Privacy Policy

1. Who we are

Mentl is a web application for career skill-building, cognitive games, and professional assessments. References to "Mentl," "we," "us," or "our" in this policy refer to the operator of this service. If you have questions or requests, contact us at mentllteam@gmail.com.

2. What we collect

We collect only what is necessary to operate the service:

• Email address — required to create an account and to receive your one-time sign-in code.
• Username — a unique pseudonym you choose during account setup. This is your public identity on leaderboards, and other signed-in users can find you by searching your username in the friends feature.
• Avatar URL — an optional profile picture URL. It appears on your profile card, which other signed-in users can see in friend search, friend lists, and leaderboards.
• Display name — an optional name (up to 50 characters) you can set on your profile, separate from your username. It appears on your profile card and may be visible to other signed-in users in friend search and friend lists. If you are a member of a recruiter organization on Mentl, your display name may also be visible to the administrators of that organization.
• Friends and social data — if you use the friends feature, we store the friend requests you send and receive and your accepted friendships. Your profile card — username, display name, avatar, XP, activity streak, and rank title — is visible to signed-in users who search for your username or are your friends, and your friends can see your scores on friends-scoped leaderboards.
• Game sessions — one record per game played, including game type, score, timestamp, and game settings used.
• Skill progress — your completion status, best score, and attempt count for each skill module you engage with. This data is private and never shown publicly.
• Daily Mentl prompt responses — when you submit a response to the Daily Mentl challenge, your written response is stored permanently as part of your activity history and sent to an AI provider (see Section 5) to score it.
• AI skill generation inputs — if you use the AI-powered custom skill feature, the prompt text or source material you submit is sent to a third-party AI provider to generate the skill (see Section 5). A hash and short preview of your input are retained for moderation; the full text is not stored permanently.
• Professional role, primary goal, and education level — optional, chosen during account setup or from your profile settings. Never shared publicly.
• News feed preferences — optional categories and custom topics you select to personalize your news feed on your dashboard. This data is private and is never shared with third parties.
• Account plan type — your current plan tier (Free or Pro). Pro subscriptions, For Teams assessment credit purchases, and per-seat Training subscriptions are processed through Stripe (see Section 5).
• Assessment invitations and results — if a recruiter sends you an assessment, we store your email address as the invitation target, your acceptance or decline, and your scores. For aptitude assessments, your per-question answer selections are stored server-side for scoring and are visible to the recruiter who invited you. You can see your pending assessments from your profile page.
• Error reports — if a client-side error occurs, a report containing the error message, page URL, and stack trace may be logged. These logs are readable only by admins and are used solely to diagnose and fix platform issues.

We do not collect payment card details (handled by Stripe directly), location data, device fingerprints, or any health or biometric data.

3. How we use your data

• To authenticate you and maintain your session via one-time email codes.
• To record and display your game scores on your personal dashboard.
• To display your username and best scores on the public leaderboard (only sessions played with default settings count toward rankings).
• To operate the friends feature — matching username searches, delivering friend requests, and showing friends-scoped leaderboards to you and your friends.
• To process payments and manage subscriptions through Stripe — Pro subscriptions, For Teams assessment credits, and Training seats.
• To track and display your learning progress across skill modules.
• To enforce daily play limits for the Daily Mentl challenge.
• To generate AI-powered custom skills from content you submit (if you have access to this feature).
• To evaluate and score your Daily Mentl prompt responses, prompt engineering challenge submissions, and creative thinking challenge responses using AI, and return scored feedback to you. For recruiter-sent assessments, scores are also shared with the recruiting organization that invited you.
• To send transactional emails (sign-in codes and assessment invitations) via our email delivery provider.
• To understand how the platform is used and improve it — aggregated and anonymized only. Individual role, goal, and education data is never shared with or sold to third parties.

We do not use your data for advertising, behavioral profiling, or sale to third parties.

4. Lawful basis (GDPR)

If you are located in the European Economic Area or United Kingdom, our lawful bases for processing your personal data are:

• Performance of a contract — processing your account data, game sessions, skill progress, and billing and subscription data for any paid plan (Pro, Training, or For Teams assessment credits) is necessary to provide the service you signed up for. This also covers AI skill generation when you choose to use that feature.
• Legitimate interests — displaying your username and best score on a public leaderboard is a core feature of the service that users reasonably expect when they play.

5. Third-party services

We use the following third-party services to operate Mentl. Each acts as a data processor on our behalf and is bound by their own privacy and security commitments:

• Supabase — hosts our database and authentication system. Your account data, game sessions, skill progress, and assessment records are stored on Supabase infrastructure.
• Google— if you choose to sign in with Google, Google provides authentication and shares your email address and basic profile information with us to create or authenticate your Mentl account. This applies only if you use Google sign-in and is governed by Google's Privacy Policy.
• Resend — our email delivery provider. Your email address is shared with Resend solely to deliver sign-in codes and, if applicable, assessment invitation emails. Resend does not use this data for any other purpose.
• Stripe — payment processing for individual Pro subscriptions, For Teams assessment credit purchases, and per-seat Training subscriptions. When you or your organization make a purchase, your email address and account ID (and, for organizations, the company name) are shared with Stripe to process the transaction and manage the subscription. Stripe handles payment card data directly under their own privacy policy — we never see or store your card details.
• Vercel Analytics — collects aggregated, session-level usage data (page views and navigation events) to help us understand platform usage. No personally identifiable information is associated with these events.
• Vercel AI Gateway / Anthropic— used for AI-powered custom skill generation and Daily Mentl prompt scoring. Content you submit for these features is sent to an AI language model via Vercel's AI Gateway. This data is not used to train AI models and is not retained by the provider beyond the scope of processing your request, per their terms.
• AI grading providers (Gemini, Groq, Mistral, OpenRouter, and OpenAI models via GitHub Models) — when you submit a response to a prompt engineering challenge or a creative thinking challenge, your submission text is sent to one of these AI providers to evaluate and score it. The specific provider used is determined automatically based on availability. These providers do not use submitted content to train their models and do not retain it beyond the scope of processing your request, per their respective terms. No personally identifiable information beyond the submission text itself is included in grading requests.
• Gravatar — we compute a one-way hash of your email address and include it in a request to gravatar.com to check whether you have a Gravatar profile picture. If you do, it is displayed on your Mentl profile page. No Gravatar account is required on your part.

We use no advertising networks or tracking pixels.

6. Cookies and local storage

We set only strictly necessary cookies: a single HTTP-only session cookie issued by Supabase to keep you signed in. We do not use tracking, advertising, or analytics cookies. Because our cookies are essential to the service, no cookie consent banner is required.

We also use your browser's local storage for on-device state such as game settings, in-progress game and assessment attempts, and your theme preference. This data stays in your browser and is not used to track you.

7. Data retention

Your account data, game sessions, and skill progress are retained for as long as your account is active. If you delete your account (or request deletion — see section 8), all associated data is permanently removed from our systems.

Stripe billing records for purchases and subscriptions are retained per Stripe's own retention requirements, which may extend beyond account deletion to meet financial record-keeping obligations (typically up to 7 years). Skill generation job records (prompt hash and preview) are removed when the generated skill or your account is deleted.

8. Your rights

Depending on where you live, you may have the following rights:

• Access & portability — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data (e.g. your display name).
• Erasure — request deletion of your account and all associated data.
• Objection — object to processing based on legitimate interests (e.g. leaderboard display).
• California residents (CCPA) — right to know what data we collect, request deletion, and not be discriminated against for exercising these rights.

To exercise any of these rights, email us at mentllteam@gmail.com. We will respond within 30 days.

9. Children

Mentl is not directed at children under 13. We do not knowingly collect personal data from children under 13. If we become aware that an account belongs to a child under 13, we will delete it and all associated data promptly.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via the app or by email. The effective date at the top of this page reflects when the policy was last updated. Continued use of Mentl after a change constitutes acceptance of the updated policy.

11. Contact

Questions or privacy requests: mentllteam@gmail.com