Privacy Policy

Last updated: 28 October 2026

MindMePlay is a mental preparation and journaling app for cricketers, including children and young people. We have written this policy in plain language so that players, parents, and guardians can understand it. If anything is unclear, contact us at [email protected].

1. Who we are

MindMePlay is provided by MINDMEPLAY LTD, a company registered in England and Wales, registered office 22 Bugle Grove, Finchwood Park, Wokingham, Berkshire, England, RG40 4NG ("we", "us", "our"). For UK data protection law, we are the data controller, and for India's Digital Personal Data Protection Act we are the Data Fiduciary, for the personal data described in this policy.

ICO registration number: ZC187700

For any privacy question, request, or complaint, contact us at [email protected].

2. Who can use MindMePlay

How an account is created depends on age:

• Anyone under 18 uses MindMePlay through a profile created and managed by a parent or guardian. Children and teenagers cannot create their own accounts. The parent or guardian sets up the profile from their own account and gives consent on the young person's behalf.
• Adults aged 18 and over create their own account and may also act as a parent or guardian managing one or more young players' profiles.

We do not allow under-18s to register their own accounts. If we learn that a young person has created an account without a parent or guardian, we will remove it.

3. What data we collect

The most important point first

MindMePlay is built local-first. Your journal entries, ratings, game plans, progress, streaks and practice history are stored on your device. They are not sent to us and we cannot see them.

Two things about backup are worth being clear on, and they are different things.

First, your own device backup. MindMePlay's on-device data is not yet included in your family's Apple iCloud or Google backup, so it cannot be restored from that backup if a phone is lost or replaced. We are changing this in a coming update and will update this section when we do. When it is included, the copy will sit in your own Apple or Google account, under your own account security. We will not be the provider or controller of that backup, we will not be able to see it, and we will not be able to delete it for you.

Second, our own optional cloud backup. This is planned and is not yet available. When it launches, an adult will be able to choose to back up that adult's own profile to our servers, and we will update this policy before it does. Children's and teenagers' activity data is not backed up to our servers.

Account information (stored on our servers)

• Email address and password (passwords are stored securely by our authentication provider; we never see them in plain text).
• A PIN set by parents or guardians to protect parental settings (stored on your device only, not on our servers).
• The account role: parent/guardian or adult; and the link between a parent account and the profiles it manages.
• Two consent records: (1) a record of your acceptance of our Terms of Service and Privacy Policy, including the date, time, and policy version; and (2) for family accounts, a separate record of the parent or guardian's specific consent to our processing of child profile data, including the date, time, policy version, and a description of what is being consented to. Both records are kept as our audit trail of lawful processing.

Profile information (stored on our servers)

• Display name or nickname (a real name is not required), and an optional avatar emoji.
• Age band (for example Junior, Teen, or Adult) not a date of birth and country and region (coarse locale fields used for content and localisation, not precise location).
• Cricket details: playing role, bowling type (pace or spin), and spin type where relevant; and voice band (used to select age-appropriate audio guidance).

Date of birth: checked, not kept

When an adult account is created, we ask for a date of birth only to confirm the person is 18 or over. We use it for that check and then discard it; we store only the result of the check (adult confirmed) and a timestamp.

Activity and journaling data (stored on your device)

• Journal entries, including structured inputs (mood, energy and focus ratings, session type, selectable prompts) and free-text notes that the user chooses to type.
• Game plans, session reflections, and cricket statistics the user records.
• Progress data such as completed sessions, streaks, levels, and experience points.
• Optional journal settings a parent chooses for a child, such as where the child mostly plays, which change only the words the journal shows.
• If a parent enters a cricket academy's code, which academy and squad the profile is linked to, and the dates the parent chose to share squad figures with it or stopped (section 8).

This data stays on the device. It is not yet included in your family's own Apple or Google device backup (see above). See section 7 for our planned cloud backup.

Website analytics

We use Google Analytics 4 (GA4) on this website (mindmeplay.com) to understand how visitors use the site, for example which pages are most visited. GA4 is configured in basic measurement mode only. Analytics cookies are not set until you give consent via the banner shown on your first visit to the site. If you decline, no analytics cookies are set and GA4 does not load. Website analytics are never linked to your app account and never include any journal content. For full details of the cookies we use, see our Cookie Policy at mindmeplay.com/cookies.

Marketing and mailing list

If you sign up to our waitlist or marketing list, we collect your email address. We use it to send you launch notifications and product updates. The lawful basis is your explicit consent, given via an un-pre-ticked opt-in at signup confirmed by a double opt-in email. You can unsubscribe at any time using the link in any email we send. We use MailerLite to manage our mailing list.

Payments and membership

If you buy a MindMePlay Membership, the payment is processed by Apple (App Store) and in future by Google (Google Play). They hold your payment details; we never see your card details. We use RevenueCat to manage subscriptions and confirm membership status: RevenueCat receives a purchase identifier and subscriber identifier linked to your account, the status of your subscription (for example, active or expired), and standard device and platform metadata. RevenueCat does not receive your card details and is never given any journal content. We receive a confirmation of the purchase so we can activate membership on your account.

Usage analytics

• We use PostHog (European Union hosting) to understand how features are used, for example, how often a session is completed. We have switched off automatic app-lifecycle and deep-link tracking. Analytics never include journal content or anything you write. For children's and teenagers' profiles, analytics are switched off entirely: while a young player's profile is in use, no usage events are sent to us at all. Product analytics apply only to adult accounts and never include journal content. Adults can turn this off at any time in the app's settings, under Usage data.
• Separately, the app keeps anonymous product totals. When a player completes an activity, such as saving a journal entry, a count for their age band and that week goes up by one. Nothing sent for these totals carries a name, account, device or any other identifier, so a total cannot be traced back to any player. These are counts, not usage events about your child, and they are only ever seen inside MindMePlay.
• We do not use analytics to build advertising profiles, and we do not sell data.

4. How we use data

5. Legal bases (UK) and grounds (India)

• Contract: to provide the app and its core features, and the membership you purchase.
• Consent: for children's data, consent is given by a parent or guardian and can be withdrawn at any time; in India, processing is based on consent, with verifiable parental consent for under-18s. For website analytics, consent is obtained via the cookie banner. For marketing emails, consent is given at signup via double opt-in.
• Explicit consent: when our planned optional cloud backup for adults' journal data becomes available (section 7), since it may contain information about your wellbeing.
• Legitimate interests: to keep the app secure and to improve it, balanced against users' rights, with particular care for children.

6. Children's and young people's privacy

We take the privacy of young athletes seriously and follow the UK GDPR and the UK Age-Appropriate Design Code (Children's Code), India's Digital Personal Data Protection Act, and, for users in Australia, the Privacy Act 1988 and the Australian Privacy Principles; and, for users in New Zealand, the Privacy Act 2020 and the Information Privacy Principles. MindMePlay is not currently offered in the United States or the European Economic Area; if we make the app available there, we will meet the applicable requirements, including the US Children's Online Privacy Protection Act (COPPA), before doing so and will update this policy.

• Every under-18 profile is created and controlled by a parent or guardian, who gives consent. Young people cannot self-register.
• A child's journal and activity, including everything they write, stay on the child's device. The only things that leave it are the anonymous totals described in sections 3 and 8, which carry nothing that identifies the child. Our servers hold only the details listed in section 3. That on-device data is not yet included in your family's own device backup; see section 3.
• Children's profiles are private. There are no social, sharing, messaging, or follower features in the app.
• We do not use children's data for marketing or advertising, we do not profile children, and we never show purchase offers on a child's profile. Membership offers are shown only to adults.
• A parent or guardian managing a profile can view that young player's information and progress and can request changes or deletion.

If you are a parent or guardian with any concern about your child's data, contact us at [email protected].

7. Our planned optional cloud backup

This section is about backup to our servers, which is planned and is not yet available. It is separate from device backup through your family's own Apple or Google account, which is covered in section 3.

When it launches, adult members will be able to choose to back up their own profile's activity data, journal entries (including free text), ratings, streaks and practice history, to our servers, so it survives a change of device. Because a personal journal can reveal information about your wellbeing, we will treat this as sensitive and will switch it on only with your explicit consent, asked separately when you turn backup on, naming exactly what will be stored. You will be able to withdraw at any time in settings: backup will stop, and you will be able to ask us to delete the server copy. Backed-up data will be encrypted in transit and at rest. This section is about an adult's own profile. We will update this policy, and tell parents, before any change to how children's data is stored.

8. Who we share data with

We do not sell personal data. We share data only with service providers that help us run the app, under agreements that require them to protect it:

• Supabase: secure database, authentication, and hosting. Data is hosted in the United Kingdom (AWS eu-west-2 region, London).
• PostHog: product analytics, European Union hosting.
• RevenueCat: subscription management and purchase validation. RevenueCat receives a purchase and subscriber identifier tied to your account, your subscription status, and standard device and platform metadata; it does not receive card details or any journal content. RevenueCat is based in the United States.
• MailerLite: mailing list and email marketing, for subscribers who have opted in. MailerLite is based in the European Union.
• MailerSend: transactional email delivery. MailerSend sends our account emails, including the parent email verification code, from [email protected], and processes the recipient email address and delivery data. MailerSend, Inc. is a US company; the data it processes for us is hosted in the European Union (Google Cloud, Belgium).
• Apple and Google: app distribution and payment processing through the App Store and Google Play.
• Google Analytics: website analytics on mindmeplay.com, used only with visitor consent. Google LLC is based in the United States.
• Cloudflare: hosting for our website, and delivery of the app's anonymous totals to us. Cloudflare handles your device's IP address to deliver each request, as it does for any visit to our website. It does not pass the address on to us with the totals, and we have not switched on any logging that would keep it. Cloudflare, Inc. is based in the United States and operates a global network.

Cricket academies and clubs. Where your child is part of a cricket academy or club that uses MindMePlay, and only where you have chosen to share, that organisation may see anonymous, squad level figures showing how often the squad used the app each week and which areas players worked on. The organisation is never told anything about your individual child, never sees who they are, and never sees what anyone writes. If you choose not to share, or later change your mind, your child is left out of these figures. Withdrawing stops any future counting; figures already counted cannot be removed, because they are anonymous totals that identify nobody.

We may disclose data if required by law, or to protect users' safety.

9. Where data is stored

Personal data in our own database is stored in the United Kingdom (Supabase, AWS eu-west-2 region, London). PostHog (product analytics), MailerLite (mailing list), and MailerSend (transactional email) host their data in the European Union. Some service providers that support payments, subscriptions, email delivery, and website analytics (Apple, Google, RevenueCat, MailerSend, Google Analytics, and Cloudflare) may process limited account, subscription, analytics, or connection data outside the United Kingdom and the European Union, under appropriate contractual safeguards including Standard Contractual Clauses and the UK International Data Transfer Addendum. If you use MindMePlay from India or elsewhere, your account data in our database is stored in the United Kingdom under appropriate safeguards. We do not transfer personal data to any country restricted under applicable law. On-device data stays on your device.

10. How long we keep data

We keep personal data while an account is active. If an account or profile is deleted, we delete the associated personal data (backups purge within 90 days), except where we must keep limited information to meet legal obligations, for example, consent records are retained for six years after account closure as evidence of lawful processing. You can ask us to delete data at any time.

11. Your rights

Depending on where you live, you may have the right to: access the data we hold about you or your child; correct it; delete it; object to or restrict certain processing; withdraw consent at any time (as easily as you gave it); request a portable copy; and, in India, nominate someone to exercise your rights if you are unable to.

To exercise any right, email [email protected]. For children's data, requests can be made by the managing parent or guardian. We aim to respond within one month (UK) and to resolve grievances within 90 days (India). UK users may also complain to the Information Commissioner's Office (ico.org.uk); India users may complain to the Data Protection Board of India (section 14); Australia users may complain to the Office of the Australian Information Commissioner (section 15); New Zealand users may complain to the Office of the Privacy Commissioner (section 16).

12. Security

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (TLS in transit, AES-256 at rest), secure authentication with multi-factor authentication on all service accounts, and access controls. We are adding app-level encryption of on-device data and will update this policy when it ships. No system can be guaranteed completely secure, but if a breach affects your personal data we will inform you, and the relevant authority, as the law requires.

13. Changes to this policy

We may update this policy as the app develops. When we make a significant change, we will update the date at the top and, where appropriate, notify users in the app; material changes affecting a child's data will be notified to the consenting parent.

14. India: additional information (DPDP)

For users in India, MINDMEPLAY LTD is the Data Fiduciary under the Digital Personal Data Protection Act 2023 and the DPDP Rules. The data and purposes are itemised in sections 3 to 4; your rights are in section 11. Grievance contact: [email protected] (Grievance Officer: the Founder, MINDMEPLAY LTD), we resolve grievances within 90 days. You may also complain to the Data Protection Board of India, whose complaint channel we will publish as it is operationalised. You can withdraw consent at any time via the app or by email. We obtain verifiable parental consent before processing any child's data, and we do not undertake behavioural monitoring of, or targeted advertising to, children. This notice is provided in English; contact us if you need help accessing it in another language.

15. Australia: additional information (Privacy Act)

For users in Australia, MINDMEPLAY LTD handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). The data we collect and the purposes are itemised in sections 3 to 4; your rights, including access and correction (APPs 12 and 13), are in section 11 and can be exercised via [email protected].

Overseas disclosure (APP 8): our service providers are located overseas. Account and consent data is hosted in the United Kingdom (Supabase, AWS eu-west-2, London); product analytics (PostHog), our mailing list provider (MailerLite), and our transactional email provider (MailerSend, a US company with data hosted in the European Union, Google Cloud Belgium) host data in the European Union; our subscription platform (RevenueCat) is hosted in the United States, alongside Apple and Google for app distribution and payments; and our website, and the delivery of the app's anonymous totals, run on Cloudflare, a US company with a global network. Before disclosing personal information to these providers we take reasonable steps to ensure they handle it consistently with the APPs, through binding data processing agreements and contractual safeguards including Standard Contractual Clauses and the UK International Data Transfer Addendum.

Complaints: contact us first at [email protected] and we will respond as set out in section 11. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

16. New Zealand: additional information (Privacy Act 2020)

For users in New Zealand, MINDMEPLAY LTD handles personal information in accordance with the Privacy Act 2020 and the Information Privacy Principles (IPPs). The data we collect and the purposes are itemised in sections 3 to 4; your rights, including access and correction (IPPs 6 and 7), are in section 11 and can be exercised via [email protected].

Disclosure outside New Zealand (IPP 12): our service providers are located overseas. Account and consent data is hosted in the United Kingdom (Supabase, AWS eu-west-2, London); product analytics (PostHog), our mailing list provider (MailerLite), and our transactional email provider (MailerSend, a US company with data hosted in the European Union, Google Cloud Belgium) host data in the European Union; our subscription platform (RevenueCat) is hosted in the United States, alongside Apple and Google for app distribution and payments; and our website, and the delivery of the app's anonymous totals, run on Cloudflare, a US company with a global network. Personal information disclosed to these providers is protected by comparable privacy safeguards through binding data processing agreements and contractual protections, including Standard Contractual Clauses and the UK International Data Transfer Addendum, so that it is protected to a standard comparable to the Privacy Act 2020.

Complaints: contact us first at [email protected] and we will respond as set out in section 11. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.

17. Contact us

MINDMEPLAY LTD · 22 Bugle Grove, Finchwood Park, Wokingham, Berkshire, England, RG40 4NG · [email protected]

Cookie Policy: mindmeplay.com/cookies