Skip to content
2Mynds Log in Book

Privacy Policy

Last updated

Privacy Policy of 2MYNDS

This Application collects some Personal Data from its Users. This document contains a section dedicated to Californian consumers and their privacy rights. This document can be printed for reference by using the print command in the settings of any browser.

Revised 2 November 2026. For a participant under 18, the coaching pathway agreement now asks for the parent or guardian’s phone number as well as their email, so they can be included in the participant’s coaching messages. It is listed under “The coaching pathways: THRIVE and GRIT”.

Revised 27 October 2026. The contact form gained a spam check, Cloudflare Turnstile, after automated submissions began arriving through it. It is the third thing this website loads from another company and the first new one since the rebuild, so the count below changes from two to three and the service is described in full under “Protection from SPAM”.

Revised 22 October 2026. Three corrections, found by watching what the site actually requests in a browser rather than by reading its source: the number of pages carrying an audio narration was given as fifteen and is nineteen, five of which are not articles; the note about googletagmanager.com below named only one of the two Google domains a visitor actually sees; and the audio narration is now described as what it is — fetched only if you press play, not as the page opens.

Revised 21 September 2026. The typefaces moved off Google Fonts and onto this website’s own domain, removing a third-party request that happened on every page; the Google Fonts entry below records what it used to do. The note about googletagmanager.com is new, because the domain name says “tag manager” and this site does not run one — a true sentence that looked false to anyone checking.

Revised 15 September 2026. The website at www.2mynds.com was rebuilt, and this policy is brought in line with both it and the Flow 255 application.

Gone entirely, from both the website and the application: Font Awesome, OneSignal push notifications, and the HubSpot contact database. These were listed before and are not used.

Gone from the website, but still running in the Flow 255 application and now described there instead: Google Tag Manager — which today delivers Google Analytics and nothing else — and the jsDelivr content delivery network, which the previous version of this policy listed under “Advertising”. That was a miscategorisation: it delivers code libraries and nothing else.

Switched off in the application on 14 September 2026, rather than disclosed: the Meta (Facebook) pixel, Google Ads conversion tracking, Google Ads Remarketing with the DoubleClick cookie, the Google Ads conversion linker, and Plerdy, a behavior-analytics service that recorded how people moved through the application.

Plerdy was paired with a lookup to ipify, which fetched each visitor’s IP address and handed it to Plerdy as their identifier. None of these had ever appeared in any version of this policy. They were found on 13 September 2026, and removed the following day rather than written up — the Google Tag Manager container now carries Google Analytics and nothing else.

Newly named, because the previous version did not disclose them at all: FunnelKit, Stripe, Zoom and Microsoft Outlook, Wordfence and Cloudways on the application side; Cloudflare, Bunny.net and Amazon SES on the website side — and FunnelKit there too since 16 September 2026, for newsletter signups. Google Analytics remains on both, loaded directly on the website and through Tag Manager in the application.

Newly written: “Children and young people”. Young athletes use the application, including through their schools, and no previous version of this policy said anything about them. That section now sets out who may hold an account, how a child under 13 uses a parent’s, what a school is responsible for, and how a parent asks what is held about their child or has it deleted.

This policy covers two things, and they collect very different amounts of data:

  • This website, www.2mynds.com — the public marketing pages. Described in full below.
  • The Flow 255® application at flow255.2mynds.com — the subscription product and its store. It has its own Terms and Conditions, but it does not have a separate privacy policy: it links here. Its processing is described under “The Flow 255 application” below.

Where a section does not say which of the two it means, it applies to both. The website itself runs one analytics tag and a contact form, and that is the whole of it; the application, being a product with accounts and a store, collects considerably more.

2Mynds does not sell your personal information, and does not share it for advertising. 2Mynds is paid by its customers — for subscriptions, and for the THRIVE and GRIT coaching and training packages. It is not paid by anyone for information about the people who use this website or the application, and it does not pass personal information to data brokers, advertisers or mailing-list companies. The services named in this policy receive personal information only in order to perform a service for 2Mynds.

Policy Summary

Personal Data processed for the following purposes and using the following services:

Analytics

Google Analytics 4

Personal Data: Trackers; Usage Data

Contacting the User

Contact form

Personal Data: email address; first name; last name; the message you write; the page you wrote it from

Displaying content from external platforms

YouTube (Google LLC) — the TEDx talk on the homepage only, and only if you press play

Personal Data: Trackers; Usage Data

Hosting and content delivery

Cloudflare Pages; Bunny.net; Amazon Simple Email Service; Supabase (signed participant waivers only)

Personal Data: Usage Data; and, for the contact form only, email address; first name; last name; the content of the message

Protection from SPAM

Cloudflare Turnstile (Cloudflare, Inc.) — the contact page and the co-branded school pages only

Personal Data: Usage Data

Coaching by message

WhatsApp (Meta Platforms, Inc.) — text-based mentoring, for people on a coaching pathway only

Personal Data: phone number; first name; last name; the content of coaching messages

The Flow 255 application

FunnelKit — email broadcasts and automations

Stripe — payment

Google Tag Manager; Google Analytics

Bunny.net; YouTube — video

Zoom; Microsoft Outlook — booking and calendar

Cloudways — hosting

Personal Data: account and subscription details; email address; Trackers; Usage Data

Neither the website nor the application carries advertising or remarketing. On 14 September 2026 the Meta pixel, Google Ads conversion tracking, Google Ads Remarketing, the Google Ads conversion linker and the Plerdy behavior-analytics service were all switched off in the application. Google Analytics is what remains.

What this website does not do

The rest of this section is about www.2mynds.com only. The application is a product with accounts, a store and email automation, and it necessarily collects more; see “The Flow 255 application” further down.

This website carries no advertising, no advertising trackers and no remarketing. It does not run a tag manager, a social media pixel, a heatmap or session-recording tool, or a push notification service. Since 14 September 2026 the Flow 255 application carries none of those either — see the note in its section above.

It loads three things from other companies. The Google Analytics script, on every page. On the nineteen pages that carry an audio narration, the audio file itself from Bunny.net — and that one is only fetched if you press play; until you do, nothing is requested from Bunny.net at all. And on the pages that carry a form — the contact page and the co-branded school pages — the Cloudflare Turnstile spam check described below, which loads as the page does. Nothing else on any page is fetched from a third party.

It used to be three. Until 21 September 2026 the typefaces came from Google Fonts, which meant your IP address and browser reached Google on every page whether or not you did anything. They are now served from this website, so that request no longer happens. Nothing about how the site looks changed.

One thing here is easy to misread, so it is worth stating plainly. The Google Analytics script is served from a domain called googletagmanager.com. That is simply where Google hosts the file; this site does not run Google Tag Manager, has no tag container, and loads no tags through one. If you are watching your browser’s network tab you will see two Google domains: googletagmanager.com, which is where the script itself comes from, and www.google-analytics.com, which is where Google Analytics sends what it measures. Both are the one thing described above doing its job, and that is all they are.

One page carries a video — the homepage, which has Leon’s TEDx talk — and it is not a third thing. It does not load with the page. What you see is a still image served from this website, with a play button on it; nothing is requested from Google, and Google is not told you opened the page, unless you press it. If you do, the talk opens through youtube-nocookie.com and YouTube then receives your IP address, your browser and which page the video sits on, and sets its cookies in the ordinary way. That choice is yours to make, and not making it costs you nothing — with JavaScript switched off the play button is simply a link to YouTube, and nothing is sent until you follow it.

Cookies. Two are set, both by Google Analytics and both first-party — _ga and _ga_V2CLHEPCD9. They distinguish one visitor from another so that visits can be counted; they carry no name, no email address and nothing you typed. There are no other cookies unless you press play on one of the videos described above. The spam check on the form pages adds none: it was measured on 27 October 2026 and set no cookie and stored nothing in the browser, which matches Cloudflare’s own statement that Turnstile does not use cookies to track visitors.

Full Policy

Owner and Data Controller

2Mynds, Inc.
20289 Stevens Creek Blvd #1006
Cupertino, CA 95014
United States
Owner contact email: [email protected]

Types of Data collected

Among the types of Personal Data collected, by itself or through third parties, there are: Trackers; Usage Data; first name; last name; email address; and, in the Flow 255 application only, account, order and subscription details and the billing information needed to take payment.

On this website, nothing else is asked for — with one exception, the participant waiver, which is signed before taking part in an in-person activity and asks for more. What it asks for, and why, is set out under “In-person activities and the participant waiver” and “The coaching pathways” below.

The contact form has five fields — first name, last name, email address, the type of inquiry, and your message — and records which page you sent it from. It does not ask for your phone number, your address, your date of birth, your gender, your employer or your profession, and this Application does not collect your precise location or any device advertising identifier.

Children and young people

Young athletes use the Flow 255 application, including through their schools and clubs, so this section sets out how that works. It follows the Terms and Conditions, which govern who may use the Service — if the two ever disagree, the Terms and Conditions are the document that decides.

You must be 13 or over to register your own account.

Under 13. A child under 13 may use the Service, but only where a parent has purchased it and supervises its use. They do not hold an account of their own: the account belongs to the adult, and so does responsibility for how it is used.

13 to 17. A young person aged 13 to 17 may hold their own account, but may only purchase the Service under parental or adult supervision or agreement.

Through a school, club or other organization. Where someone under 18 uses the Service as part of an organization, that organization is responsible for having obtained a parent’s or guardian’s agreement to the Terms and Conditions on their behalf.

Nothing extra is collected because a user is young. In the application, a young person’s account holds what any account holds — name, email address, subscription details, and their activity in the application. No additional information is requested on account of age, and no special category of data is collected about them there. In-person activities are different, and are described next. 2Mynds does not collect biometric data from anyone.

In-person activities and the participant waiver

2Mynds runs physical and mental training in person, some of it at the venues where athletes compete. Before anyone takes part, a participant waiver is signed online. It is the one place where 2Mynds asks for information about health, and it is completed by a parent or guardian whenever the participant is under 18.

What the waiver asks for, and why:

Why it is asked
The participant’s name and date of birthTo know who is taking part, and to confirm whether a parent or guardian must sign
Whether the participant has any medical condition, injury, allergy or limitation, and a description if soSo that coaches can keep the participant safe during the activity
An emergency contact — name, relationship and phone numberSo that someone can be reached if the participant is hurt or unwell
Whether photos or video of the participant may be usedTo record the choice — see below
Whether to send a birthday messageTo record the choice — see below
The name, email address and signature of whoever signs, and the dateBecause a waiver has to show who agreed to it, and when

Two things are recorded that nobody is asked for. When a waiver is signed, the browser used and the internet address it was sent from are stored alongside it, and kept for as long as the waiver is kept. They are there for one reason: a signature is only evidence if there is also something to show that it was made. They are not used for analytics, they are not used to work out where anyone is, and they are not shared.

A child does not fill it in. For a participant under 18, the parent or guardian completes and signs the waiver. For these in-person waivers the participant’s own email address is asked for only when they are 18 or over. The coaching pathways work differently, and are described next.

Health information is used for safety and nothing else. What the waiver records about a medical condition is used to keep the participant safe during activities. It is not used to infer anything about them, it is not used for marketing, and it is not shared beyond the people running the activity — 2Mynds, and the independent coach who delivers the session.

Independent coaches. Some 2Mynds sessions are delivered by coaches who run their own businesses. The coach delivering a session sees the waivers for the participants in it — including the medical and emergency-contact answers — because they are the person keeping those participants safe. They see the waivers for their own sessions, not anyone else’s.

Photos and video are used only with permission. If permission is given, the participant may be photographed or filmed during sessions, and those images may be used on 2Mynds’ website, its social media, and in its educational and promotional material. If it is not given, no identifiable image of the participant is used for promotion. Saying no does not affect taking part. Permission can be withdrawn at any time by writing to [email protected]; images already published will be removed where 2Mynds controls them.

A birthday message is sent only if asked for. The date of birth is collected because the waiver needs it. It is used for a birthday message only when the box asking for one is ticked, and that can be undone at any time.

A waiver run jointly with a partner is held by 2Mynds. Some activities are run together with a partner organization — Ultra Performance Academy, for example — and use a joint waiver that names both. Signed waivers are stored by 2Mynds. 2Mynds is emailed a copy of each waiver as it is signed, and currently forwards that email to the partner automatically, so the partner always has the latest waiver information — including the medical and emergency-contact answers it needs to run the activity safely. The partner is responsible for how it handles what it receives. This is not a sale: the partner receives it because it is running the activity too.

Where it is kept. Signed waivers are stored with Supabase, a database service, in its US West (North California) region. Like any hosted database it is reached over the internet, and it refuses outright any request that does not carry a secret key. That key is held only in this website’s hosting configuration and never leaves it; the key the website holds can add a waiver but cannot change or delete one. Only 2Mynds staff can read what is stored.

How long a signed waiver is kept. Until the time to bring a claim about the activity has run out: two years after the last activity it covers, for an adult; and for a participant under 18, two years after their eighteenth birthday, because that time does not start running until then. It is then deleted.

Everything a parent can ask for above applies here too — what is held, correcting it, deleting it — with one limit: a signed waiver is a record of an agreement, and deleting it while it may still be needed as evidence would defeat its purpose.

No advertising, and nothing sold. Neither the website nor the application carries advertising, advertising trackers or remarketing, and no advertising audience is built from anyone’s activity — a young person’s included. A young person’s personal information is not sold, and is not shared for advertising. See the note under “The Flow 255 application” above.

Activity that other members can see. The application includes leaderboards, which rank participating members against one another. Where a young person takes part, their name and standing can be visible to other members of the same group. This is a feature of how the application works rather than a disclosure to a third party, but parents and organizations should know it before enrolling someone.

What a parent or guardian can ask for. A parent or guardian may ask what personal information we hold about their child, ask for it to be corrected, or ask for it to be deleted, by writing to [email protected]. We will ask for enough information to be satisfied of the relationship before acting on the request.

If we hold something we should not. If you believe a child has given us personal information without the supervision the Terms and Conditions require, write to [email protected] and we will delete it.

The coaching pathways: THRIVE and GRIT

THRIVE and GRIT are coaching pathways rather than one-off sessions. They run mostly online — video coaching, text-based mentoring, periodic reports — with occasional in-person work. Everyone taking one signs a pathway agreement, which is a participant waiver and an engagement agreement in one document. Where the participant is under 18, a parent or guardian signs it.

It asks for everything the waiver above asks for, and five things more:

Why it is asked
Which pathway, and whether the participant is a junior, an adult athlete or an executiveBecause what is included differs between them, and the signed record has to show what was agreed
The participant’s own email address and phone numberSo a coach can reach the participant directly. This is asked whatever the participant’s age — coaching is delivered to them, not only to their parent — and for someone under 18 the parent or guardian provides it when they sign. For someone under 18 the phone number is optional
For a participant under 18: the parent or guardian’s phone numberSo the parent or guardian can be included in the participant’s coaching messages, which for someone under 18 are never private from them — see below
For a participant under 18: whether a coach may hold live online sessions without a parent or guardian presentTo record the answer. It is a required question with no default, and “no” is a complete answer
The signature, as drawn or typed, and the dateAs above — a signed agreement has to show who agreed and when

Coaching by message. Mentoring between sessions is delivered by text message, through WhatsApp. What is sent and received is coaching: training, preparation, how a session or a competition went.

  • For a participant under 18, nothing written is private from their parent or guardian. All text-based coaching messages are accessible to them. This is deliberate, and the agreement says so in the same words.
  • 2Mynds keeps its copy of written coaching messages for the same period as a signed waiver — two years after the last activity, or for a participant under 18, two years after their eighteenth birthday, whichever is later. They are then deleted. Participants and parents keep their own copies of their own conversations, which are theirs and not 2Mynds’ to delete.
  • Live coaching sessions are not recorded. 2Mynds does not record video or audio of a coaching session, and no transcript is made.
  • WhatsApp is operated by Meta, which carries the messages and applies its own terms and privacy policy to that carriage. 2Mynds does not control what Meta holds.

Permission for one-to-one live sessions, and taking it back. Where the participant is under 18, a parent or guardian is present on every live online session unless they have given written permission for one-to-one sessions. That permission is recorded on the signed agreement. It can be withdrawn at any time by writing to the coach in any form, and it takes effect immediately — it does not wait for anything to be signed. 2Mynds keeps that message for the same period as the signed agreement, because it is the record of the withdrawal.

Safeguarding records. A concern about a coach, a session, or anything else to do with a participant’s safety can be raised at safeguarding@2mynds.com, which is read by 2Mynds’ safeguarding lead and by a deputy who is not a coach. Where a concern is raised or an incident is recorded, 2Mynds keeps a note of it — what happened, when, who was involved and what was done — for the same period as a signed waiver. Those notes are read only by the safeguarding lead and the deputy, except where they must be passed to someone else to keep a person safe, or where the law requires it. Raising a concern never affects a participant’s place on a pathway.

Everything else in this section applies here too — health information used for safety and nothing else, photos and video only with permission, the birthday message only if asked for, where it is kept, and what a parent or guardian can ask for.

Complete details on each type of Personal Data collected are provided in the dedicated sections of this privacy policy or by specific explanation texts displayed prior to the Data collection.

Personal Data may be freely provided by the User, or, in case of Usage Data, collected automatically when using this Application.

Unless specified otherwise, all Data requested by this Application is mandatory and failure to provide this Data may make it impossible for this Application to provide its services. In cases where this Application specifically states that some Data is not mandatory, Users are free not to communicate this Data without consequences to the availability or the functioning of the Service.

Users who are uncertain about which Personal Data is mandatory are welcome to contact the Owner.

Any use of Cookies – or of other tracking tools – by this Application or by the owners of third-party services used by this Application serves the purpose of providing the Service required by the User, in addition to any other purposes described in the present document and in the Cookie Policy, if available.

Users are responsible for any third-party Personal Data obtained, published or shared through this Application and confirm that they have the third party’s consent to provide the Data to the Owner.

Mode and place of processing the Data

Methods of processing

The Owner takes appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data.The Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to the Owner, in some cases, the Data may be accessible to certain types of persons in charge, involved with the operation of this Application (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by the Owner. The updated list of these parties may be requested from the Owner at any time.

The Owner may process Personal Data relating to Users if one of the following applies:

  • Users have given their consent for one or more specific purposes. Note: Under some legislations the Owner may be allowed to process Personal Data until the User objects to such processing (“opt-out”), without having to rely on consent or any other of the following legal bases. This, however, does not apply, whenever the processing of Personal Data is subject to European data protection law;
  • provision of Data is necessary for the performance of an agreement with the User and/or for any pre-contractual obligations thereof;
  • processing is necessary for compliance with a legal obligation to which the Owner is subject;
  • processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Owner;
  • processing is necessary for the purposes of the legitimate interests pursued by the Owner or by a third party.

In any case, the Owner will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

Place

The Data is processed at the Owner’s operating offices and in any other places where the parties involved in the processing are located.

Depending on the User’s location, data transfers may involve transferring the User’s Data to a country other than their own. To find out more about the place of processing of such transferred Data, Users can check the section containing details about the processing of Personal Data.

Users are also entitled to learn about the legal basis of Data transfers to a country outside the European Union or to any international organization governed by public international law or set up by two or more countries, such as the UN, and about the security measures taken by the Owner to safeguard their Data.

If any such transfer takes place, Users can find out more by checking the relevant sections of this document or inquire with the Owner using the information provided in the contact section.

Retention time

Personal Data shall be processed and stored for as long as required by the purpose they have been collected for.

Therefore:

  • Personal Data collected for purposes related to the performance of a contract between the Owner and the User shall be retained until such contract has been fully performed.
  • Personal Data collected for the purposes of the Owner’s legitimate interests shall be retained as long as needed to fulfill such purposes. Users may find specific information regarding the legitimate interests pursued by the Owner within the relevant sections of this document or by contacting the Owner.

The Owner may be allowed to retain Personal Data for a longer period whenever the User has given consent to such processing, as long as such consent is not withdrawn. Furthermore, the Owner may be obliged to retain Personal Data for a longer period whenever required to do so for the performance of a legal obligation or upon order of an authority.

Once the retention period expires, Personal Data shall be deleted. Therefore, the right of access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after expiration of the retention period.

In practice, for the things this policy describes:

How long
Google Analytics event data14 months, then deleted by Google automatically. This is the maximum the service allows on a standard property.
Contact form messagesThese arrive as email in the Owner’s inbox. They are not deleted automatically, so they remain until deleted by hand. If you would like a message you sent removed, ask and it will be.
Your account, and your activity in the Flow 255 applicationFor as long as the account exists. Close it and the data goes with it, except where something must be kept for a legal obligation.
Signed participant waivers and pathway agreementsUntil the time to bring a claim has run out — two years after the last activity for an adult, and two years after their eighteenth birthday for someone who signed up under 18. See “In-person activities and the participant waiver”.
Written coaching messagesThe same clock as a signed waiver: two years after the last activity, or two years after an eighteenth birthday, whichever is later. 2Mynds deletes its own copy then; your copy is yours to keep or delete. See “The coaching pathways”.
Safeguarding notesThe same clock again, for the same reason — a concern about a child may be raised long after the fact. See “The coaching pathways”.
Orders, subscriptions and payment recordsKept for as long as accounting and tax rules require, which is longer than the account itself. Card details are held by Stripe, not by 2Mynds, under Stripe’s own retention.

If you want to know how long a specific piece of information will be kept, ask at [email protected] and you will be told.

The purposes of processing

The Data concerning the User is collected to allow the Owner to provide its Service, comply with its legal obligations, respond to enforcement requests, protect its rights and interests (or those of its Users or third parties), detect any malicious or fraudulent activity, as well as the following: Analytics, Contacting the User, Displaying content from external platforms, and Hosting and content delivery.

For specific information about the Personal Data used for each purpose, the User may refer to the section “Detailed information on the processing of Personal Data”.

Detailed information on the processing of Personal Data

Personal Data is collected for the following purposes and using the following services:

Analytics

The services contained in this section enable the Owner to monitor and analyze web traffic and can be used to keep track of User behavior.

Google Analytics 4 (Google LLC)

Google Analytics is a web analysis service provided by Google LLC (“Google”). Google utilizes the Data collected to track and examine the use of this Application, to prepare reports on its activities and share them with other Google services.

This Application loads the Google Analytics tag directly. It is not loaded through Google Tag Manager, and it is not connected to a Google Ads account, a conversion tracking tag or a remarketing audience from this website.

Google Signals is switched off on this property. Google Signals is the setting that would let this site’s analytics data contribute to cross-device advertising audiences and to personalized advertising through Google. With it off, and with no advertising tag of any kind running on either the website or the application, no advertising audience is built from anything you do here.

Google still receives the analytics data described above and handles it under its own terms as the provider of the service.

Personal Data processed: Trackers; Usage Data.

Place of processing: United States – Privacy Policy – Opt Out.

Category of personal information collected according to CCPA: internet information.

Contacting the User

Contact form (this Application)

By filling in the contact form with their Data, the User authorizes this Application to use these details to reply to requests for information, quotes or any other kind of request as indicated by the form’s header.

The form is delivered as an email to the Owner and is not written to any database on this website. Delivery is carried out by Amazon Simple Email Service (Amazon Web Services, Inc.), which processes the message in transit in order to send it. Completing this form does not subscribe the User to anything: the newsletter is a separate form with its own consent, described below.

Personal Data processed: email address; first name; last name; the content of the message; the page the message was sent from.

Category of personal information collected according to CCPA: identifiers; internet information.

Displaying content from external platforms

This type of service allows you to view content hosted on external platforms directly from the pages of this Application and interact with them. This type of service might still collect web traffic data for the pages where the service is installed, even when Users do not use it.

Typefaces — no longer Google Fonts

Until 21 September 2026 this website used Google Fonts, so the font files were requested from Google’s servers as each page loaded, and Google received the visitor’s IP address and browser information for that request — whether or not the visitor interacted with anything on the page.

That is no longer the case on this website. The typefaces are served from this website’s own domain. No font request reaches Google, and no other company processes anything in order to show you the type on this page.

This entry is kept rather than deleted so that anyone who read the earlier version can see what changed and when.

Bunny.net (BunnyWay d.o.o.)

Bunny.net is a content delivery network used by this Application to serve the audio narrations attached to some articles. It is requested only on the pages that carry a narration, and only when the audio loads.

Personal Data processed: Usage Data.

Place of processing: Slovenia — Privacy Policy.

Category of personal information collected according to CCPA: internet information.

Hosting and content delivery

This type of service hosts the pages of this Application and delivers them to the User. Data passes through it for the sole purpose of serving the request, and server logs are generated as a result.

Cloudflare Pages (Cloudflare, Inc.)

Cloudflare Pages is a hosting and content delivery service provided by Cloudflare, Inc. It serves every page of this Application and, acting as a reverse proxy, handles all traffic between the User and this Application. Cloudflare also runs the function that receives the contact form.

Personal Data processed: Usage Data; various types of Data as specified in the privacy policy of the service.

Place of processing: United States — Privacy Policy.

Category of personal information collected according to CCPA: internet information.

Amazon Simple Email Service (Amazon Web Services, Inc.)

Amazon SES is an email sending service provided by Amazon Web Services, Inc. This Application uses it to deliver contact form submissions to the Owner’s own inbox. It is used for that delivery only: it holds no mailing list for this Application, and no marketing email is sent from it. The newsletter is sent by FunnelKit instead, described below.

Personal Data processed: email address; first name; last name; the content of the message.

Place of processing: United States — Privacy Policy.

Category of personal information collected according to CCPA: identifiers.

Supabase (Supabase, Inc.)

Supabase is a hosted database service. It holds one thing and nothing else: the signed participant waivers and pathway agreements described earlier in this policy, together with a frozen copy of the exact wording each person was shown when they signed. It holds no website analytics, no newsletter list and no account records.

It is reached over the internet, as any hosted database is, and it refuses outright any request that does not carry a secret key — there is no anonymous read access to the stored waivers at all. The key used by this website can add a waiver and read back the record it has just added; it cannot change one, delete one, or read the stored wording. Only 2Mynds staff can read what is stored. Records are deleted automatically two years after the last activity, or for a participant who signed while under 18, two years after their eighteenth birthday, whichever is later.

Personal Data processed: first name; last name; date of birth; email address; phone number; medical and health information volunteered for safety; emergency contact name, relationship and phone number; whether photos and video may be used; whether a birthday message was asked for; for a coaching pathway, the pathway and segment agreed and the answer about one-to-one online sessions; whether the signer is the participant or a parent or guardian, and that person’s name and email address, and for a parent or guardian signing a pathway agreement, their phone number; the signature as typed and, where it was drawn, the drawn signature itself; the date and time of signing, the browser used and the internet address it was sent from; and for waivers carried over from the previous version of this website, the reference of the original entry.

Place of processing: United States, US West (North California) — Privacy Policy.

Category of personal information collected according to CCPA: identifiers; internet information; health information; characteristics of protected classifications; sensitive personal information.

Protection from SPAM

This type of service tells a person apart from an automated script, so that submissions made by the latter can be refused.

Cloudflare Turnstile (Cloudflare, Inc.)

Cloudflare Turnstile is a bot-detection service provided by Cloudflare, Inc. It runs on the pages of this website that carry a form — the contact page and the co-branded school pages — and checks that the form is being filled in by a person. Cloudflare receives the visitor’s IP address and information about their browser in order to make that check, and the result is confirmed with Cloudflare when the form is submitted. It does not see the message, and it runs on no other page.

It was added on 27 October 2026, after automated submissions began arriving through the contact form.

Personal Data processed: Usage Data.

Place of processing: United States — Privacy Policy.

Category of personal information collected according to CCPA: internet information.

Coaching by message

Text-based mentoring between coaching sessions is delivered by message. The service below carries those messages. It is not loaded by this website or by the application, and it processes nothing for anyone who is not on a coaching pathway.

WhatsApp (Meta Platforms, Inc.)

Written coaching — training, preparation, how a session or a competition went — is sent and received through WhatsApp. Meta carries the messages and applies its own terms and privacy policy to that carriage; 2Mynds does not control what Meta holds, and cannot delete a participant’s own copy of their own conversation.

2Mynds keeps its copy of written coaching messages for the same period as a signed waiver — two years after the last activity, or for a participant under 18, two years after their eighteenth birthday, whichever is later — and then deletes them. For a participant under 18, nothing written is private from their parent or guardian: all text-based coaching messages are accessible to them, and the signed agreement says so in the same words.

Personal Data processed: phone number; first name; last name; the content of coaching messages.

Place of processing: United States — Privacy Policy.

Category of personal information collected according to CCPA: identifiers; the content of communications.

The Flow 255 application

The subscription product at flow255.2mynds.com is a different kind of service from this website: it has user accounts, a store and subscriptions, and it sends email to the people who hold those accounts. The services below are the ones it uses in addition to everything already described.

⚠ This section describes the Flow 255 application, not this website. Nothing here runs on www.2mynds.com.

Managing contacts and sending messages

This type of service makes it possible to manage a database of email contacts and to send messages to Users, including automated sequences triggered by activity in the application. These services may also record when a message was opened and whether links in it were clicked.

FunnelKit (FunnelKit, formerly WooFunnels)

FunnelKit is used in two places. Inside the Flow 255 application it sends email broadcasts and automated email sequences to account holders, and operates the application’s cart and checkout flow. From this website it receives newsletter signups: the address given at /newsletter/ is passed to FunnelKit, which holds the subscriber list and sends the newsletter.

Newsletter signup is double opt-in. Submitting the form sends one confirmation email and nothing else; the address joins the list only if that link is clicked, and it is removed on unsubscribe, which is available in every newsletter sent. The signup form asks for an email address and nothing else.

Personal Data processed: email address; first name; last name; order and subscription details; Usage Data.

Place of processing: within the Flow 255 application — Privacy Policy.

Category of personal information collected according to CCPA: identifiers; commercial information; internet information.

Payment

Payment for subscriptions and products is handled by the providers below. 2Mynds does not receive or store full card numbers.

Stripe (Stripe, Inc.)

Stripe is the payment processor used by the Flow 255 application to take payment for subscriptions and orders, and it is the only one. Card details are entered on Stripe’s own hosted fields and are processed by Stripe, not by 2Mynds.

Personal Data processed: payment details as required by Stripe; email address; billing information; Usage Data.

Place of processing: United States — Stripe Privacy Policy.

Category of personal information collected according to CCPA: identifiers; commercial information.

Tag Management

This type of service helps the Owner to manage the tags or scripts needed on a service in a centralized fashion. This results in the Users’ Data flowing through these services, potentially resulting in the retention of this Data.

Booking and scheduling

LatePoint, with Zoom (Zoom Communications, Inc.) and Microsoft (Microsoft Corporation)

Appointments are booked through LatePoint, which runs inside the Flow 255 application. Booking an appointment creates a Zoom meeting and writes the appointment to a Microsoft Outlook calendar, so the name, email address and appointment time are shared with those services in order to do so.

This one matters to visitors of www.2mynds.com. The booking links on the website lead here, so someone who books a consultation without ever holding an account still has their details processed this way.

Personal Data processed: email address; first name; last name; appointment time and time zone; Usage Data.

Place of processing: United States — Zoom Privacy Statement — Microsoft Privacy Statement.

Category of personal information collected according to CCPA: identifiers.

Security and hosting of the application

Cloudways (DigitalOcean, LLC)

Cloudways hosts the Flow 255 application and holds its database, which contains the account, order and subscription records described in this policy.

Personal Data processed: all Data described in this policy for the application; Usage Data.

Place of processing — Privacy Policy.

Category of personal information collected according to CCPA: identifiers; commercial information; internet information.

Wordfence (Defiant, Inc.)

Wordfence protects the Flow 255 application from attack. To do so it checks visiting IP addresses against a list of known-malicious addresses and receives threat signature updates.

Personal Data processed: Usage Data.

Place of processing: United States — Privacy Policy.

Category of personal information collected according to CCPA: internet information.

Google Tag Manager (Google LLC)

Google Tag Manager is a tag management service provided by Google LLC. The Flow 255 application loads it, and Google Analytics is delivered through it there. This website does not use it — see the Analytics section above.

Personal Data processed: Trackers.

Place of processing: United States — Privacy Policy.

Category of personal information collected according to CCPA: internet information.

Displaying content from external platforms

Bunny.net and YouTube (Google LLC)

Video in the Flow 255 application is delivered through Presto Player, mostly from Bunny.net and in some cases from the 2Mynds YouTube channel. Bunny.net receives only what it needs to deliver the file. On this website, one page carries a YouTube video — the homepage, which has Leon’s TEDx talk — and nothing else does.

YouTube embeds run in privacy-enhanced mode, through youtube-nocookie.com. This means no cookie is set on your device unless you actually play the video.

On this website it goes further: nothing is sent to Google at all until you press play. The page shows a still image served from this website, not from Google, and the player is only created when you click it. Until then YouTube does not know the page has been opened. With JavaScript switched off the play button is an ordinary link to YouTube, so the choice stays yours either way.

In the application, privacy-enhanced mode is the whole of it. Google receives a request when a page carrying a player loads, so it learns your IP address, your browser and which page the video sits on — privacy-enhanced mode limits what is stored on your device, not what is sent to Google.

In both places, if you do play a video, YouTube then sets cookies in the ordinary way.

Vimeo was previously used and is being withdrawn; while that is in progress a Vimeo player may still appear on some pages.

Personal Data processed: Trackers; Usage Data.

Place of processing: United States and Slovenia — Google Privacy Policy — Bunny.net Privacy Policy — Vimeo Privacy Policy.

Category of personal information collected according to CCPA: internet information.

Content delivery networks (jsDelivr, Amazon CloudFront)

The application loads common code libraries and some template images from public content delivery networks. These receive the User’s IP address in order to serve the file, and are used for delivery only — they are not advertising services.

Personal Data processed: Usage Data.

Place of processing: jsDelivr Privacy Policy — Amazon Privacy Notice.

Category of personal information collected according to CCPA: internet information.

The rights of Users

Users may exercise certain rights regarding their Data processed by the Owner.

In particular, Users have the right to do the following:

  • Withdraw their consent at any time. Users have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data.
  • Object to processing of their Data. Users have the right to object to the processing of their Data if the processing is carried out on a legal basis other than consent. Further details are provided in the dedicated section below.
  • Access their Data. Users have the right to learn if Data is being processed by the Owner, obtain disclosure regarding certain aspects of the processing and obtain a copy of the Data undergoing processing.
  • Verify and seek rectification. Users have the right to verify the accuracy of their Data and ask for it to be updated or corrected.
  • Restrict the processing of their Data. Users have the right, under certain circumstances, to restrict the processing of their Data. In this case, the Owner will not process their Data for any purpose other than storing it.
  • Have their Personal Data deleted or otherwise removed. Users have the right, under certain circumstances, to obtain the erasure of their Data from the Owner.
  • Receive their Data and have it transferred to another controller. Users have the right to receive their Data in a structured, commonly used and machine readable format and, if technically feasible, to have it transmitted to another controller without any hindrance. This provision is applicable provided that the Data is processed by automated means and that the processing is based on the User’s consent, on a contract which the User is part of or on pre-contractual obligations thereof.
  • Lodge a complaint. Users have the right to bring a claim before their competent data protection authority.

If you are in the European Economic Area or the United Kingdom

2Mynds has customers in Europe, so the GDPR and the UK GDPR apply to them. The rights listed above are not offered as a courtesy — they are yours, and the legal bases in “Mode and place of processing the Data” are the grounds we rely on.

Where your data goes. 2Mynds is a United States company and every service named in this policy is operated from the United States, except Bunny.net, which operates from Slovenia. So using this website or the application means your personal data is transferred to the United States.

The safeguards relied on for that transfer are the European Commission’s Standard Contractual Clauses, and, where a provider is certified under it, the EU–US Data Privacy Framework and its UK extension. If you want to know which basis applies to a particular service named in this policy, ask at [email protected] and you will be told.

Special categories. 2Mynds does not process special categories of personal data as Article 9 defines them. The Flow 255 application records fitness — training activity and mental performance assessments — not data concerning health, and it makes no clinical or diagnostic finding about anyone.

Complaining. You may complain to the supervisory authority in the country where you live, where you work, or where you believe the problem happened. You do not have to come to us first — though we would rather you did, because it is usually quicker.

Details about the right to object to processing

Where Personal Data is processed for a public interest, in the exercise of an official authority vested in the Owner or for the purposes of the legitimate interests pursued by the Owner, Users may object to such processing by providing a ground related to their particular situation to justify the objection.

Users must know that, however, should their Personal Data be processed for direct marketing purposes, they can object to that processing at any time without providing any justification. To learn, whether the Owner is processing Personal Data for direct marketing purposes, Users may refer to the relevant sections of this document.

How to exercise these rights

Any requests to exercise User rights can be directed to the Owner through the contact details provided in this document. These requests can be exercised free of charge and will be addressed by the Owner as early as possible and always within one month.

Additional information about Data collection and processing

The User’s Personal Data may be used for legal purposes by the Owner in Court or in the stages leading to possible legal action arising from improper use of this Application or the related Services.
The User declares to be aware that the Owner may be required to reveal personal data upon request of public authorities.

Additional information about User’s Personal Data

In addition to the information contained in this privacy policy, this Application may provide the User with additional and contextual information concerning particular Services or the collection and processing of Personal Data upon request.

System logs and maintenance

For operation and maintenance purposes, this Application and any third-party services may collect files that record interaction with this Application (System logs) use other Personal Data (such as the IP Address) for this purpose.

Information not contained in this policy

More details concerning the collection or processing of Personal Data may be requested from the Owner at any time. Please see the contact information at the beginning of this document.

If something goes wrong with your data

If personal data is lost, stolen, or exposed to someone who should not have had it, and doing so is likely to put people at risk, 2Mynds will notify the relevant supervisory authority within 72 hours of becoming aware of it, as the GDPR requires. Where the risk to you is high, you will be told directly and without undue delay.

Californian consumers are notified in accordance with California’s own breach notification law, which applies whether or not the GDPR does.

How “Do Not Track” requests are handled

This Application does not support “Do Not Track” requests, a signal most browsers and sites stopped acting on some years ago. To determine whether any of the third-party services it uses honor “Do Not Track” requests, please read their privacy policies.

Global Privacy Control

Global Privacy Control (GPC) is the signal that replaced “Do Not Track” in practice, and California requires businesses to treat it as a valid request to opt out of the sale or sharing of personal information.

2Mynds neither sells personal information nor shares it for cross-context behavioral advertising — see “Sale of your personal information” below — so there is nothing that a GPC signal from your browser would switch off. Sending one costs you nothing and changes nothing here.

Were that ever to change, this policy would say so before the change took effect, and honoring GPC would be part of making it.

Changes to this privacy policy

The Owner reserves the right to make changes to this privacy policy at any time by notifying its Users on this page and possibly within this Application and/or – as far as technically and legally feasible – sending a notice to Users via any contact information available to the Owner. It is strongly recommended to check this page often, referring to the date of the last revision shown at the top of this page.

Should the changes affect processing activities performed on the basis of the User’s consent, the Owner shall collect new consent from the User, where required.

Information for Californian consumers

This part of the document integrates with and supplements the information contained in the rest of the privacy policy and is provided by the business running this Application and, if the case may be, its parent, subsidiaries and affiliates (for the purposes of this section referred to collectively as “we”, “us”, “our”).

The provisions contained in this section apply to all Users who are consumers residing in the state of California, United States of America, according to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, “the CCPA”) (Users are referred to below, simply as “you”, “your”, “yours”), and, for such consumers, these provisions supersede any other possibly divergent or conflicting provisions contained in the privacy policy.

This part of the document uses the term “personal information“ as it is defined in The California Consumer Privacy Act (CCPA).

Categories of personal information collected, disclosed or sold

In this section we summarize the categories of personal information that we’ve collected, disclosed or sold and the purposes thereof. You can read about these activities in detail in the section titled “Detailed information on the processing of Personal Data” within this document.

Information we collect: the categories of personal information we collect

We collect the following categories of personal information:

  • On www.2mynds.com — identifiers and internet information; and, through the participant waiver only, personal characteristics (age), sensitive personal information (health information a parent or participant chooses to give), and audio-visual information (photos and video, only with permission).
  • In the Flow 255 application — identifiers, internet information, commercial information (orders and subscriptions), and geolocation data (your country, derived from your IP address to choose a currency).

Before September 2026, employment related information was also listed, through services that have since been removed. Inferred information was collected until 14 September 2026, in the form of advertising audiences built from activity in the application; the services that built them have been switched off. Neither is collected now.

We will not collect additional categories of personal information without notifying you.

How we collect information: what are the sources of the personal information we collect?

We collect the above mentioned categories of personal information, either directly or indirectly, from you when you use this Application.

For example, you directly provide your personal information when you submit requests via any forms on this Application. You also provide personal information indirectly when you navigate this Application, as personal information about you is automatically observed and collected. Finally, we may collect your personal information from third parties that work with us in connection with the Service or with the functioning of this Application and features thereof.

How we use the information we collect: sharing and disclosing of your personal information with third parties for a business purpose

We may disclose the personal information we collect about you to a third party for business purposes. In this case, we enter a written agreement with such third party that requires the recipient to both keep the personal information confidential and not use it for any purpose(s) other than those necessary for the performance of the agreement.

We may also disclose your personal information to third parties when you explicitly ask or authorize us to do so, in order to provide you with our Service.

To find out more about the purposes of processing, please refer to the relevant section of this document.

Sale of your personal information

For our purposes, the word “sale” means any “selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating orally, in writing, or by electronic means, a consumer’s personal information by the business to another business or a third party, for monetary or other valuable consideration”.

That definition is broad, and it is worth being plain about where we stand inside it.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. 2Mynds is paid by its customers for subscriptions and for the THRIVE and GRIT packages. It is not paid by anyone for information about you.

The services named in “Detailed information on the processing of Personal Data” — analytics, hosting, payment, email delivery, video, booking and security — receive personal information in order to perform a service for us and are restricted to that purpose. The only other recipients are the people running an in-person activity with 2Mynds — a partner organization on a joint waiver, and the independent coach delivering a session — who receive the waivers for that activity because they are running it, and pay nothing for them. Neither the website nor the application has carried advertising or remarketing since 14 September 2026.

Your right to opt out of the sale of personal information

You have the right to opt out of the sale of your personal information. Because no sale takes place, there is nothing here for you to opt out of.

If that ever changes, this policy will say so before the change takes effect, and the way to opt out will be set out in this section. Until then, any question about it can go to [email protected].

What are the purposes for which we use your personal information?

We may use your personal information to allow the operational functioning of this Application and features thereof (“business purposes”). In such cases, your personal information will be processed in a fashion necessary and proportionate to the business purpose for which it was collected, and strictly within the limits of compatible operational purposes.

We may also use your personal information for other reasons such as for commercial purposes (as indicated within the section “Detailed information on the processing of Personal Data” within this document), as well as for complying with the law and defending our rights before the competent authorities where our rights and interests are threatened or we suffer an actual damage.

We will not use your personal information for different, unrelated, or incompatible purposes without notifying you.

Your California privacy rights and how to exercise them

The right to correct inaccurate personal information

You have the right to ask us to correct personal information about you that is wrong, and we will correct it unless we have a documented reason to believe it is accurate. Ask at [email protected]. This right was added by the California Privacy Rights Act and was missing from earlier versions of this policy.

The right to limit the use of sensitive personal information

The CCPA, as amended, gives you the right to limit how a business uses and discloses sensitive personal information — a defined category that includes, among other things, information about health.

2Mynds collects health information in one place only: the participant waiver for in-person activities. It asks whether the participant has a medical condition, injury, allergy or limitation, so that they can be kept safe while taking part. It is used for that and for nothing else — not to infer anything about the participant, and not for marketing. See “In-person activities and the participant waiver” above.

The Flow 255 application records fitness: your training activity, and assessments of mental performance skills and attributes. It does not diagnose anything, it does not record any clinical classification of disease, and it is not a medical or healthcare service. Nothing it holds about you describes a health condition.

Nor is anything it holds used for the purposes this right exists to restrict. It is not used to infer characteristics about you, it is not used for advertising, and it is not disclosed to anyone outside the services named in this policy, each of which is restricted to performing a service for us. Nothing you provide is used to build a profile of you for anyone else’s benefit.

If you would like to know exactly what is held about you, or want it deleted, ask at [email protected] and you will be told, or it will be done.

We will not treat you differently for exercising your rights

You will not be discriminated against for exercising any right in this policy. We will not deny you a service, charge you a different price, give you a lower quality of service, or suggest that we might, because you asked what we hold, asked us to correct or delete it, or objected to something we do.

If you ask us to delete information that the Service needs in order to work — your account, for instance — the consequence is that the Service stops working for you. That is a consequence of the deletion, not a penalty for asking, and we will tell you before doing it rather than after.

The right to know and to portability

You have the right to request that we disclose to you:

  • the categories and sources of the personal information that we collect about you, the purposes for which we use your information and with whom such information is shared;
  • in case of sale of personal information or disclosure for a business purpose, two separate lists where we disclose:
    • for sales, the personal information categories purchased by each category of recipient; and
    • for disclosures for a business purpose, the personal information categories obtained by each category of recipient.

The disclosure described above will be limited to the personal information collected or used over the past 12 months.

If we deliver our response electronically, the information enclosed will be “portable”, i.e. delivered in an easily usable format to enable you to transmit the information to another entity without hindrance – provided that this is technically feasible.

The right to request the deletion of your personal information

You have the right to request that we delete any of your personal information, subject to exceptions set forth by the law (such as, including but not limited to, where the information is used to identify and repair errors on this Application, to detect security incidents and protect against fraudulent or illegal activities, to exercise certain rights etc.).

If no legal exception applies, as a result of exercising your right, we will delete your personal information and direct any of our service providers to do so.

How to exercise your rights

To exercise the rights described above, you need to submit your verifiable request to us by contacting us via the details provided in this document.

For us to respond to your request, it’s necessary that we know who you are. Therefore, you can only exercise the above rights by making a verifiable request which must:

  • provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative;
  • describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We will not respond to any request if we are unable to verify your identity and therefore confirm the personal information in our possession actually relates to you.

If you cannot personally submit a verifiable request, you can authorize a person registered with the California Secretary of State to act on your behalf.

If you are an adult, you can make a verifiable request on behalf of a minor under your parental authority.

You can submit a maximum of 2 requests to know over a period of 12 months. That limit applies to requests for disclosure of the personal information we hold. Requests to delete your personal information, and requests to correct it, are not limited in this way.

How and when we are expected to handle your request

We will confirm receipt of your verifiable request within 10 days and provide information about how we will process your request.

We will respond to your request within 45 days of its receipt. Should we need more time, we will explain to you the reasons why, and how much more time we need. In this regard, please note that we may take up to 90 days to fulfill your request.

Our disclosure(s) will cover the preceding 12 month period.

Should we deny your request, we will explain you the reasons behind our denial.

We do not charge a fee to process or respond to your verifiable request unless such request is manifestly unfounded or excessive. In such cases, we may charge a reasonable fee, or refuse to act on the request. In either case, we will communicate our choices and explain the reasons behind it.

Personal Data (or Data)

Any information that directly, indirectly, or in connection with other information — including a personal identification number — allows for the identification or identifiability of a natural person.

Usage Data

Information collected automatically through this Application (or third-party services employed in this Application), which can include: the IP addresses or domain names of the computers utilized by the Users who use this Application, the URI addresses (Uniform Resource Identifier), the time of the request, the method utilized to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server’s answer (successful outcome, error, etc.), the country of origin, the features of the browser and the operating system utilized by the User, the various time details per visit (e.g., the time spent on each page within the Application) and the details about the path followed within the Application with special reference to the sequence of pages visited, and other parameters about the device operating system and/or the User’s IT environment.

User

The individual using this Application who, unless otherwise specified, coincides with the Data Subject.

Data Subject

The natural person to whom the Personal Data refers.

Data Processor (or Data Supervisor)

The natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller, as described in this privacy policy.

Data Controller (or Owner)

The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data, including the security measures concerning the operation and use of this Application. The Data Controller, unless otherwise specified, is the Owner of this Application.

This Application

The means by which the Personal Data of the User is collected and processed. In this document the term covers both the website at www.2mynds.com and the Flow 255® application at flow255.2mynds.com, which share this policy. Where a statement is true of only one of them, it says so — and the two differ substantially, so it is worth reading which one a section means.

Service

The service provided by this Application as described in the relative terms (if available) and on this site/application.

European Union (or EU)

Unless otherwise specified, all references made within this document to the European Union include all current member states to the European Union and the European Economic Area.

Cookies are Trackers consisting of small sets of data stored in the User’s browser.

Tracker

Tracker indicates any technology – e.g Cookies, unique identifiers, web beacons, embedded scripts, e-tags and fingerprinting – that enables the tracking of Users, for example by accessing or storing information on the User’s device.

Current City

Provides access to the User’s current location.

This privacy statement has been prepared based on provisions of multiple legislations, including Art. 13/14 of Regulation (EU) 2016/679 (General Data Protection Regulation).

This privacy policy relates solely to this Application, if not stated otherwise within this document.