Privacy Policy

Last updated: February 10, 2026

Alston Analytics, doing business as MindCast (“we,” “our,” or “us”), respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and safeguard your information when you use our audio learning platform at mindcast.fm (the “Service”).

1. Information We Collect

1.1 Account Information

When you sign in with Google OAuth, we receive and store:

• Full name and email address
• Profile picture URL (optional, provided by Google)
• Google account identifier (used solely for authentication)

We do not receive or store your Google password. Authentication is handled entirely through Google’s OAuth 2.0 protocol.

1.2 User-Generated Content

When you use the Service, you may create or provide:

• Episode topics and prompts — the subjects you request for custom audio episode generation
• Journal and reflection entries — free-form text you write in response to episode prompts
• Snips (highlights) — saved excerpts from episode transcripts
• Quiz responses — answers to comprehension and review questions
• Episode reviews — ratings and feedback on episodes
• Onboarding preferences — interests, learning style, and preferred episode format

1.3 Learning Analytics

We collect data about your learning engagement, including:

• Listening history and episode progress
• Mastery scores and knowledge-graph progress
• Interlude interaction data (responses to Socratic pause prompts)
• Learning path progress and completion
• Replay hotspot data (which sections you re-listen to)

1.4 Technical and Usage Data

We automatically collect:

• IP address (for security, rate limiting, and fraud prevention)
• Browser type and version
• Device type and operating system
• Referring URL and pages visited
• Timestamps of requests

1.5 Payment Information

Payment processing is handled entirely by Stripe. We never receive or store your full credit card number. From Stripe we receive:

• Stripe customer identifier
• Subscription status and plan tier
• Last four digits of your payment method (for display only)

2. How We Use Your Information

We process your information for the following purposes:

• Service delivery: Generating audio episodes, rendering transcripts, and powering interactive learning features
• Personalization: Tailoring content recommendations, knowledge graphs, and learning paths to your interests
• Account management: Authenticating your identity, managing subscriptions, and enforcing usage limits
• Analytics and improvement: Understanding aggregate usage patterns to improve content quality and platform features
• Communication: Sending essential service updates, security alerts, and subscription-related notices
• Safety and compliance: Preventing fraud, enforcing our Terms of Service, and complying with legal obligations

3. AI Processing Disclosure

MindCast uses artificial intelligence to research, draft, fact-check, and narrate audio episodes. When you request a custom episode, the following occurs:

• Your topic text (not your account details) is sent to large-language-model (LLM) APIs for content research, script generation, and quality enhancement.
• The generated script is sent to text-to-speech (TTS) APIs to produce the audio narration.
• We use multiple AI providers (see Section 5). Each provider processes data according to their own privacy and data-use policies.

What we do NOT share with AI providers: your name, email address, payment information, journal entries, quiz responses, or any other personally identifiable information. Only the topic/prompt text required for content generation is transmitted.

4. Data Storage and Security

4.1 Where Your Data Lives

• Database: Your account data, episodes, reflections, snips, and learning analytics are stored in a PostgreSQL database accessed through Prisma Accelerate, hosted in the United States.
• Audio files: Generated audio episodes are stored on Vercel Blob Storage (US-based, encrypted at rest).
• Application hosting: The web application runs on Vercel’s edge network, with serverless functions executing in US regions.

4.2 Security Measures

We implement the following security safeguards:

• All data in transit is encrypted via TLS/HTTPS
• Database connections are encrypted and access-controlled
• Authentication is handled via OAuth 2.0 (no passwords stored)
• Session tokens are HTTP-only, secure, and scoped
• API routes enforce authentication and rate limiting
• Administrative access is restricted and audited

No system is 100% secure. If you discover a security vulnerability, please report it to info@alstonanalytics.com.

5. Third-Party Services

We rely on the following third-party services to operate MindCast. Each processes data under its own privacy policy:

We do not sell, rent, or trade your personal data to any third party for marketing or advertising purposes.

6. Journal and Reflection Data

Your journal entries and reflection responses are treated with the highest level of privacy:

• All journal and reflection data is private by default and visible only to you.
• We do not use your journal or reflection content to train AI models.
• We do not share, sell, or expose your journal entries to any third party, including our AI providers.
• Journal data is stored encrypted in our database and is only retrieved when you access it through the Service.
• You may delete any or all journal entries at any time from your account.

7. Canon vs. Custom Episode Privacy

• Canon (curated) episodes are publicly available content pre-generated by MindCast. They are accessible to all users and indexed by search engines.
• Custom (on-demand) episodes you generate are private by default. Only you can access your custom episodes unless you explicitly choose to share them.

8. Cross-Session Memory

We store conversation context across sessions to provide continuity in your learning experience. This means the platform can recall topics you’ve explored, insights you’ve generated, and questions you’ve asked in previous sessions. Plus and Pro users receive deeper memory, including longer context windows and richer session summaries.

You can delete all conversation data at any time from your account settings. Deleting conversation data permanently removes your session history, insights, and cross-session context.

9. AI Model Providers

Episodes are generated using AI language models from multiple providers, including OpenAI and Google. When you request a custom episode or interact with AI-generated features, your prompts are sent to these providers for processing. Each provider operates under its own data processing agreements (see Section 5 for the full list).

We do not use your data to train AI models. Our agreements with AI providers explicitly prohibit the use of your inputs and outputs for model training. Your prompts are processed solely to generate your requested content and are not retained by providers beyond the duration needed to fulfill the request.

10. Voice Recording

If you use voice input (e.g., the “Talk It Through” feature), audio is processed in real-time and is not stored after transcription. Voice data is transmitted to a speech-to-text service, converted to text, and then discarded. The resulting text transcript is treated the same as typed input and is subject to the same privacy protections described in this policy.

We do not create voice profiles, store voice recordings, or use your voice data for any purpose other than real-time transcription.

11. Artifact Generation

Insights, summaries, takeaways, debate exercises, and other artifacts are generated from your conversations and episode interactions. These artifacts are stored in your account and are visible only to you unless you explicitly choose to share them.

Artifact generation is subject to daily limits based on your subscription tier. Artifacts are derived from content you have already provided or consumed within the platform. You may delete individual artifacts or all artifact data from your account at any time.

12. Cookies and Local Storage

MindCast uses a minimal set of cookies and browser storage:

• Authentication session cookie (essential) — maintains your signed-in state. HTTP-only, secure, and scoped to our domain.
• Locale preference cookie (functional) — stores your language preference (e.g., English or Spanish).
• Theme preference (localStorage) — remembers your light/dark mode setting.
• Knowledge-graph layout cache (localStorage) — saves your graph visualization layout for performance.

We do not use third-party tracking cookies, advertising cookies, or fingerprinting technologies. You can clear cookies and local storage at any time through your browser settings.

13. Your Rights

Regardless of your location, we provide the following rights in alignment with GDPR, CCPA, and other data-protection frameworks:

• Right of access: Request a copy of all personal data we hold about you.
• Right to rectification: Correct inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your account and all associated data.
• Right to data portability: Export your data (episodes, reflections, snips, analytics) in a machine-readable format.
• Right to restrict processing: Limit how we process your data in certain circumstances.
• Right to object: Opt out of specific data processing activities.
• Right to withdraw consent: Revoke consent at any time where processing is based on consent.

To exercise any of these rights, email us at info@alstonanalytics.com. We will respond within 30 days. You may also delete individual episodes, journal entries, and snips directly from your account at any time.

14. Data Retention

• Active accounts: We retain your data for as long as your account is active and you use the Service.
• Account deletion: Upon account deletion, we remove your personal data, custom episodes, journal entries, snips, and learning analytics within 30 days. Anonymized, aggregate analytics may be retained for product improvement.
• Legal requirements: We may retain certain records where required by law (e.g., billing records for tax compliance).
• Audio files: Audio files for deleted custom episodes are purged from blob storage during the deletion process.

15. Data Sharing

We share your data only in the following limited circumstances:

• Infrastructure providers: Companies that host and operate the Service (Vercel, Prisma, cloud providers) in their capacity as data processors.
• AI providers: Topic/prompt text only (no personal data) for content generation.
• Payment processor: Stripe, for subscription management and billing.
• Legal compliance: When required by law, subpoena, or court order, or to protect the safety and rights of our users.

We do not sell your personal data. We do not share your data with advertisers. We do not engage in data brokering.

16. International Data Transfers

Your data may be processed in the United States or in other jurisdictions where our service providers operate. When data is transferred outside of your jurisdiction, we ensure appropriate safeguards are in place, including standard contractual clauses where applicable.

17. Children's Privacy

MindCast is not intended for users under 13 years of age (or 16 in jurisdictions where that threshold applies). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at info@alstonanalytics.com and we will promptly delete the data.

18. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or an in-app notification and update the “Last updated” date above. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

19. Contact Us

For any privacy-related questions, data requests, or concerns, please contact us:

Alston Analytics (d/b/a MindCast)
Email: info@alstonanalytics.com