Privacy Policy / 隐私政策

1. Who We Are

Mindsoul XR ("the App") is an Android XR application that integrates a Brain–Computer Interface (BCI) headband, hand-tracking, and AI conversation in an immersive 3D environment. This Privacy Policy describes what information the App processes, why it is processed, and the choices you have. If you have any questions, please contact us at kevin.zhang@mindsoul.cn.

2. Information We Process

• Account information: email address, password (stored as a hash on our servers), and — if you choose Google Sign-In — the basic profile fields returned by Google Credential Manager (name, email, profile picture URL, stable account identifier).
• EEG / brainwave data: when you connect a BrainLink Pro / Lite / Mind Link headband, the App reads the raw EEG stream and derived metrics (attention, relaxation, signal quality) over Bluetooth. EEG data is health-related data and we treat it as sensitive personal information.
• Bluetooth device information: the name, MAC address, and connection state of nearby BrainLink devices, used solely to discover and connect to your headband. We do not use Bluetooth scan results to derive your physical location.
• XR sensor data: hand-tracking landmarks and scene-understanding signals are used on-device to render the 3D keyboard and place virtual content in your space. These signals are not uploaded to our servers.
• Content you create: sentences you read aloud during semantic-collection tasks, motor-imagery labels, images you upload to the Imagination Gallery, and messages you send to the AI conversation feature (which are stored as long-term memory by our Mem0 integration).
• Diagnostic information: app logs (timestamps, screen names, error stack traces) written to the device under /sdcard/Android/data/com.pmtalk.mindsoul.xr/files/logs/. Logs remain on the device unless you choose to share them with us for support.

3. How We Use Information

• To authenticate you and keep you signed in.
• To stream EEG data to our backend in real time so the App can display visualizations, run BCI tasks (semantic collection, motor imagery), and return AI-generated results to your headset.
• To persist your conversation memory so the AI assistant can recall context across sessions.
• To store images you upload to the Imagination Gallery and link them to your account.
• To diagnose crashes and improve stability.
• To train and improve our BCI models. Data used for model training is de-identified or anonymized before use; we do not train models on raw account identifiers.

4. Permissions and Why We Need Them

• BLUETOOTH_SCAN / BLUETOOTH_CONNECT — to discover and connect to your BrainLink EEG headband. We declare neverForLocation, so scan results are not used to infer location.
• ACCESS_FINE_LOCATION — required by the Android OS for BLE scanning on Android 11 and below. We do not collect or transmit location data.
• HAND_TRACKING — to drive the spatial keyboard and gesture input. Hand-tracking data stays on-device.
• SCENE_UNDERSTANDING_FINE — to place virtual panels and content in your room. Scene data stays on-device.
• INTERNET / ACCESS_NETWORK_STATE / ACCESS_WIFI_STATE — to talk to our backend over HTTPS and to discover backend endpoints on the local network via UDP broadcast.
• FOREGROUND_SERVICE / FOREGROUND_SERVICE_MEDIA_PROJECTION — to keep the screen-recording session alive when you explicitly start a recording.

5. Sharing With Third Parties

• Google Sign-In (Google LLC) — only if you choose to sign in with Google. We receive your basic profile from Google; Google receives the fact that you signed in to Mindsoul XR.
• Mem0 — we use Mem0 as a memory store for your AI conversations. Conversation content you send to the AI feature is sent to Mem0 under our account and tied to your user ID.
• Cloud infrastructure providers — we host our backend and storage on standard cloud infrastructure that processes data on our behalf under written agreements.
• We do not sell personal information and we do not share it with advertisers. We do not include third-party advertising or analytics SDKs in the App.

6. Data Storage, Security, and Retention

All network traffic between the App and our backend is encrypted in transit using HTTPS / TLS. EEG records, conversation memory, and uploaded images are stored on our backend under access controls that limit visibility to the owning account and authorized administrators of your organization (if applicable). We retain account and content data for as long as your account is active. When you delete your account, we delete or anonymize your personal data within 30 days, except where we are required to retain specific records for legal or security reasons.

7. Your Rights and Choices

• Access, correct, or export your personal data.
• Delete your account and the personal data associated with it.
• Disconnect Google Sign-In and switch to email/password (or vice versa).
• Stop EEG collection at any time by disconnecting the headband or quitting the App.
• To exercise any of these rights, email kevin.zhang@mindsoul.cn from the address associated with your account. We will respond within 30 days.

8. Children

Mindsoul XR is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

9. International Transfers

Your information may be processed and stored in jurisdictions other than your own. Where required by law, we use appropriate safeguards (such as standard contractual clauses) for international transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you in the App. Continued use of the App after an update means you accept the revised policy.

11. Contact

For privacy questions, data-subject requests, or security reports, contact: kevin.zhang@mindsoul.cn.