Privacy - projectmindsync.org

1. Who We Are

Project MindSync ("we", "us", "our") is operated by Project MindSync, United Kingdom. We are the data controller for the personal information collected through this website and our platform.

If you have any questions about this Privacy Policy or how we handle your data, please contact us at privacy@projectmindsync.org.

2. What Data We Collect

We collect the following types of personal data:

Account information — your email address, username, and location when you register. We do not collect your real name — you are known on the platform only by the username you choose.
Session data — the numbers you submit during LottoSync sessions, the timestamps of your submissions, your participation history, and your individual and collective match results
DreamSync data — images and text you provide to build your personalised VAudio experience
HealthSync data — health measurements you voluntarily log during MicroExperiments
Payment information — processed securely via Stripe; we do not store your card details
Shop orders — your delivery address and order details when you purchase from our shop
Usage data — how you interact with our website and platform (see Section 4)
Technical data — your IP address, browser type, and device information

3. How We Use Your Data

We use your personal data for the following purposes:

To create and manage your MindSync account
To deliver the LottoSync, DreamSync, and HealthSync services you have signed up for
To process payments and fulfil shop orders
To send you session reminders, results, and important platform updates by email
To use your anonymised session number submissions as part of our ongoing collective consciousness research — this is the core purpose of the LottoSync experiment and the reason you joined
To comply with our legal obligations

We will never sell your personal data to third parties or use it for purposes beyond those described in this policy without your explicit consent.

4. Cookies & Tracking

We use two types of cookies on this website:

Essential cookies — these are required for the platform to function and cannot be switched off. They include the cookies used to link your account to our AR product system. These are set for up to 10 years and do not track your browsing behaviour.

Analytics cookies — these are only set if you click Accept on our cookie banner. They help us understand how visitors use the site so we can improve the experience.

The analytics tools we use are:

Tool	Purpose	Provider
Meta Pixel	Measures ad performance and allows us to show relevant ads to people who have visited our site	Meta Platforms, Inc.
Google Analytics (GA4)	Tracks visitor numbers, traffic sources, pages visited, and session behaviour	Google LLC
Microsoft Clarity	Records anonymised session replays and heatmaps to help us understand how people navigate the site	Microsoft Corporation

You can withdraw your consent at any time by clearing your browser cookies. The cookie banner will reappear on your next visit, allowing you to change your preference.

5. Third Party Services

We use a number of trusted third party services to operate the platform. Each has their own privacy policy and data practices:

Service	Purpose
Firebase (Google)	User authentication, database, and backend functions
Stripe	Secure payment processing for DreamSync subscriptions and shop orders
Resend	Transactional email delivery (session reminders, results, account emails)
Bunny CDN	Fast delivery of audio, video, and image assets
Prodigi	Print-on-demand fulfilment for shop orders
ElevenLabs	AI voice generation used in DreamSync audio experiences

We only share the minimum data necessary with these providers to deliver our services.

6. How Long We Keep Your Data

We retain your personal data for as long as your account is active or as needed to provide you with our services. Specifically:

Account data — retained for the lifetime of your account
Session and experiment data — your LottoSync number submissions and results are retained indefinitely as anonymised research data forming part of the ongoing collective consciousness experiment. By participating in LottoSync you consent to this use.
DreamSync VAudio data — retained in your Dream Archive unless you request deletion
Payment records — retained for 7 years as required by UK tax law
Analytics data — retained in accordance with each provider's own retention policies

If you close your account, we will delete or anonymise your personal data within 30 days, except where we are legally required to retain it.

7. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights:

Right of access — you can request a copy of the personal data we hold about you
Right to rectification — you can ask us to correct inaccurate or incomplete data
Right to erasure — you can ask us to delete your personal data in certain circumstances
Right to restriction — you can ask us to limit how we use your data
Right to data portability — you can ask us to provide your data in a portable format
Right to object — you can object to us processing your data for certain purposes
Right to withdraw consent — where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, please contact us at privacy@projectmindsync.org. We will respond within 30 days.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Data Security

We take the security of your personal data seriously. We use industry-standard measures to protect it, including:

SSL/TLS encryption on all data transmitted between your browser and our servers
Secure authentication via Firebase, including email verification
Payment data handled exclusively by Stripe, who are PCI DSS compliant
Access to personal data restricted to authorised personnel only

No method of transmission over the internet is 100% secure. While we take all reasonable steps to protect your data, we cannot guarantee its absolute security.

9. Children's Privacy

Project MindSync is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at privacy@projectmindsync.org and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If we make significant changes, we will notify you by email or by displaying a notice on the platform.

We encourage you to review this policy periodically to stay informed about how we protect your information.

Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please get in touch:

Privacy Enquiries privacy@projectmindsync.org

General Enquiries hello@projectmindsync.org

Data Controller Project MindSync, United Kingdom