Mental is a private mood journal. The short version: your journal lives on your device and your own iCloud — we can't read it. There's no account to create, we never sell your data, and we don't track you across other apps or websites. The detail is below.
Prefer a shorter overview? Read the plain-language map of Mental’s data flows.
What we collect, and where it lives
As you use Mental, the app stores: your check-ins (the mood you log, any note you write, and your tags), the name you enter during setup, and — only if you choose to add them — your sex and year of birth. If you use them, it also stores your memories, daily wrap-ups, and Wager predictions. If you used Mirror before version 2.3, your chapters, reflections, and prompt answers are kept and stay readable in the Mirror archive; Mirror no longer creates new chapters.
All of this is kept on your device and synced through your own private iCloud (Apple's CloudKit), tied to your Apple ID — we keep no copy of your journal and have no way to read it. Mental has no login and no account. Ask Mental conversations are the exception: they stay on your device, without iCloud sync. The optional AI relay described below temporarily processes only the data you choose to send for an AI request; it does not keep a lasting copy of your journal.
Analytics
To understand how the app is used and to fix problems, we use PostHog for product analytics. It records anonymous usage events — for example, that a check-in started, a streak milestone was reached, or a screen was opened — tied to a random identifier, not to your identity.
Analytics never include the text of your notes, your name (only the length of the name you entered is recorded), your mood content, or your sex or year of birth. Analytics are on by default; you can turn them off at any time in Settings.
Website campaign measurement
We use Cloudflare to count website page views and clicks on Mental’s App Store links in aggregate. The existing counter records its type, an allowed page path, a broad source category (such as a Google referral or TikTok), and an App Store campaign group. These counts are not unique people or proof of installations. This Cloudflare dataset contains no visitor ID, IP address, journal content, selected feeling, full page URL, or search query. The free check-in tool keeps your words in the open page and generates its text download on your device.
Additional aggregate measurements include visits within a browser tab, entry pages and internal page transitions, visible active time, reaching 75% of the main content, tool interactions, completed worksheet results and downloads, browser family and device category, page-load performance, and error categories. We do not send field values, selected feelings, downloaded text, filenames, error messages or stack traces. A random visit marker and a small set of visit flags stay only in your tab's session storage and expire after 30 minutes without activity; the marker itself is never sent to our server. These measurements do not recognise you on a later day or another device. Duplicated tabs can share a visit; if session storage is blocked, we do not try to identify a visit another way.
To preserve a source category and keep App Store links attributed while you move between pages, your browser tab temporarily keeps category and campaign markers for 30 minutes from the first incoming visit. This uses session storage, not a cookie or a third-party tracking pixel. The browser event collector respects Do Not Track and Global Privacy Control. Cloudflare still handles network requests under its own service policies. Apple separately reports eligible App Store campaign activity in aggregate; we cannot use these reports to identify an individual visitor or match a website visit to a particular download.
Detailed website analytics
To learn which pages help, where a page is confusing and how fast it loads, the website also uses PostHog, in a project separate from the app. It records page views, clicks and taps, scrolling, time on a page, page-load performance, taps on App Store links, and that a tool was used or produced a result. It also makes session recordings: a replay of the page layout with your pointer, scrolling and clicks.
What you type and choose stays in your browser. Every text field is masked before anything is sent. The tools where you pick a feeling, search for a word, choose a prompt or write a note appear in recordings as blank boxes. Recording pauses while your pointer or keyboard is inside a tool and stops for the rest of that page once you use one, and clicks inside tools are left out of click maps. We do not send the feeling you select, what you type or search for, downloaded text, the search words that brought you here, or parts of the page address other than campaign tags.
A random identifier is kept in your tab's session storage, not in a cookie or local storage, and sent with these events so that the pages of one visit stay together. It is gone when you close the tab: we cannot recognise you on a later day or another device, we create no profile, and we never try to identify you. PostHog receives your IP address with each request and is set to discard it. It also receives your browser's user-agent string (browser, operating system and their versions, used to tell people from bots), screen size, language and time zone. PostHog, Inc. processes this data in the United States under its own privacy terms. Recordings are deleted after 30 days and events after one year.
If your browser sends Do Not Track or Global Privacy Control, none of this loads. Blocking PostHog with a content blocker works too, and the site works the same either way.
Turning website measurement off
Do Not Track or Global Privacy Control turns off both website measurements described above: the Cloudflare counter and PostHog. Automated browsers, including the ones we use to check the site, are not measured either.
You can also turn measurement off in this browser without changing its settings: turn measurement off or turn it back on. This keeps one setting in your browser's local storage, the only thing the site stores there, and sends nothing. If your browser blocks storage, the setting covers only the page you open.
Apple Health (optional)
If you connect Apple Health, Mental can save your check-ins to Health as State of Mind, and read your sleep, steps, time in daylight, workouts, and any moods you've logged in other apps to show context in your journal. This stays on your device and is governed by Apple's Health permissions. Your exact Health values never leave your device, and Health data is never included in analytics. One opt-in exception: if you separately turn on “Include Health context” in AI features (off by default), Mental sends only coarse ranges — broad sleep, steps, daylight, and workout buckets, never exact figures — through Mental's Cloudflare relay to DeepInfra, the AI provider, so AI features such as daily wrap-ups can take your rhythms into account. Ask Mental requests never include it. This data carries no name or account identifier and is handled as part of the temporary AI request processing described below. You can revoke Health access, or that AI opt-in, at any time.
Voice input
You can speak a note or an Ask Mental message instead of typing it. Your iPhone turns speech into text on the device, and Mental keeps the text, not the audio. If your iPhone can't transcribe your language on its own, Mental asks first: with “Transcribe with Apple” on (off by default), audio is sent to Apple to be turned into text while the microphone is on. Microphone access is managed in iOS Settings.
AI features (optional)
Mental's AI features are daily wrap-ups, automatic tags, Memory, Ask Mental, and suggested actions. They are generated using DeepInfra, a third-party AI service. Before an AI feature sends data for the first time, the app identifies DeepInfra and Mental's Cloudflare relay, explains what will be sent, and asks for your permission. When a feature you turned on runs, the words you send to Ask Mental, relevant journal text and supporting check-in context (such as dates, moods, and tags) are sent through the Cloudflare relay to DeepInfra solely to generate that feature. The request does not include your profile name or an account identifier, but anything you write may be sent. If you separately enable Health context, the coarse Health ranges described above may also be included.
For AI work that runs in the background, the Cloudflare relay temporarily keeps an encrypted request payload in Cloudflare Queue and temporary job status, result, and limited metadata in Cloudflare KV. This data expires within 24 hours. Ask Mental replies are sent straight back to your device and are not stored on the relay. DeepInfra processes each request under its own privacy and data-handling terms. Reflective prompts that run on your device send nothing.
AI features are off until you turn them on, require Mental Pro (the first week of daily wrap-ups is free), and aren't available in every region. In You → AI features you choose which features run, and “Use AI” turns them all off. Turning AI or a feature off stops new requests; your check-ins, existing AI results, and feature choices stay saved, and work already submitted cannot be recalled.
Ask Mental
Ask Mental is a conversation, by voice or text, about a situation, a decision, or a disagreement. It is one of the AI features above. Each time you send a message, Mental sends the recent messages of that conversation through the Cloudflare relay to DeepInfra. If Memory is on, your device also picks up to eight items that share words with your latest message — check-in notes with their moods, saved memories, and suggested actions with any results you reported — and sends them along. With Memory off, no journal content is added. When a conversation reaches a conclusion, Mental offers to keep it as a keepsake, written from the same conversation. If you choose Save a check-in, Mental drafts an optional note from your own messages; you pick the mood, can edit the note, and decide whether to save it.
Your conversations and keepsakes are stored only on your device, not in iCloud sync, and are included in your device's backups. If Memory is on, the words you send that Mental uses for memories, with the question they answered, sync through your private iCloud along with your memories. You can delete a conversation, which also removes memories built from it, turn Ask Mental off in AI features, or delete your history as described below.
Purchases
If Mental offers a paid subscription and you buy one, the payment is handled entirely by Apple — we never see your card details. Subscription status is managed through RevenueCat, tied to an anonymous identifier, not to your name or identity.
What we don't collect
Mental does not collect your email, password, phone number, postal address, payment card numbers, precise location, contacts, or photos. We use no advertising identifiers and do not track you across other apps or websites.
Your control
From within the app you can export your check-ins as a file, and delete your history at any time: check-ins, memories, daily wrap-ups, predictions, the Mirror archive, and Ask Mental conversations. Deleting on your device removes them from your iCloud sync too. Your tags and profile are kept.
Children
Mental is not directed at children under 13, and we do not knowingly collect information from them.
Changes
We may update this policy as the app evolves; the date at the top reflects the latest version.
About Mental
Return to the Mental mood tracker overview, or read about Mental's product purpose and editorial approach.
Contact
Questions? hello@getmental.app.