Privacy Policy

Last updated: August 2026

1. Who we are

Mintlane is an independent mobile app studio based in Germany, operated by Stefan Hirche. We build focused mobile applications for Android and iOS. This privacy policy applies to the website at mintlane.io and all Mintlane mobile applications, including Medifix and Noralia.

2. Our approach to data

Mintlane apps are designed to run standalone — without accounts, without servers, and without your data leaving your device unless you explicitly choose otherwise. This is a core architectural decision, not a policy afterthought.

We do not build user profiles. We do not sell data. We do not serve tracking-based advertising.

3. This website

The mintlane.io website counts how often each page is opened and how often the links on it are used — for example how many people go on to Google Play or the App Store. We run this ourselves on our own hosting. There is no Google Analytics, no third-party script, and no advertising network involved.

It is built so that it cannot identify you, and that is a property of the database rather than a promise about our intentions. We store only daily totals: a row records that a page was opened 47 times on a given date, not who opened it. There is no record of an individual visit anywhere in the system, so there is no profile to build, no history to hand over, and nothing to link back to you.

Specifically, we do not use cookies, do not store an identifier in your browser, and do not record your IP address, your device model, your screen size, or which pages you personally viewed in what order. Because nothing is stored on or read from your device, this site needs no cookie banner.

The daily totals we keep are: how many pages were opened and by roughly how many distinct browsers; which page each view and click belonged to; which website referred the visit (the domain only, never the full address); the country, derived from your browser's time zone setting rather than from your IP address; whether the device was a phone or a desktop computer; the hour of day; and any campaign tag present in the link you followed.

To tell a returning browser from a new one within a single day, we compute a one-way fingerprint from your IP address and browser version using a secret that is regenerated every night and never reused. Your IP address itself is never written to the database, and yesterday's value cannot be recalculated or matched against today's — so this cannot be used to follow anyone from one day to the next. These working values are deleted automatically after 48 hours.

If your browser sends a Do Not Track or Global Privacy Control signal, nothing is counted at all. The dark/light mode preference is stored locally in your browser only.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest — understanding which parts of a small independent site are worth maintaining, using the least data that can answer the question).

4. Medifix

Medifix stores all medication and intake data locally on your device using an AES-256 encrypted on-device database. By default, no medication data is transmitted to Mintlane or any third party — the only exception is the optional Caregiver-Sharing feature described in section 4.3 below, which you must explicitly set up.

4.1 Drug interaction lookups

When you search for a medication, Medifix may query the publicly operated FDA OpenData API (api.fda.gov) for drug interaction information. The query contains only the medication name — no personal information, no device identifiers, and no account data. The FDA API is operated by the US Food and Drug Administration and is subject to its own terms of service. You can disable interaction lookups at any time in Settings.

4.2 Crash reports (optional)

Medifix includes crash reporting powered by Google Firebase Crashlytics. This feature is off by default and is only enabled if you explicitly consent during onboarding or in Settings → Privacy → Crash reports.

When enabled, crash reports contain: a stack trace, the app version, the device manufacturer, the operating system version, and a random Crashlytics installation ID. They do not contain any medication names, intake times, or other health data.

Legal basis: Art. 6(1)(a) GDPR (consent). Data processor: Google LLC, USA (adequacy via EU Standard Contractual Clauses). You can withdraw consent at any time in Settings.

4.3 Caregiver-Sharing (optional)

Medifix offers an optional feature that lets you invite a family member or other caregiver to see a real-time summary of your medication status. This feature is off by default and only activates if you generate an invitation link and someone accepts it.

When in use, both the patient's and the caregiver's devices sign in anonymously to Firebase Authentication — this creates a random, device-bound identifier with no email address, password, or real-world identity attached. A snapshot of the medication status is encrypted on-device before being written to Firebase Realtime Database, purely to relay it between the two paired devices; the encryption key is generated locally and never leaves either device, so Mintlane and Google cannot read its contents. Access to that data is restricted to the two paired devices' anonymous identifiers. Push notifications (e.g. a missed-dose alert to the caregiver) are delivered via a server-side Cloud Function and Firebase Cloud Messaging, encrypted with that same locally-generated key — Cloud Functions and FCM relay the encrypted content without being able to read it.

The invitation link does not require or collect the caregiver's email address or any contact information — pairing happens via a one-time link, not an account lookup. You can revoke a caregiver's access at any time in Settings, which immediately removes their access to your data.

Data processor: Google LLC, USA (adequacy via EU Standard Contractual Clauses).

4.4 In-app purchases

Medifix offers an optional Premium upgrade and an optional Caregiver-Sharing subscription. Purchases are processed entirely by Apple (App Store) or Google (Google Play). Mintlane receives only a confirmation of whether a valid purchase exists — no payment details, no card numbers, and no billing address are ever transmitted to Mintlane.

4.5 Device permissions

Medifix requests the following device permissions:

• Notifications — to deliver medication reminders
• Battery optimisation exemption (Android) — to ensure reminders are not suppressed by the operating system
• Camera and photo library (optional) — to attach a photo to a medication entry
• Biometric authentication (optional) — for app lock via Face ID or fingerprint

None of these permissions are used to collect or transmit personal data.

4.6 Your data — export and deletion

You can export all your Medifix data at any time in Settings → Privacy → Export data. The export is a local file — it is not sent to Mintlane.

You can permanently delete all Medifix data in Settings → Privacy → Delete all data. This action is irreversible and removes everything from your device immediately.

5. Noralia

Noralia stores cycle data, period logs, symptoms, mood entries, notes, reminders, app settings, and app-lock data locally on your device. Noralia does not require an account and does not transmit your health data to Mintlane.

5.1 Local encrypted storage

Noralia uses a SQLCipher-encrypted on-device database. PIN credentials are not stored in plain text. JSON exports and PDF reports are created only when you choose to generate or share them from inside the app; they are not automatically sent to Mintlane.

5.2 Crash reports (optional)

Noralia includes crash reporting powered by Google Firebase Crashlytics. This feature is off by default. If enabled, crash reports may include technical diagnostics such as stack traces, app version, device model, operating system version, and a random Crashlytics installation ID. They do not intentionally contain cycle data, symptoms, notes, PIN data, or other health entries.

Legal basis: Art. 6(1)(a) GDPR (consent). Data processor: Google LLC, USA (adequacy via EU Standard Contractual Clauses).

5.3 Remote configuration

Noralia uses Google Firebase Remote Config to determine current Premium pricing and display an occasional promotional banner on the Premium screen. Unlike crash reporting, this runs automatically every time you open the app and is not something you opt into. It sends an anonymous, random installation identifier to Google's servers — no cycle data, symptoms, notes, name, or any other content you've entered is included.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest — necessary to show accurate, current pricing). Data processor: Google LLC, USA (adequacy via EU Standard Contractual Clauses).

5.4 In-app purchases

Noralia offers an optional one-time Premium upgrade. Purchases are processed by Apple (App Store) or Google (Google Play). Mintlane receives only a purchase-validity signal; we do not receive payment card details, billing addresses, or store account credentials.

5.5 Device permissions

Noralia may request the following permissions:

• Notifications — to deliver reminders you set up
• Biometric authentication (optional) — to unlock app lock via Face ID, fingerprint, or the platform equivalent

Noralia receives only the result of a biometric check from the operating system, not raw biometric data.

5.6 Your data — export and deletion

You can export Noralia data locally in Settings. You can also delete all local Noralia data from the app. Because the core health data stays on your device, Mintlane usually cannot access, correct, restore, or delete it for you.

5.7 Health data sync (Premium, optional)

Premium subscribers can optionally connect Apple Health or Android Health Connect to view their sleep and activity data alongside their cycle in the app, from Settings. This is read-only — Noralia never writes data back to Health or Health Connect — and entirely on-device: the data is cached in the same encrypted local database as your other Noralia data and is never transmitted to Mintlane or any other party.

6. Contact data

If you email us at hello@mintlane.io, we will use your email address and message content solely to respond to your enquiry. We do not add you to any mailing list and we do not share your contact details with third parties.

7. Your rights (GDPR)

If you are located in the European Union, you have the following rights regarding any personal data we may hold:

• Right of access (Art. 15 GDPR) — you can ask what data we hold about you
• Right to rectification (Art. 16 GDPR) — you can ask us to correct inaccurate data
• Right to erasure (Art. 17 GDPR) — you can ask us to delete your data
• Right to restriction (Art. 18 GDPR) — you can ask us to limit how we use your data
• Right to object (Art. 21 GDPR) — you can object to processing based on legitimate interests
• Right to data portability (Art. 20 GDPR) — you can ask for your data in a portable format; for in-app data use Settings → Export data

To exercise any of these rights, contact us at privacy@mintlane.io. Given the minimal data we collect, most requests can be fulfilled within a few days.

8. Data retention

We retain email correspondence for up to 24 months for support continuity, after which it is deleted. The website's daily totals described in section 3 are kept indefinitely, because they contain no personal data and are only useful when compared across years; the 48-hour working values described in the same section are deleted automatically. Crashlytics data is retained by Google for 90 days. If you use Caregiver-Sharing, the encrypted status snapshot and the anonymous device identifiers described in section 4.3 are retained in Firebase only for as long as the caregiver connection stays active, and are deleted immediately when you revoke it. We hold no other personal data on our own servers.

9. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date at the top of this page. We do not send unsolicited emails to notify you of changes.

10. Contact

Questions about privacy? Write to us at privacy@mintlane.io. We read and respond to every message.