Privacy Policy

Mindsprig is an end-to-end encrypted, local-first AI workspace for thinking in threads. This Privacy Policy explains what information we handle, how it is protected, and the limited cases in which data leaves your device. It applies to the Mindsprig web application and marketing site. It works alongside our Terms & Conditions.

Mindsprig is designed so that we cannot read your conversations. Wherever this policy and our engineering practices could conflict, we build to the stricter standard: your decrypted content and your encryption key never leave your device.

We keep what we collect to the minimum needed to run the service:

• Account information: the email address and authentication details used to sign in, managed through our authentication provider, Supabase.
• Encrypted content: your conversations, thread titles, side questions, and saved AI provider keys are stored only as ciphertext. We cannot decrypt them.
• Billing information: subscription status and the identifiers needed to manage your plan. Card details are handled by our payment processor, not by Mindsprig.

Your content is encrypted on your device before it is ever stored or transmitted. The encryption key is derived from your password and exists only in your device's memory while you are unlocked. It is never written to disk, never placed in cookies or browser storage, and never sent to our servers.

At sign-up we generate a one-time recovery code that wraps the same key, giving you a second way in if you forget your password — without us ever being able to read your data. We never receive your password or recovery code.

If you lose both your password and your recovery code, we have no way to recover your encrypted data — there is no backdoor. You can choose to erase your data and start over with a new password, but the original content cannot be restored. This is an intentional property of a zero-knowledge system.

Mindsprig stores your data locally in your browser first, so the app stays usable offline and during network problems. Everything persisted on your device is encrypted; plaintext is never written to local storage. Your device is the primary copy of your work.

Mindsprig uses only the cookies and browser storage required to run the service. We do not use advertising, marketing, or analytics cookies, and we do not track you across other sites — so there is no consent banner to click through.

• Essential cookies: a first-party authentication cookie keeps you signed in. It is strictly necessary to use your account and is set only after you log in.
• Functional browser storage: we use your browser's session storage and IndexedDB to remember interface state (such as the active thread, panel widths, and scroll position) and to hold your encrypted, local-first data. This stays on your device and is not used to profile you.
• Crash reporting: our error-reporting service does not set cookies on your device. See “Crash & error reporting” below for what it does and does not collect.

Synchronization is a paid capability, and it is the only way a copy of your content exists outside your device. When you have an active subscription and are online, Mindsprig synchronizes your encrypted data to our hosted backend (Supabase) so it is available across your devices. Only encrypted payloads are uploaded — never plaintext and never your encryption key. Our servers store and relay ciphertext; they cannot read its contents.

Without a subscription nothing is uploaded at all, so we hold no conversation data for you on the server — and cannot recover anything if your device or its browser data is lost.

If a subscription lapses, synchronizing stops but the encrypted data already stored is retained unchanged rather than deleted, and becomes available again if you subscribe later. You can erase it at any time by deleting your account.

Mindsprig connects to the AI provider you choose (for example, your selected model vendor). When you send a message, its content is transmitted to that provider so it can generate a response. This is the one case where conversation content leaves your device in readable form, and it happens only at your direction.

That transmission is governed by the AI provider's own privacy policy and terms, not this one. Mindsprig does not control how a third-party provider uses data it receives. We encourage you to review the policy of any provider whose API key you connect.

Subscriptions are sold and billed by Stripe, acting as the merchant and seller of record. Stripe collects and handles your payment details directly under its own privacy policy; Mindsprig never receives or stores your card details. We retain only the information required to know your plan and subscription status.

As seller of record, Stripe independently determines how it processes your purchase data — including for tax calculation and reporting, fraud prevention, dispute handling, and buyer support — and acts as a controller of that data in its own right, not merely as our processor. Its handling of that data is governed by Stripe’s privacy policy.

To keep the app reliable we use a crash-reporting service (Sentry). Reports are scrubbed before they leave your browser: they never contain decrypted conversation content, encryption keys, request or response bodies, or personal data such as your IP address, cookies, or headers. The only user identifier attached to a report is an opaque account id, and session replay is never enabled.

We rely on a small number of vetted providers that process data on our behalf, under their own security and privacy commitments:

• Supabase — authentication and encrypted data storage and sync. It holds only ciphertext and cannot read your content.
• Stripe — merchant of record for paid plans: payment processing, tax calculation and remittance, and buyer support (see “Payments” above).
• Sentry — crash and error reporting (scrubbed; see “Crash & error reporting” above).
• AI providers you connect — receive message content only when you send a message (see “Third-party AI providers” above).

These providers may process data in countries other than your own, including the United States. Where required by law, such transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We retain your encrypted data for as long as your account is active. When you delete a conversation or thread, it is marked as deleted and removed from your devices through sync; deletions propagate across devices so your removals stick. You can permanently delete your entire account at any time from Settings → Account, which cancels any active subscription and erases your associated data. You can also reach us using the contact details below.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. Because your conversation content is end-to-end encrypted, you already hold the only readable copy on your device. For requests concerning account or billing data that we can access, contact us using the details below and we will respond as required by applicable law. We do not sell your personal information or share it for cross-context behavioural advertising. If your region has a data-protection authority, you also have the right to lodge a complaint with it.

Mindsprig is not directed to children, and we do not knowingly collect personal information from anyone under the age required by their local law to consent to online services. If you believe a child has provided us with personal information, please contact us so we can address it.

We may update this Privacy Policy as the product evolves. When we make material changes, we will revise the “Last updated” date at the top of this page. Continued use of Mindsprig after an update means you accept the revised policy.

Questions about this policy or your data? Email us at support@mindsprig.io.