Privacy Policy

BreakThru Mindset is a personal development and manifestation platform founded by Tyson E. Sam. In this policy, “BreakThru Mindset”, “we”, “us” and “our” mean [Legal entity name], the business that operates breakthrumindset.com, the member dashboard and related services (together, the “Services”).

This policy explains how we handle personal information when you visit our website, create an account, take the free assessment, use the 90-day program and journal, join the community, register for events, buy something from us or contact us.

If you have any questions, you can reach us through our contact page or at hello@breakthrumindset.com. Our mailing address is [Mailing address].

Information you give us

• Account details: your name, email address and password when you create an account. Passwords are handled by our authentication provider and stored only in hashed form; we never see them.
• Profile details: optional information such as a display name, photo, short bio, time zone, focus areas, your chosen desired state of mind, and your profile visibility and progress-sharing settings.
• Assessment answers: your responses to the free mindset assessment and the results we calculate from them, including the growth area we suggest you focus on first.
• Program and journal content: journal entries, gratitude lists, affirmations, goals, habits and habit check-ins, weekly reflections, lesson progress and challenge check-ins.
• Community content: posts, comments, reports and accountability requests you create in the member community.
• Purchases: what you bought, the amount and currency, the order status and, for physical products, the shipping address you enter at checkout.
• Applications and registrations: the details you provide when you apply for mentorship (such as your name, email, phone number and answers to our questions) or register for an event.
• Messages and sign-ups: what you send us through the contact form, and your email address when you join the newsletter or a waitlist, together with a record of the consent you gave (the wording you agreed to, when you agreed, and the IP address the request came from).

Information we collect automatically

• First-party analytics events: when you take certain actions, such as starting the assessment, joining a waitlist or completing a purchase, we record the name of the event, the page it happened on, a random session identifier kept in your browser's session storage and, if you are signed in, your account identifier. We use these events to understand which parts of the site are helpful.
• Technical information: like most websites, our hosting and infrastructure providers process technical data such as your IP address, browser type, device type and the pages you request, so that the site can be delivered securely.
• Cookies: see “Cookies and analytics” below.

Information from other sources

• Stripe tells us whether a payment succeeded and shares the details needed to fulfil your order, such as your name, email address, billing country and shipping address. Stripe does not share your full card number with us.

We use personal information to:

• create and secure your account and keep you signed in;
• deliver the Services, including the 90-day program, your private journal, lessons, the progress dashboard and the community;
• personalize your experience, for example by suggesting a starting point based on your assessment;
• process orders, enrollments and event registrations, ship physical products and provide receipts;
• send service messages, such as order confirmations, account and security notices, and event details;
• send marketing email, such as the weekly reflection or the free seven-day introduction, but only if you opted in;
• review mentorship applications and respond to messages;
• moderate the community and enforce our Terms of Service;
• understand, in aggregate, how the site is used so we can improve it;
• prevent fraud and abuse, and comply with our legal obligations.

Legal bases

Where the law requires a legal basis for processing, we rely on: performance of a contract (to provide the Services you signed up for or bought); consent (for marketing email and, where required, non-essential cookies, which you can withdraw at any time); legitimate interests (to keep the Services secure, moderate the community and improve the site, balanced against your rights); and legal obligation (for example, keeping tax and accounting records).

Your journal entries, goals, habits, habit check-ins and weekly reflections belong to you.

• They are stored with database access rules that allow only your signed-in account to read or change them.
• No staff role at BreakThru Mindset (coaches, moderators, editors or administrators) is given permission to view them, and our staff tools do not display them.
• We do not use their contents for marketing or advertising, and we never sell them.
• They are only shared if you choose to share them yourself, for example by posting something in the community.

Like all of the Services, this information is stored on servers operated by our database provider (see “Service providers we use”).

All payments are processed by Stripe. When you check out, you enter your card details on Stripe's secure checkout page, and they go directly to Stripe. Your full card number never touches BreakThru Mindset's servers, and we do not store it.

For memberships, you manage your payment method, invoices and cancellation through Stripe's billing portal, which you can open from your account settings. Stripe's handling of your information is described in the Stripe Privacy Policy.

We send two kinds of email, delivered through our email provider, Resend:

• Service email about something you did or bought, such as order confirmations, account and security notices, mentorship application updates and event details. These are part of providing the Services.
• Marketing email, such as the weekly reflection, the free seven-day introduction and news about programs and events. We only send marketing email if you opt in, and we keep a record of when and how you gave consent.

Every marketing email includes an unsubscribe link. You can also turn marketing email off in your account settings at any time. When you unsubscribe, we keep a minimal record of your email address so we can respect your choice.

Essential cookies

We use essential cookies to keep you securely signed in to your account. Without them, sign-in does not work, so they cannot be switched off.

First-party analytics

Our own analytics events (described above) are stored in our database. They use a random session identifier kept in your browser's session storage, which is cleared when you close the tab. They do not follow you to other websites.

Google Analytics (optional)

We may use Google Analytics to understand overall traffic, such as which pages are visited and how people find us. When it is enabled, Google Analytics sets its own cookies and we ask it to anonymize IP addresses. You can learn more in Google's privacy information or install the Google Analytics opt-out add-on. Where the law requires consent for analytics cookies, we will ask for it first.

Embedded videos

Lessons may include videos embedded from providers such as YouTube (in privacy-enhanced mode), Vimeo or Mux. These providers may collect technical information when you play a video, under their own privacy policies.

We do not use advertising cookies. You can control or delete cookies in your browser settings, but blocking essential cookies will prevent you from signing in.

We rely on a small number of trusted providers to run the Services. They process personal information on our behalf and only for the purposes we describe here.

• Supabase: our database, user authentication and file storage.
• Stripe: payment processing, subscriptions and the billing portal.
• Resend: delivery of service and marketing email.
• Google Analytics: optional, aggregated website analytics.
• Railway: hosting and delivery of the website.
• Video providers (such as YouTube, Vimeo or Mux): playback of lesson videos.
• [Shipping or fulfilment provider]: delivery of physical products, if you order one.

We do not sell or rent your personal information, and we do not share it for targeted advertising. We share it only:

• with the service providers listed above, so they can perform services for us;
• with other members, to the extent described in “What other members can see”;
• with our coaching team, when you apply for mentorship or enroll in a coaching program, so they can review your application and support you;
• when the law requires it, or when it is necessary to protect the rights, safety or property of our members, the public or BreakThru Mindset;
• as part of a merger, acquisition or sale of all or part of our business, in which case we will tell you before your information becomes subject to a different privacy policy;
• with your permission, or at your direction.

If your profile visibility is set to members (the default), other signed-in members can see your display name, first name, photo, bio and focus areas, and your progress if you choose to share it. Anything you post in the community is visible to the members of that group.

If you set your profile visibility to private in your account settings, your profile is hidden from other members entirely.

Other members never see your email address, your billing details, your assessment answers or your private journal.

We keep personal information for as long as you have an account, or as long as we need it for the purposes described in this policy.

• When you delete your account, we delete or anonymize your profile, journal, goals, habits and other account data within [30] days.
• We keep order and payment records for [7] years, or longer if the law requires, for tax and accounting purposes.
• If you unsubscribe from marketing email, we keep a minimal record of your email address so we do not contact you again.
• Backups are overwritten on a rolling schedule of [30] days.

We protect your information with safeguards that include encrypted connections (HTTPS), database access rules that limit each account to its own private data, role-based access for staff that grants only the permissions each role needs, and hashed passwords. Card details are handled by Stripe and never stored by us.

Within our team, access depends on role. For example, administrators can see account and order details so they can support you, coaches can see mentorship applications, and moderators can see community reports. As described above, no role can see your private journal.

No system is perfectly secure. If we become aware of a security incident that affects your personal information, we will notify you and the relevant authorities as the law requires. Please use a strong, unique password and let us know right away if you think your account has been compromised.

You can:

• Update your profile and privacy settings at any time in your account settings, including your profile visibility.
• Turn marketing email off in your account settings, or use the unsubscribe link in any marketing email.
• Ask for a copy of your data, or ask us to correct it.
• Delete your account, or ask us to delete your personal information, from your account settings or through our contact page.

Depending on where you live (for example, in the European Economic Area, the United Kingdom, or certain US states such as California), you may also have the right to object to or restrict certain processing, to data portability, to withdraw consent, and to not be discriminated against for exercising your rights. You may also complain to your local data protection authority.

To make a request, use your account settings or our contact page. We will confirm that the request comes from you, for example by asking you to reply from the email address on your account, and respond within [30] days. You may use an authorized agent where the law allows.

The Services are intended for adults and are not directed to children under [16]. We do not knowingly collect personal information from children under [16]. If you believe a child has given us personal information, please contact us and we will delete it.

BreakThru Mindset is based in [Country], and our service providers may process information in the United States and other countries. Where the law requires, we rely on appropriate safeguards, such as standard contractual clauses, for transfers of personal information across borders.

We may update this policy as the Services change. When we do, we will update the “Last updated” date at the top of this page and, if the changes are significant, let you know by email or with a notice in your dashboard before they take effect.

For privacy questions or requests, please use our contact page or email hello@breakthrumindset.com.

[Legal entity name] [Mailing address]