Privacy Policy

Last updated 14 September 2026

Mindwtr (“we”, “our”, or “us”) is designed as a local-first application. We respect your privacy and aim to minimize data collection by design.

1. Data storage

All data created within the app (tasks, projects, notes) is stored locally on your device.

2. Data sync

If you choose to use sync features (for example File Sync, WebDAV, self-hosted sync, or Dropbox OAuth in supported builds), your data is transmitted directly between your device and your chosen storage/sync provider. We (the developer) do not have access to this data.

• Dropbox OAuth sync (supported builds): Mindwtr requests Dropbox App Folder access and syncs only app data files under /Apps/Mindwtr/ (for example data.json and attachments/*).
• Token handling: OAuth access/refresh tokens are stored locally on your device and used only to call Dropbox APIs for your account.
• FOSS builds: Dropbox OAuth may be disabled in FOSS distributions.
• Other providers via File Sync: iCloud Drive, Google Drive, OneDrive, Syncthing, and similar tools can still be used indirectly through File Sync.

3. Anonymous usage analytics (heartbeat)

In builds configured with the heartbeat endpoint, Mindwtr may send a small heartbeat event at most once per day to help us measure app health and adoption (for example DAU/MAU and distribution-channel usage).

• What may be sent: platform (for example iOS/Android/macOS/Windows/Linux), app version, distribution channel (for example App Store/Play Store/F-Droid/IzzyOnDroid/winget/Homebrew), coarse device class (for example phone/tablet/desktop), coarse OS major version (for example iOS 18 or Android 15), locale (for example en-US), and two app-generated random identifiers: an install identifier that is stored only on that device, and a profile identifier that is stored inside your Mindwtr data and therefore syncs to your other installs, so several devices using the same data count as one profile instead of several people.
• Profile identifier: it is a random value with no personal information. It is created when the app first runs, and a device that connects to existing synced data adopts the identifier already in that data. It is sent only while the analytics setting is on.
• Country data: country may be derived server-side from edge network metadata during request handling.
• What is not sent in the heartbeat payload: user task data, project data, note content, files, AI prompt content, email address, name, contacts, account data, or other personal content.
• Opt-out: supported builds include a Settings toggle to disable future heartbeat analytics. When this is turned off, Mindwtr sends one final anonymous opt_out heartbeat with the same app-generated identifier so the server can stop counting that install as active.

4. In-app feedback

If you send feedback from within the app (Settings → About → Send feedback), what you submit is sent directly to us at our feedback endpoint. It is only sent when you choose to submit feedback.

• What is sent: the category you pick (bug, feature, or other), your message, and basic context about your install — app version, platform, operating system, distribution channel, locale, and build.
• Email (optional): an email address is included only if you choose to enter one, so we can reply.
• Recent diagnostics (optional): if you select Include recent diagnostics, Mindwtr attaches a bounded snapshot of recent in-app activity, errors, whether detailed logging was enabled, and available saved logs. To help diagnose problems without enabling detailed logging, the app keeps a sanitized buffer in memory: up to 30 minutes, 160 entries, and 64,000 characters. This buffer is not saved to disk; restarting the app or choosing Clear log clears it. Entries expire from the buffer when it is next read or updated. Diagnostics are sent only when you opt in and submit feedback. The attachment prioritizes errors and is limited to 20,000 characters. Task content, backups, and screenshots are not attached.
• Local mobile crash capture: separately from the memory buffer, mobile builds can save one fatal JavaScript crash record, up to 16 KiB, even with detailed logging off. It contains the time, app/build version, platform and bounded technical error details; unrecognized messages are omitted for privacy. The record moves into the local log after a successful restart. It is shared only through your explicit log export or optional feedback diagnostics, never uploaded automatically. Clear log removes the retained record and local log.
• Unlike the heartbeat, feedback can contain information that identifies you, because you write it — your message, and any email or logs you choose to include. We use it only to understand and respond to your report.

5. Third-party services (AI)

If you use optional AI features with your own API key (BYOK):

• What data is sent: the text you submit for AI processing (for example task title, notes, or prompt content). If you choose a remote speech-to-text provider, Mindwtr also sends the voice recording you ask it to transcribe.
• Who receives it: your selected provider (for example OpenAI, Google Gemini, or Anthropic).
• When it is sent: only after you enable AI and accept the in-app consent prompt.
• How it is sent: directly from your device to that provider.
• Mindwtr developer access: we do not proxy these requests and do not collect or store this AI request content.

6. Security, retention, and deletion

• Security: our analytics and feedback endpoints use HTTPS, and access to stored submissions is restricted. For sync and AI features, transport and storage are also governed by the provider and endpoint you choose; use HTTPS endpoints and review that provider’s privacy controls.
• On-device data: tasks, projects, notes, settings, and local attachments remain until you delete them, clear Mindwtr’s app data, or uninstall the app. Copies in device backups, shared folders, or sync providers remain until you remove them through those services.
• Anonymous usage analytics: we retain these records only for as long as reasonably needed to understand app health, active installations, and release adoption. Turning the analytics setting off stops future daily events and records the opt-out, but it does not automatically erase earlier anonymous records. These records use a random app-generated identifier and are not linked to a Mindwtr account, name, or email address.
• Feedback: we retain submitted feedback and any optional contact or diagnostic information for as long as reasonably needed to investigate, respond, and maintain project history, then delete it when it is no longer needed.
• AI and sync providers: we do not retain content sent directly to your chosen AI or sync provider. The provider’s own retention and deletion policy applies.
• Deletion requests: you may ask us to delete developer-controlled feedback or other information we can identify by emailing [email protected]. Include the feedback report ID or email address used in the report when available. Because anonymous analytics records are not connected to an account or contact information, we may be unable to identify a particular record from your name or email alone. We may retain limited information when required for security, fraud prevention, or legal compliance.

7. Contact us

If you have any questions about this Privacy Policy, email [email protected] or reach us via our GitHub repository.