Privacy Policy

Mental Gym (“the app”, at mg.huikuri.dev) is a small learning app run by an individual, Ossian Huikuri (“we”). Access is by approval. This page says plainly what the app stores, why, and who else touches it.

What we collect

From Google sign-in: your name, email address and profile picture URL (the openid, email and profile scopes, nothing more). We don't request your contacts, files, calendar or any other Google data.

From you: a username and a generated avatar (what other learners see), an optional note with your access request, and the answers you write while learning, plus the scores, progress, streaks and trophies derived from them.

Technical: a session cookie that keeps you signed in, and basic request data (such as IP address) used for rate limiting and security. There are no advertising or tracking cookies and no analytics profiles.

How we use it

To run your account, review access requests, generate lessons, grade your answers, show your progress and the weekly leaderboard, and email you when your request is received and when it's approved. We don't sell your data and don't use it for advertising. Your email is visible only to the admins who review access requests; other learners see just your username, avatar and scores.

The app's use of information received from Google APIs is limited to authenticating you and creating your profile, and adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Who processes it

We use these providers to operate the app, each only for the purpose listed:

• Google: sign-in.
• Vercel: hosting.
• Neon: the database where accounts and progress are stored (EU region).
• OpenAI: your answers and the lesson text are sent to an AI model to write lessons and grade your work.
• Resend: sending the two account emails mentioned above.

Retention and deletion

We keep your data while your account exists. To delete your account, answers and progress, email ossian.huikuri@gmail.com or ask an admin; it is removed from the database promptly. You can also ask for a copy of your data or a correction the same way.

Security and children

Data is encrypted in transit, secrets are kept out of the code, and sign-in sessions can be revoked. No system is perfectly secure, but we take reasonable care. The app is not intended for children under 13.

Changes and contact

If this policy changes materially we'll update the date above. Questions: ossian.huikuri@gmail.com. See also the Terms of Service.