Last updated: 14 August 2026

1. Data controller

The controller responsible for this website is [Name], [Address], Germany. Contact: hello@mind-stories.com. Privacy enquiries: privacy@mind-stories.com.

2. What we collect

If you only read: your language choice and display theme (stored on your own device, see section 5), and — for each view of a story — a one-way hash of your IP address (see section 7). We do not run analytics, advertising, or tracking of any kind, and no third party receives data about your visit.

If you create an account: your email address and username, your chosen orientation preferences, and the activity you generate — ratings, comments, favourites, and which stories you have read.

If you buy something: your email address, the amount, and the identifiers Stripe returns for the payment and the subscription. Card details are entered on Stripe’s systems and never reach ours.

If you submit a story: the text you send us and whether you want it published under your name or anonymously.

3. Why we process it

To operate the service and your account, to deliver and bill purchases and subscriptions, to keep the platform free of bots and abuse, to trace leaked paid content back to the account it was served to, and to meet our legal obligations (tax, withdrawal and cancellation records).

4. Legal bases (Art. 6 GDPR)

Performance of a contract, Art. 6(1)(b): account, purchases, subscription. Legal obligation, Art. 6(1)(c): invoicing and retention duties. Legitimate interests, Art. 6(1)(f): bot protection, rate limiting, security logging, and the watermarking described in section 7 — our interest is protecting paid content and the availability of the service. Consent, Art. 6(1)(a): only where we ask you for it explicitly.

5. Cookies and local storage

We use no analytics or advertising cookies, and therefore ask for no cookie consent. What exists is strictly what the site needs to work:

Cookie: NEXT_LOCALE — your language choice, session only. After you sign in, Supabase sets a session cookie that keeps you logged in.
Stored on your device, not sent to us: your display theme, your confirmation that you are of age, and your recent search terms. You can clear these at any time in your browser.

6. Processors and third parties

Supabase (database, accounts, authentication) · Vercel (hosting and delivery) · Stripe (payments) · Resend (transactional email — confirmations, password resets) · Cloudflare Turnstile (bot check on sign-up and on the submission, contact and cancellation forms; it receives your IP address for that check) · DeepL (translating story texts; no personal data is sent).

Typefaces are served from our own servers. Nothing on this site loads from Google, and no personal data is sold or passed on for advertising.

7. IP addresses, rate limits and watermarking

We do not store your IP address in readable form. Where we need it — to count requests against a rate limit, and to mark who a paid story was served to — it is first passed through a keyed one-way hash. The result cannot be turned back into an address.

Every view of a story carries an invisible watermark tied to that hash and, if you are signed in, to your account. Its purpose is to trace paid content that turns up elsewhere. This is legitimate interest under Art. 6(1)(f); you may object under Art. 21 GDPR.

8. Comments

Comments are published under your username. To protect you and others, a comment containing something that looks like an email address or a phone number is not published; the attempt is recorded — including the text you tried to post — so that repeated abuse can be recognised. Those records are for moderation only and are deleted with your account.

9. How long we keep it

Account data: until you delete your account. Payment records: as long as tax law requires us to keep them (in Germany, generally ten years). Rate-limit counters: hours. Security and watermark records: for as long as they can still serve their protective purpose, then deleted.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), and you may withdraw any consent you have given at any time. Write to privacy@mind-stories.com. You also have the right to complain to a supervisory authority.

11. Age

This site is for adults. We do not knowingly process data of anyone under 18.