Start free

Privacy policy

Last updated: September 7, 2026

The short version: Mindestro is local first. Your notes live in a database on your own device, the app is complete without an account, and the app carries no advertising, analytics scripts, or third-party trackers. The separate marketing site uses cookie-free Cloudflare Web Analytics for aggregate traffic and performance measurement. Data leaves your device only through features you turn on yourself or the marketing measurement named below.

What stays on your device

  • Your notes, tasks, projects, agents and settings, stored in your browser's own storage or, in the desktop app, in a file under your home folder.
  • AI keys you bring. They are saved on your device and used to call the provider you chose. They are never sent to us.
  • The on-device AI. The built-in models download to your device and run there; what they read never leaves it.

What leaves your device, and when

  • Marketing analytics. Marketing pages on mindestro.com load Cloudflare Web Analytics to measure aggregate visits and performance. It does not use cookies, local storage, advertising identifiers, or fingerprinting. The script is never loaded by the app at app.mindestro.com.
  • Accounts. Supabase handles account authentication. Your account includes your email address, when supplied, and identifiers/profile information returned by a sign-in provider you choose. Linking GitHub does not grant access to your repositories. Signing in alone does not enable sync.
  • Optional device-to-device sync. Where enabled, the account service stores device names, trust status, last-seen and last-sync times, and short-lived connection metadata. Notes and attachments travel directly between approved devices; this service does not store a cloud copy of them. Connection offers expire after two minutes and an automatic cleanup runs every minute. Provider logs and backups have their own retention; expiry is not a promise of immediate removal from every backup. Revoking a device blocks future exchanges at the next authorization check, not copies it already received.
  • Device address discovery. The configured production discovery service is Cloudflare STUN at stun.cloudflare.com. After you enable device sync and accept the discovery disclosure, it receives network addresses needed to attempt a direct connection, not your notes or attachments. No TURN relay is enabled. Some networks cannot connect directly. The consent screen identifies the configured discovery endpoints; changing those endpoints requires renewed consent.
  • Paid cloud services. Paid cloud note storage and hosted AI are not enabled in this release candidate. They are separate from free device-to-device sync and will require their own setup and data-processing disclosures before use.
  • AI providers you bring. When you point a feature at a provider such as Anthropic or OpenAI, the content you invoke it on goes from your device to that provider under that provider's own terms. Nothing goes to a provider you did not configure.
  • The site assistant. The small helper on these marketing pages answers from a fixed pool of prepared answers on the page itself. A question the pool cannot answer may be processed by Anthropic to write a reply. Questions are not used for advertising or profiling.
  • The update check. The desktop app periodically asks mindestro.com for the latest version number. The request carries no personal data.
  • Ordinary web logs. Serving mindestro.com produces the request logs any website produces at its hosting provider. We use them to keep the service running, not to profile visitors.

What we never do

  • No selling or renting of personal data, ever.
  • No advertising and no advertising identifiers.
  • No analytics or tracking scripts in the app.
  • No advertising trackers or cross-site profiling.

Your controls

  • Use Mindestro without an account. Everything local works.
  • Export all your notes at any time as plain markdown from Settings.
  • Delete your account to remove your synced data from our provider. Clear all data in Settings to wipe the device copy.

Changes

If this policy changes, the new version appears here with a new date at the top. A change that widens what leaves your device will be announced in the app, not slipped in quietly.

Questions about any of this: mindestro@signary.jp