1. The short version
Your Mindly library — your notes, files, links, images, voice recordings and the connections between them — is stored on your Mac, not on our servers. We never upload or back up your library.
When you use an AI feature, that is different, and we want to be precise about it: the specific item you are acting on is sent to our server and forwarded to our AI provider so the model can generate a tag, a summary, a connection or a chat reply. It is used for that request and is not saved to any Mindly database afterwards. The details are in section 4.
We do not sell your data, we do not share it with advertisers, and we do not build an advertising or behavioural profile of you.
2. Who is responsible for your data
Mindly ("we", "us") is the data controller for the processing described in this policy.
You can reach us about anything in this policy at [email protected].
3. What stays on your Mac
Mindly stores your library in a Mindly directory on your device. The following never leave your Mac unless you use an AI feature on a specific item, as described in section 4:
- Your notes, documents, PDFs and other files
- Your saved links and the items you capture
- Your images and screenshots
- Your voice recordings — with one exception for transcription, explained in section 10
- Your tags, spaces, mind maps and the structure of your library
We do not sync, upload or back up your library. If you lose your device or delete the app without a backup, we cannot recover your content, because we never had a copy of it.
We also do not track your browsing history or your reading behaviour inside the app.
4. What happens when you use an AI feature
Mindly's AI features do not run on your Mac. When you use one, the content that feature needs is sent to our servers and processed by a third-party AI provider located in the United States, which returns the result. What is sent depends on the feature:
- Tags and summaries: the text of the item, or the text extracted from a file or PDF on your device
- Image tagging: the image
- Saved links: the address you saved, and the text of the page it points to, so that it can be summarised
- Connections and suggestions: the text of the items involved
- AI chat: the item you are chatting about, and the messages in that conversation
Nothing else from your library is sent. An item you never run an AI feature on is never transmitted.
Retention: we do not store the content you send. It is used to produce the result and is not written to any Mindly database. We do not use your content to train models, and our contract with that provider does not permit them to use it to train or fine-tune theirs. They do not retain the content by default, but may log it temporarily, for up to 30 days, where that is needed to investigate errors or suspected abuse of their platform.
Encryption: content is encrypted in transit using TLS, both between your Mac and our server and between our server and the AI provider. It is not end-to-end encrypted: our server decrypts the request in order to process and forward it.
Operational logs: to run and debug the service and to protect it from abuse, our servers write a technical log entry for each AI request. That entry contains the time of the request, your IP address, the app version, your anonymous client identifier, which feature was used, whether the request succeeded, and a short truncated excerpt of the submitted text for debugging. Images, full documents and full conversations are not written to these logs. Log entries are retained for up to 30 days and then deleted.
What this means in practice: AI features are optional. If you do not use them, the content of that item never leaves your Mac. If you work with material that must not be processed by a third-party cloud service — legally privileged documents, health records, or anything covered by an NDA or a research ethics protocol that forbids it — do not run AI features on that material.
5. Account information we store
If you create an account, we store the following on our servers:
- Name and email address: for account setup, sign-in, Pro access and support
- UUID: a randomly generated identifier that links your app to your account
- Registration date, last app open date and first launch status: to run onboarding, understand usage trends and improve the product
- Plan (Free or Pro): to determine which features you can access
- Subscription details: subscription type, start date, renewal date and subscription ID, for billing and support
If you sign in with Google, we receive your name, email address and Google account identifier from Google. We do not receive your Google password, and we do not access any other Google data.
6. The website
Separately from the app, this website processes the following:
- Analytics: we use a cookieless analytics provider that collects aggregated page-view data and does not build a cross-site profile of you
- Waitlist: if you join the waitlist, we store the name and email you submit, and the date you submitted them
- Contact and feedback forms: we store the email address and message you send, and for in-app feedback the app version and feedback type
- Server logs: our hosting provider records standard request logs, including IP addresses, for security and reliability
Cookies: we do not use advertising or tracking cookies and there is no consent banner because we do not set anything that requires consent. We use strictly necessary cookies to keep you signed in to your account, and our payment provider may set a cookie on the checkout and pricing pages for fraud prevention.
7. Payments
Pro subscriptions are handled by a third-party payment provider. When you subscribe, you enter your payment details directly with that provider. We never see or store your card number, and card details never touch our servers. They send us your subscription status, subscription ID and billing dates so that we can unlock Pro features and support you.
8. Service providers we use
We use a small number of processors to run Mindly. They may access personal data only to provide their service to us, under contract:
- An AI inference provider (United States) — processing the content you submit to AI features
- A cloud database and authentication provider — accounts and sign-in, and storage of waitlist, contact and feedback submissions
- A payment provider — subscription payments and billing
- A cloud hosting provider (United States) — website and API hosting, server logs and cookieless analytics
- An email delivery provider — sending transactional email such as sign-up confirmations, password resets and support replies
If you would like the identity of a specific provider, email us and we will tell you.
Apple is also a recipient of content in one specific case: voice note transcription uses the speech recognition built into macOS, which sends the recording to Apple. Apple acts under its own Privacy Policy rather than as our processor, and we never receive the audio. See section 10.
International transfers: some of these providers process data in the United States. Where personal data is transferred outside the European Economic Area, the transfer is made on the basis of the European Commission's Standard Contractual Clauses or an equivalent safeguard permitted under Chapter V of the GDPR. You can request a copy of the relevant safeguard by emailing us.
9. Information we do not collect
- We never upload or back up your Mindly library
- We do not read, index or store the content of your library on our servers, other than the specific items you send to AI features as described in section 4
- We do not track your browsing history or reading behaviour
- We do not collect location data
- We do not sell personal data, and we do not share it with advertisers
- We do not use your content to train AI models
10. Permissions the app may ask for
Every permission below is optional. Mindly works without them, and you can revoke any of them at any time in macOS System Settings.
Microphone
- Used solely to record voice notes
- Recordings are saved to your Mindly library on your Mac
- Recordings are never uploaded to Mindly's servers, and are never sent to our AI provider
- Transcription: voice notes are transcribed automatically after recording. To do this, Mindly passes the recording to Apple's speech recognition service, which is built into macOS. Apple processes the audio on Apple's servers and returns the text, which is then stored in your library on your Mac. This processing is carried out by Apple under Apple's Privacy Policy, not by Mindly, and we do not receive a copy of the audio
- If you do not grant microphone access, no recording or transcription takes place
Shortcuts
- Used to let you capture items quickly through the macOS Shortcuts app and custom shortcuts
- If a shortcut triggers an AI feature, the content it captures is processed as described in section 4
Keychain
- Used to store authentication tokens securely if you sign in with a third-party provider such as Google
- This lets Mindly refresh or revoke expired tokens without asking you to sign in repeatedly
- Token storage is managed by macOS. Mindly accesses only its own authentication tokens and stores nothing else in your Keychain
11. Why we are allowed to process this data
If you are in the European Economic Area or the United Kingdom, our legal bases under Article 6 GDPR are:
- Performance of a contract (Art. 6(1)(b)) — creating and maintaining your account, running AI features you invoke, delivering Pro access, processing your subscription and providing support
- Legitimate interests (Art. 6(1)(f)) — keeping the service secure and available, preventing abuse of our AI endpoints, debugging errors, and understanding aggregate usage to improve the product
- Consent (Art. 6(1)(a)) — joining the waitlist, receiving product or marketing email, and granting optional macOS permissions. You can withdraw consent at any time, without affecting processing carried out before you withdrew it
- Legal obligation (Art. 6(1)(c)) — retaining billing and tax records for the periods required by law
Providing your name and email is necessary to hold an account. If you do not provide them, you can still use Mindly, but not the account-based or Pro features.
12. How long we keep things
- Your library: stays on your Mac until you delete it. We hold no copy
- Content sent to AI features: not retained after the request completes
- Technical AI request logs: up to 30 days
- Account data: kept while your account exists, and deleted when you delete your account
- Waitlist entries: until you ask us to remove them, or until the waitlist is retired
- Contact and feedback messages: up to 24 months, so we can follow up on bug reports and support history
- Billing and invoice records: retained for as long as tax and commercial law requires, which in Germany is up to 10 years under § 147 AO and § 257 HGB. This obligation overrides a deletion request for those specific records
13. Your rights
Under the GDPR you have the right to access your personal data, to have inaccurate data corrected, to have your data deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time.
Deleting your account: you can delete your account and all associated account data yourself from Settings inside the Mindly app. This is immediate and permanent. You can also email us and we will do it for you.
Exercising any other right: email [email protected]. We will respond within one month, as required by Article 12(3) GDPR. We may need to verify your identity first.
Complaints: if you think we have handled your data improperly, please contact us first so we can put it right. You also have the right to lodge a complaint with a data protection supervisory authority, either in the EU member state where you live or work, or where the alleged infringement took place.
14. California privacy rights
If you are a California resident, you have the right to know what personal information we collect and why, the right to request its deletion, the right to correct inaccurate information, the right to opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising these rights.
We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we have not done so in the preceding twelve months. To exercise any of these rights, email us at the address above.
15. Security
- Your library is stored on your Mac and is protected by your device's own security, including FileVault if you have it enabled
- All traffic between the app, our servers and our providers is encrypted in transit using TLS
- Authentication tokens are stored in the macOS Keychain
- Access to our production database is restricted and requires authentication
- We never store payment card details
No service can promise perfect security. If a data breach affects your personal data and is likely to present a risk to you, we will notify you and the competent supervisory authority as required by Articles 33 and 34 GDPR.
16. Children
Mindly is not intended for children. In the European Economic Area and the United Kingdom you must be at least 16 to create an account, unless the law of your country sets a lower age of digital consent, in which case that age applies. Elsewhere, including the United States, you must be at least 13.
We do not knowingly collect personal data from children below the applicable age. If we learn that we have, we will delete it promptly. If you believe a child has given us personal data, please contact us.
17. Changes to this policy
We may update this policy as Mindly changes. When we make a material change, we will update the "Last updated" date at the top and, if you have an account, notify you by email or in the app before the change takes effect.
18. Contact
Questions about this policy, or about how your data is handled, go to [email protected]. Our Terms of Use are here.