Privacy Policy

Who we are

The IceMind mobile application and the icemindapp.com website (collectively, "the Service") are operated by Nohan Lopez, an individual based in France.

For the purposes of the General Data Protection Regulation (EU Regulation 2016/679, "GDPR"), the California Consumer Privacy Act ("CCPA/CPRA") and equivalent legislation, Nohan Lopez acts as data controller (or "business" under the CCPA) of personal data collected via the Service.

No Data Protection Officer (DPO) has been appointed, as appointment is not mandatory under Art. 37 GDPR for an operation of this size. Contact for all data-related matters: support@icemindapp.com.

Note: a French micro-enterprise registration is in progress to formalize the activity. Business registration numbers and a registered postal address will be added to this page upon issuance.

Data we collect

Information you provide

• First name (optional)
• Age range or date of birth (optional)
• Session duration, water/air temperature, environment
• Breathing protocol used
• Post-session feelings and personal notes (optional)
• Cold-bath spots: if you add a spot, its GPS coordinates (latitude / longitude) and name are stored
• Profile picture (optional): only if you choose one from your photo library

Technical data (only if you enable cloud sync / IceMind Pro)

• Apple ID via Sign in with Apple. We never receive your full Apple email without explicit consent (Apple's private relay applies by default).
• Apple StoreKit transaction identifier used only to verify your subscription status.

Data we do NOT collect

• Your contacts
• Your health data (HealthKit is not used)
• No advertising identifier (IDFA), no cross-app tracking
• No background location
• No banking or payment information (Apple handles all payments)
• No photo library content beyond the profile picture you select

Legal basis for processing (GDPR)

Pursuant to Article 6 GDPR, each processing activity is grounded on an identified legal basis:

How we use your data

Your data is used exclusively to operate the Service for you. Nothing else.

We do not use your data for advertising, commercial profiling, or any automated decision-making producing legal effects within the meaning of Article 22 GDPR.

Storage and security

• Local storage by default: all your data stays on your iPhone, protected by iOS native encryption (Secure Enclave + iOS Data Protection).
• Cloud storage (IceMind Pro): synchronization via Firebase / Firestore (Google Cloud). Data — including GPS coordinates of your spots and your profile picture — is encrypted in transit (TLS 1.2+) and at rest (AES-256), tied to your Apple ID, accessible only to you.
• No data selling, ever: we never sell, rent, or share your data for commercial, marketing or advertising purposes, to any third party, under any circumstance.
• Technical measures: strong authentication via Sign in with Apple, least-privilege server access, administrative access logging, encrypted backups.

Location, camera and photos

Location

IceMind uses your location only when the app is open ("When in use" iOS permission), and only at the precise moment you add or view a spot on the map. No background tracking. No location history. You can deny access at any time in iOS Settings: the app remains fully usable without the spots map.

Camera and photo library

Access to camera and photo library is used exclusively to select your profile picture. No other image is read, analyzed, indexed or transmitted.

Notifications

If you grant permission, we only send: (i) a daily reminder at the time you choose, (ii) an alert when your streak is at risk, (iii) an occasional notification when you unlock a trophy. No marketing or promotional notifications. Disable any time in Settings > Notifications > IceMind.

Subscriptions and payment

IceMind Pro subscriptions are sold and managed exclusively by Apple via StoreKit. IceMind stores and processes no banking or card data. Apple may transmit to us, via our subscription management provider RevenueCat, an anonymized transaction identifier and your subscription status.

To manage or cancel: iOS Settings > [your name] > Subscriptions > IceMind.

Sub-processors and third parties

We share data only with sub-processors strictly necessary for the operation of the Service. Each is contractually bound (GDPR Art. 28) and never uses your data for its own purposes.

No other third party receives your data. We work with no ad network, no data broker, no behavioral analytics service.

International data transfers

Certain data may be processed outside the European Economic Area, notably in the United States, by our sub-processors Apple, Google (Firebase) and RevenueCat. These transfers are governed by:

• The EU–US Data Privacy Framework, to which Google LLC and Apple Inc. are certified signatories (European Commission adequacy decision of July 10, 2023);
• Where applicable, the EU Standard Contractual Clauses (SCC) (Commission Decision 2021/914);
• Additional technical measures: in-transit encryption (TLS 1.2+), at-rest encryption (AES-256), strong authentication, per-user segmentation.

You may obtain a copy of these safeguards by writing to us.

Website cookies

The icemindapp.com website uses no advertising cookies, no third-party tracking cookies, no behavioral analytics (no Google Analytics, no Meta Pixel, no Hotjar, etc.). Only strictly necessary technical cookies may be set (e.g. language preference storage), exempt from consent under EU and French regulations.

The IceMind mobile application, distributed via the App Store, uses no cookies.

Your rights

Regardless of your location, you have at all times the following rights over your data:

• Right of access — all your data is viewable directly in the app. A full export is available on email request.
• Right of rectification — modify your sessions, spots and profile any time in the app.
• Right to erasure ("right to be forgotten") — delete your sessions and spots in the app, or uninstall it to erase local data. To erase cloud data, contact us — effective within 30 days max.
• Right to restrict processing.
• Right to data portability — receive a structured export of your data in a standard format (JSON) on simple email request.
• Right to object to processing for legitimate grounds.
• Right to withdraw consent — for processing based on consent (notifications, location), revoke at any time in iOS Settings.
• Right not to be subject to automated decision-making producing legal effects (GDPR Art. 22).

To exercise these rights: support@icemindapp.com. We will reply within one month (Art. 12 GDPR), extendable by two months for complex requests.

Regional rights — rights specific to your jurisdiction

🇺🇸 United States — California (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (as amended by the California Privacy Rights Act):

• Right to know categories and purposes of personal information collected (see "How we use your data" above).
• Right to delete your personal information.
• Right to correct inaccurate information.
• Right to opt-out of the sale or sharing of personal information: IceMind does not sell or share your personal information for cross-context behavioral advertising purposes, and has not done so in the previous 12 months.
• Right to limit use of sensitive personal information.
• Right to non-discrimination when exercising these rights.

"Shine the Light" disclosure (Cal. Civ. Code § 1798.83): we do not disclose any personal information to third parties for direct marketing purposes.

To exercise CCPA/CPRA rights: email support@icemindapp.com with subject "CCPA Request". Response within 45 days as required.

🇬🇧 United Kingdom (UK GDPR)

Your rights are equivalent to those of EU users (access, rectification, erasure, objection, portability) under UK GDPR and the Data Protection Act 2018.

Supervisory authority: Information Commissioner's Office (ICO) — ico.org.uk.

🇧🇷 Brazil (LGPD)

Your rights are guaranteed by the Lei Geral de Proteção de Dados (Law No. 13,709/2018): confirmation of processing, access, correction, anonymization, portability, deletion, information about third parties, consent withdrawal.

Supervisory authority: Autoridade Nacional de Proteção de Dados (ANPD) — gov.br/anpd.

🇨🇦 Canada (PIPEDA + provincial laws)

Your rights are protected under the Personal Information Protection and Electronic Documents Act (PIPEDA), and in Quebec by Law 25.

Authority: Office of the Privacy Commissioner of Canada — priv.gc.ca.

🇦🇺 Australia (Privacy Act 1988)

Your rights are protected under the Privacy Act 1988 and the Australian Privacy Principles. Authority: Office of the Australian Information Commissioner (OAIC) — oaic.gov.au.

Other jurisdictions

We undertake to comply with applicable local data-protection laws in any jurisdiction where the app is available. For questions about your rights in a jurisdiction not listed above, contact us at support@icemindapp.com.

Complaints to supervisory authorities

If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the competent authority in your jurisdiction, including:

• 🇫🇷 France — CNIL: cnil.fr/fr/plaintes
• 🇬🇧 United Kingdom — ICO: ico.org.uk
• 🇺🇸 California — Attorney General: oag.ca.gov/privacy/ccpa
• 🇧🇷 Brazil — ANPD: gov.br/anpd
• 🇨🇦 Canada — OPC: priv.gc.ca
• 🇦🇺 Australia — OAIC: oaic.gov.au
• 🇪🇺 Other EU member states — your national data protection authority.

Data retention

We do not retain your data longer than necessary:

Data breach notification

In case of a personal data breach likely to result in a risk to your rights and freedoms, we commit to notify the competent supervisory authority within 72 hours in accordance with Art. 33 GDPR, and to inform you as soon as possible per Art. 34 if the risk is high.

Minors

IceMind is intended for users aged 15 and older, in line with the French legal age for digital consent. In jurisdictions where a different age applies (13 in the United States under COPPA; 16 in some EU member states), we honor the local minimum. We do not knowingly collect data from minors below the applicable threshold. If you are the legal guardian of a minor who has created an account, contact us for immediate deletion.

Changes to this policy

This privacy policy may be updated to reflect changes in the Service or applicable law. In case of a significant change (new purpose, new sub-processor, new international transfer), you will be informed within the app before such change takes effect. The "Last updated" date at the top reflects the most recent version.

Contact

For any question, request to exercise your rights, or complaint: support@icemindapp.com.