalDeload puzzle games, which have a separate privacy policy.

3. Legal Bases (GDPR)

Where the EU General Data Protection Regulation (GDPR) applies, processing is based on:

You may withdraw consent at any time in Android settings (notifications, location) without affecting processing before withdrawal.

4. Local-Only Use (No Account)

MentalDeload Home is offline-first. Without an account, tasks, appointments, lists, meals, notes, people, and preferences work fully on your device. Theme and display preferences, billing preferences, radio preferences, and the parent-gate PIN stay on the device only and are never synced to the cloud.

5. Account Data (Optional Google Sign-In)

An account is optional. The supported sign-in method is Google Sign-In.

When you sign in, the following may be processed:

On the device, account credentials are stored encrypted using the Android Keystore (AES-GCM). In the cloud, a user record may store your household link and email; a membership record may store your user identifier, email, role, life role, join time, and — for linked kids devices — an optional link to the child profile.

Account data is used only for authentication, sync, and household membership. Account data is never sold.

6. Cloud Sync and Household Sharing

When online backup is unlocked through Home Start, Family, Max, or an inherited household plan and you activate it, planning data may be uploaded to Google Cloud Firestore over HTTPS so it can be shared across your devices and household members. Shared content may include tasks, appointments, shopping lists, meals, notes, people/profiles, settings relevant to shared planning, and membership metadata.

Other members of the same household can see shared household content. Invite codes expire after 167 hours (about 7 days). Expired invite records are removed by a daily scheduled cleanup.

Synced cloud data is kept until you delete your account or request deletion (see sections 17 and 18). Device-only preferences that are not part of shared planning remain local.

7. Notifications

Reminders use local device notifications only (Android AlarmManager). MentalDeload Home does not use Firebase Cloud Messaging. Notification permission (POST_NOTIFICATIONS) is opt-in. After a device reboot, the app may use RECEIVE_BOOT_COMPLETED to reschedule local reminders.

You can withdraw notification permission at any time in Android settings. The app does not send marketing notifications.

8. Location, Weather, and Optional Drive Time

Optional weather and the explicitly started “Calculate drive time” action may use approximate location only (ACCESS_COARSE_LOCATION) when you allow it. The app does not request precise location or background location. Location data is not used for advertising or tracking.

For weather, forecast requests are sent to Open-Meteo (open-meteo.com) with latitude/longitude, a date range, and timezone set to automatic. No language parameter is sent. Open-Meteo may process your IP address and normal HTTPS request metadata as any web service would.

For Google place lookup and a drive-time request you explicitly start, the app processes the search text or confirmed Google Place ID through a protected MentalDeload backend path. A drive-time request additionally sends the current approximate coordinates to the server-side Maps/Routes path. Firebase Auth and App Check protect these requests. The confirmed Place ID and formatted address may be stored with the appointment locally and, when sync is on, in the household. The drive-time estimate, current origin, and route are not persistently stored by the drive-time feature or calculated in the background.

If device location is not available, weather may fall back to approximate city coordinates for the country/region capital from the household profile (“Your home”) — not from a postal code you enter. An on-device forecast cache is kept for about 1 hour. Drive time does not use that stored weather fallback; it requires a sufficiently recent device location after your explicit tap. You can deny or revoke location permission at any time.

9. Holiday Import (Optional)

Optional public-holiday import uses the OpenHolidays API (openholidaysapi.org). Requests may include country code, optional region, year, and language code DE. That provider may process your IP address and normal HTTPS request metadata.

10. Local Storage and Android Backup

The app stores planning data and preferences on your device so it works without a constant internet connection. Android Backup is enabled for the main local app data file. Billing preferences, parent-gate settings, and Firebase authentication preferences are excluded from backup.

Local app data is cleared when you uninstall the app (unless restored by an Android backup mechanism outside my control). Choosing in-app “Delete account and data” also clears local household planning data on that device.

11. Legacy Kids Mode test builds

The intended product is for adults only and does not include child accounts, Kids Mode, or child plans. The following disclosures apply only to older test builds during migration to general user profiles and permissions.

Adults create child and teen profiles in the household and may link a kids device. A linked kids device uses its own Google / Firebase account. That device receives a limited subset: its own tasks, profile and progress, appointments involving the child, shared appointments, and the meal plan. It cannot access the full household, other profiles, notes, or shared attachments. The child can finish tasks and request help (help text is length-capped). Adults in the household can see those actions.

The AI voice assistant, photo analysis, and Google place search or drive-time calculation are unavailable to child and teen accounts; the backend rejects these calls. Kids Mode read-aloud uses only voices reported by the installed Android TTS engine as usable without a network. If no such voice is available, read-aloud remains disabled.

Temporary records of kids actions in the cloud are kept for 14 days and then deleted by scheduled cleanup. Local completed kids-action queue entries on the device are purged after 7 days.

The parent PIN is stored only on the device (encrypted with the Android Keystore) and is never synced. Adults can unlink a kids device or remove its membership. Uninstalling the app clears local Kids Mode data on that device (unless restored by an Android backup outside my control).

If you believe a child has provided personal data inappropriately, contact me so I can delete it.

12. Billing (Google Play)

Optional Home Start, Family, and Max subscriptions and separately purchased credit packs use Google Play Billing. The app and related server functions may process product identifier, purchase token, order identifier, subscription state, verification time, Firebase user identifier, and household identifier. Purchase mappings and credit balances may be stored on the server until the household or account is deleted. Included credits refresh monthly; purchased credits are not reset at that boundary. Credit history records action, time, reserved and charged credits, and sometimes technical provider usage such as model and token counts, not the image or spoken content.

MentalDeload does not receive full payment card data. Google keeps Play purchase records according to Google’s policies: Google Play Terms of Service.

All three paid plans provide the same enabled online features. They differ by device count, cloud attachment storage, and monthly included credits. See the plan comparison. New data flows or providers will be reflected here.

13. Attachments, photo analysis, and voice assistant

Attachments

Selected photos and files are initially handled locally. When you use an attachment in a synchronized household, the file, its type, size, and association are stored through Firebase Cloud Storage and Firestore so authorized household members can access it. The storage allowance applies to the household. Deleted attachments may be restored during the 30-day trash period and are then cleaned up together with the cloud file. Shared content can remain visible to other members while it exists in the household.

Photo analysis

When you choose “Scan photo,” the app takes a photo or reads your selected image, resizes or normalizes it, and sends it to the protected Firebase backend. The backend submits the image and request details to Google Vertex AI (Gemini) to suggest an appointment or recipe. The proposal is shown for your review and becomes a record only if you apply it. The image is kept as a lasting attachment only if you also choose that option.

An upload can create a temporary object in Google Cloud Storage. Its upload session expires after 15 minutes. The object is deleted after analysis; periodic cleanup removes expired sessions and orphaned objects if a request fails or is abandoned. The app does not automatically save the proposed record. Google may process requests for safety and abuse prevention under its Vertex AI terms; see Google’s Vertex AI retention details.

Voice assistant and speech output

When you start voice input, the app uses the Android speech recognition service configured on your device. Depending on that service and its settings, it may process audio online. MentalDeload Home receives the recognized text, not the audio recording. Your utterance and a limited set of relevant household planning items are sent through the Firebase backend to Google Vertex AI (Gemini). The model returns an answer or proposed change; changes follow confirmation in the app. The backend does not save raw audio or the prompt as a lasting household record.

Speech output uses the installed Android text-to-speech engine. When connected, the default or a voice you selected may require the network; offline, the app falls back to an available offline voice. With a network voice, the engine may process spoken text online. Voice and engine settings can be managed in Android and the app.

14. Android Permissions

The app does not request precise location, contacts, SMS, direct microphone, direct camera, or health permissions. “Take photo” opens the camera app by Android intent; speech input opens the configured recognition service (see section 13). Play Integrity / Google Play services libraries may add standard technical permissions (for example wake lock). They do not add camera, contacts, microphone, or storage access for MentalDeload Home.

15. Third-Party Services / Processors

I use the following processors and independently responsible service providers to operate MentalDeload Home. Google’s data-protection role depends on the specific service and its terms.

Google Identity / Google Sign-In

Optional account authentication via Google Sign-In.

Firebase Authentication (Identity Toolkit)

Account creation and sign-in for optional cloud features.

Google Cloud Firestore

Cloud storage for optional household sync, membership metadata, credit balances, and technical feature records, accessed over HTTPS REST.

Cloud Functions for Firebase

Server-side functions for household operations, kids actions, purchase and credit verification, attachment storage, photo analysis, voice assistant, place lookup, and account deletion.

Firebase Cloud Storage

Cloud storage for shared attachments and temporary photo analysis uploads (see section 13).

Google Vertex AI (Gemini) and Google Maps Platform

Vertex AI processes selected photos, recognized speech text, and planning context needed for a request. Google Maps Platform processes place search text, selected Place IDs, and approximate origin coordinates when you explicitly request a drive time (see sections 8 and 13). Both services are called through the protected backend.

Android speech recognition and text-to-speech

The recognition and TTS services configured on your device may process audio or output text depending on the selected engine and voice. Their privacy notices also apply.

Firebase App Check with Google Play Integrity

Helps protect backend calls against abuse. Firebase Installations may be used transitively by the App Check native SDK; an Installation ID may be processed by Google.

Technical data processed by these Google services

May include IP address, Firebase user identifier, Firebase Android App ID, Firebase Installation ID, app/platform/SDK versions, technical request metadata, and App Check / Play Integrity tokens. Purpose: authentication, sync, function calls, security, and abuse prevention. MentalDeload Home does not use these services for advertising. Personal data is not sold.

Google Play Billing

Optional subscriptions and credit packs (see section 12).

Open-Meteo

Weather forecast API; receives coordinates for the requested forecast area when weather is used.

OpenHolidays API

Optional public-holiday data; receives country/region/year/language parameters when holiday import is used.

Website hosting (GitHub Pages)

These pages are hosted on GitHub Pages. GitHub may collect technical information such as IP addresses in server logs. I do not have access to that log data. See the GitHub Privacy Statement. This website does not use cookies, analytics, or tracking technologies.

Google and GitHub may process data in the United States or other countries. Where required, transfers rely on appropriate safeguards such as the providers’ standard contractual clauses / published transfer mechanisms.

16. Analytics and Advertising

MentalDeload Home does not use advertising SDKs, Google Analytics, Firebase Analytics, Crashlytics, Performance Monitoring, Remote Config, or Firebase Cloud Messaging in the release app. Personal data is not sold.

The app can store a limited production-safe diagnostic report on the device (handled errors with an exception or stable error code, serious warnings, unhandled managed exceptions when they can be captured, and a small number of navigation/operation breadcrumbs). This data stays in private app storage. There is no automatic upload and no Crashlytics or other telemetry SDK. A report leaves the device only after you review it and choose to send a support e-mail. You can delete stored diagnostic data in Settings → Help & Support. Native crashes, ANRs, and an immediate process kill cannot always be captured by managed code.

17. Data Deletion

Menu names below are English translations. In the German app, the account-deletion path is Profilmenü → Zuhause & Personen → Konto & Daten → Konto und Daten löschen.

You can delete your MentalDeload Home account and associated cloud data by:

Signing out ends the session on the device. It is not account deletion.

On full account deletion, the following are removed where applicable: Firebase Authentication account; email / user-identifier mapping; memberships; kids device bindings for that account; solely owned cloud household data; Play subscription mappings for a solely owned household; pending account-linked technical records; and local data if you chose “Delete account and data”.

If you are the owner of a shared household, it is recommended to transfer ownership to another adult first. Alternatively, ownership may transfer automatically to a remaining member before deletion completes — you are never permanently blocked from deleting. Shared content may remain available to other members without your membership or email linkage. If you are the sole owner, the entire household cloud data is deleted. If you are a member (not sole owner), you leave the membership and shared content remains for others.

In-app deletion removes associated cloud data immediately where technically possible. Email/web requests are completed within 30 days after verification, subject to any legally required retention. Google Play purchase records remain with Google according to Google’s policies.

18. Data Retention

Concrete retention periods:

After deletion is completed, I do not use that account data further, except where a legal obligation requires retention. Google Play records remain with Google. Shared household content may remain for other members. Removing membership and email linkage does not automatically anonymize that content; names, profile information, or personal information in free text may remain. Contact me to request deletion of such information or an individual child’s data.

Local on-device data remains on your device until you clear app data, uninstall, or complete in-app “Delete account and data” on that device.

19. Security

Authentication tokens on the device are stored encrypted with Android Keystore–backed storage where available. Cloud traffic uses HTTPS. Access to household cloud data is restricted to authenticated household members. App Check with Play Integrity helps protect backend calls against abuse.

20. Your Rights (GDPR)

If you are in the European Union / EEA, you have the right to access, rectification, erasure, restriction of processing, data portability, and objection, as well as the right to withdraw consent. To exercise these rights, contact mentaldeload@gmail.com.

You also have the right to lodge a complaint with a supervisory authority. For Germany (Bavaria), that is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA): www.lda.bayern.de. You may also contact your local EU authority.

21. California Privacy Rights (CCPA)

California residents have rights to know, delete, and opt out of the sale of personal information. I do not sell or rent personal information. To make a request, contact mentaldeload@gmail.com or use the deletion page.

22. Changes to This Policy

I may update this Privacy Policy if MentalDeload Home’s functionality changes. The current version will always be available on this website with the “Last updated” date shown above.

23. Contact

Email: mentaldeload@gmail.com

Delete account / data · Terms · Imprint / Legal Notice

← Back to Home

After the subscription ends

After the household subscription finally expires, shared synchronization ends for all members. Cloud content and attachments remain available for an announced 30-day download period and are then cleaned up automatically. Data already saved locally remains on each device; devices without another download may retain an older version. Private content is available only to its authorized owner and follows the expiry of that owner’s entitlement. Minimal status records for returning devices remain for up to 180 days after cleanup. Recovery backups expire after at most 14 weeks; necessary purchase and accounting records are handled separately.