← Home

Privacy Policy

Last updated: 9 September 2026 · Applies to mindbubble.online

This policy explains what MindBubble collects, why, and how you can ask us to change or delete it. We follow UK GDPR and the Data Protection Act 2018.

Who we are

MindBubble is the operator of mindbubble.online, a UK mental-wellbeing website. For privacy questions, email hello@mindbubble.online.

We are the data controller for information we hold about you. Some tools we use (listed below) are independent controllers for their own processing — for example Stripe for card payments, and Google if you sign in with Google or if Google ads are running.

You can use MindBubble without an account

Quick escapes, games, trackers, Find Calm, the bubble pad and most of the library work as a guest. Guest use is stored only in your browser (see “On your device”). Creating an account is optional. It lets us save your profile across devices, run the community wall, gallery uploads, and the optional £4.99 remove-ads purchase.

What we collect

If you create an account

• Name (or the name you choose), email address, and a hashed password (handled by Google Firebase Authentication — we never see your raw password).
• Age at sign-up (we ask this for UK Online Safety rules; you must be 13 or over).
• A profile: avatar, XP, rank, streak, quick escapes and Path sessions you have finished, and whether ads are removed.
• If you sign in with Google: the name and email Google shares with us for that sign-in.

If you post or upload

• Community Wall posts (text you choose to share, with your display name).
• Gallery photos or short videos you submit. These are reviewed before they appear publicly. Files are stored on our web host; captions and approval status sit in our database.

If you pay us

• Optional remove-ads purchase (£4.99, one-time) or a tip. Card details go to Stripe. We receive payment status, amount, and enough of an ID to turn ads off on your account. We do not store full card numbers.
• If the merch shop is open later: shipping name, address and order contents, so we can fulfil the order.

On your device (sync is off — we do not receive this)

• Wellness trackers (mood, sleep, anxiety, tics, self-harm recovery tools).
• Bubble pad (scratch notes, dated journal entries, lists). Nothing from the pad is uploaded. You can set an optional 4–6 digit passcode; it is stored only on this device as a hash, never sent to us.
• Money budgeter and cookbook meal plans / shopping lists.
• Saved items, theme, game progress, and a flag that ads are off.

Host logs may briefly record your IP address, browser type and pages requested, which is normal for running a website and dealing with abuse.

Privacy-friendly analytics (optional to us, not a profile of you)

We use Plausible to see which pages are visited, so we can keep the useful ones and not guess. It does not use advertising cookies, does not identify you, and does not follow you across other websites. Search text is not sent. Lawful basis: legitimate interests (running and improving a free site). You can opt out by turning on Do Not Track in your browser, or in the console on this site: localStorage.mb_analytics_off = '1' then refresh.

What we do not collect

• We do not ask for medical records, NHS numbers, or diagnoses.
• We do not put tracker, bubble-pad or crisis-journal content on our servers. Cross-device sync is not on. If we ever add it, it will be opt-in and reversible, and this page will change first.
• We do not sell your personal information.
• Support pages (Get Support UK, addiction, food help, wellness trackers) do not show ads.

Why we use it (lawful bases)

• To run the service you asked for (contract): account, profile, community, gallery, payments, remove-ads.
• Legal duty: keeping an age record for sign-up (13+).
• Legitimate interests: keeping the site secure, moderating community and gallery, understanding what is broken, and showing a display name on the leaderboard if you take part.
• Consent: optional tips, optional Google sign-in, and advertising cookies if Google AdSense is active on your visit. You can refuse ads by using the remove-ads option or by cookie controls in your browser.

Advertising

MindBubble is free. Quiet in-page banners help keep it running. Games never show ads, and ads are never sticky overlays.

Until Google AdSense is approved, banners on the site are our own (they point to remove-ads). They do not use advertising cookies.

When Google AdSense is connected, Google may use cookies or similar tech to serve and measure ads. Google is an independent controller for that. See Google’s privacy policy and how Google uses information for ads. You can opt out of personalised ads via Google’s ad settings. Paying £4.99 once removes MindBubble ads on your account.

Cookies and local storage

• Essential: sign-in session, theme, and the tools listed under “On your device”.
• A service worker may cache pages and images so the site works offline. It does not profile you.
• Advertising cookies only if Google ads are running, as above.

You can clear cookies and site data in your browser. That will sign you out and wipe local trackers on that device.

Who we share with

We only share what is needed to run MindBubble:

• Google Firebase — accounts and the profile / community / gallery metadata database.
• Our web host (cPanel) — the website files and gallery media you upload.
• Stripe — payments.
• Google AdSense — only once ads are live, for serving those banners.
• Plausible — page counts only, no advertising profile. See “Privacy-friendly analytics” above.

Some of these companies store data outside the UK (often in the US). They use their own safeguards (such as standard contractual clauses). We do not share your information with advertisers as a mailing list, and we do not sell it.

We may disclose information if the law requires it, or to protect someone’s safety.

How long we keep it

Account and community data stays until you ask us to delete the account, or we close the service. Payment records are kept as long as tax and accounting rules need. Host logs are rotated in the ordinary way. Local tracker data lives on your device until you clear it.

Your rights

Under UK GDPR you can ask to:

• see what we hold about you
• correct it
• delete it (including your account)
• download a copy (portability, where it applies)
• object to, or restrict, certain uses
• withdraw consent where we relied on it (for example advertising cookies)

Email hello@mindbubble.online and we will respond within one month. You can also complain to the Information Commissioner’s Office (ICO).

To wipe only this device: use your browser’s “clear site data” for mindbubble.online. That does not delete a signed-in account on our side — ask us if you want that gone too.

Children

MindBubble is not for children under 13. We ask for age at sign-up. If you believe a child under 13 has an account, email us and we will delete it.

Community and gallery

Anything you post on the Community Wall or that we approve in the Gallery can be seen by other visitors. Do not share addresses, phone numbers, or anyone else’s private information. We may remove posts or media that are harmful, illegal, or against a kind space.

A gentle boundary

MindBubble is not medical advice, a diagnosis, or a replacement for professional help. If you are in crisis: Samaritans 116 123 (free, 24/7), text SHOUT to 85258, or call 999 in an emergency.

Changes

If this policy changes in a meaningful way, we will update the date at the top of this page. The current version is always at mindbubble.online/privacy.html.

About MindBubble · Accessibility · Open the app · hello@mindbubble.online