Minda

Minda data processing overview

Last updated 8 October 2026

This page is for teams and organisations that use Minda's account server and need to know how it handles their data. It is a plain-language overview, not a contract. A signed data processing agreement (DPA) is available from the contact listed on the Legal page: ask for it there.

Who is responsible for what

Account data is the operator's own: the email address and name of a person who signs in, their plan, credits, devices and sign-in history. The operator of this server decides why and how it is used, and is the controller of it. Who the operator is, and how to reach it, is on the Legal page.
Team content is what a team puts on the server: its name, its members and roles, invitations, shared workflows (the text of scheduled tasks), shared run results, shared apps and the team's audit log. The team decides what goes in and who sees it; the operator processes it for the team, to run the team features, and for no other purpose.
Everything else Minda does happens on the user's own computer and never reaches this server. What does leave the computer, feature by feature, is in Minda at Settings → About → What leaves this computer and in the Privacy summary.

What the server processes

Sign-in: the email address, the name and picture address a sign-in provider gives, the sign-in methods used, the Terms version accepted and when, a password stored only as a hash (never the password), and the devices signed in (the name the app gives and when each was last used).
The agent's level: while a user is signed in, Minda reports its agent's growth points (one number) when they change; the server keeps the latest number and its time, and Minda staff see the level in the admin panel.
Billing: Stripe's customer number, the plan and the state of the subscription. Card details are typed on Stripe's own pages and never reach this server.
Minda AI: for each request, the model, its kind, the credits, the vendor's cost, the time and the outcome. The words, pictures and audio of a request go to the AI vendor that runs the model and are not kept here.
Sync: items are encrypted on the user's computer before they are sent. With a passphrase, the server cannot read them. With the default Minda-managed key, the server keeps that key wrapped with a secret only the operator holds and hands it back to the signed-in user's Minda app.
Teams: the team content above, plus, for admins of a paid team, each member's last activity, number of signed-in devices and Minda AI credits used this month. Never the content of a member's browsing or chats.
A computer's own automations (only while "Edit on the web" is on in that computer's Minda, off by default): a readable copy of the automations that computer runs, as Minda shows them (their names, triggers, steps, and the messages, addresses and recipients written in them; never a webhook's address or an API key), its run log (what ran and how it went), and the changes the user queues for it on the account page with the computer's answer. The server keeps them for the account page and never runs them.
Community skills: a skill a user chooses to share, with the display name they chose. It is public.
Feedback: a problem report or an idea a user chooses to send from Minda (Settings → About, or the Report flag under an AI answer, which also attaches that question and answer unless they untick it), shown to them in full before it goes. It holds their own words, the versions of Minda, Electron and Chromium and the system, and only if they tick each: the site's host name (never its address), a few settings, a screenshot of the tab and their account email. It is stored with the account when they are signed in and on its own when they are not, with no IP address. Minda staff read it in the admin panel and may keep a private note on it. Nothing is sent without the user pressing Send.

Who else handles the data

The companies that process data for the server (payments, email, sign-in, AI vendors and hosting) are listed on the Service providers page.

Security measures

These controls exist today. Minda has no independent audit report (such as SOC 2) yet, and this page does not claim one.

Sign-in sessions are random 32-byte tokens, stored only as a hash, that expire 180 days after their last use; a user can sign out everywhere.
Email sign-in codes have 6 digits, are stored as a hash, expire after 10 minutes and allow 5 tries. Browser sign-in with Google, Microsoft, GitHub or Apple uses PKCE. Passwords are stored with scrypt at the OWASP minimum cost. Sign-in requests are rate limited.
The server is meant to be reached over HTTPS only; its replies are not cached, and its web pages carry a strict content security policy.
Synced items are encrypted on the user's computer, and every request the server accepts is size limited and checked. Stripe's webhooks are signature checked and processed once.
The request log holds only the method, the path without its query, the status and how long the request took; never a token, a code, a request body or an email address.
Deleting an account deletes its rows, ends its sessions and deletes its customer record at Stripe.

How long data is kept

Minda AI request records (the credit history): 92 days.
Feedback reports: 365 days, or until the account that sent them is deleted.
Team shared run results: 90 days, and the newest 200 for each team.
A team's audit log: 400 days, and the newest 20,000 entries for each team.
The admin panel's activity log: actions by Minda staff, 365 days; a staff member's changes to an account's credits, 365 days. The log of accounts' own actions and Stripe's changes: 90 days.
Sign-in sessions: until 180 days after their last use, or until the user signs out. Email codes: 10 minutes to use, removed an hour after they were sent. Team invitations: 7 days.
The answer to a request that creates or charges something, when the app sent it with an Idempotency-Key so it can safely ask again after a timeout: 24 hours, encrypted, with the key and a hash of the request.
Synced items: until the user deletes them or deletes the account.
A computer's copy of its own automations: until "Edit on the web" is turned off there while signed in, the user removes that computer on the account page, 90 days pass without that computer looking for changes, the account is deleted, or 10 newer computers of the account replace it (signing out leaves it); a change queued for it, 30 days while it waits and 7 days once the computer has answered.
Account data and team content: until the account or the team is deleted. Deleting an account also deletes the run results it shared and the feedback reports it sent while signed in; the workflows it published stay with the team, whose audit log then calls it "Deleted user", and a team it was the only member of is deleted. A record that a credit pack was bought (Stripe's Checkout number, the credits, the time) and a keyed hash of the email address for the free trial stay, so that a payment is not counted twice and a trial is given once. Stripe keeps the invoices and payments it must keep for tax and accounting.
Database backups: the deploy kit (server/deploy/) keeps one copy of the database a day for 14 days on the server, so a deleted account's rows stay in those copies until the copies age out. The admin panel's backups (owners only) are kept on the server too: the scheduled ones until the newest number an owner set replaces them, the ones made by hand, uploaded or made before a restore until an owner deletes them; they are encrypted when the operator sets a backup key, and an owner may download them to a computer of theirs. An operator who also copies them elsewhere sets how long those copies are kept. How long the hosting provider keeps its own request logs and disk snapshots is the operator's choice; this server does not set it.

What Minda staff can see

Support view. To help with a support request, Minda staff can open one account read-only in the admin panel's "ghost login", which is logged with the staff member and their address. It shows what that account's Minda app is told by the server: the account (name, email, plan and what it includes, credit balances, subscription and billing state), its credit history for 30 days, the Minda AI models its plan unlocks, its teams (name, role, member count, seats), its notices, and its sync status (whether it is on, the kind of key, the number of items of each kind, their size and last change) and signed-in devices. It makes no session for the account, so nothing can act as the user. Synced content and the Minda-managed sync key never reach the panel.
Request log. As above: the method, the path without its query, the status and how long it took.
Admin activity log. It records what staff do in the admin panel with the staff member's address, and the email address of the account they acted on, for 365 days.

Incidents

How to report a vulnerability, and what Minda does about one, is on the Security page.

Contact

The operator's contact details, including for privacy and data requests, and to ask for a signed DPA, are on the Legal page.

The operator of this server has not published who it is or how to contact it yet. Do not rely on this page until it has.

Who runs this service

Publisher and operator: Not set by the operator of this server.
Contact: Not set by the operator of this server.

Terms · Privacy · Security · Service providers · Remove a profile