Privacy policy

Data controller

The controller of your personal data is Clément Guérin, sole proprietor (micro-enterprise), SIRET: 10028571700011, located at 43 Quai Malakoff, 44000 Nantes, France. For any data-related question: hello@minddy.app

Data collected

When you use minddy, we process the following data:

• Account data: email address, user id, display name and profile picture (via Supabase Auth). If you sign in with Google or GitHub, those services pass us your email, name and profile picture; no password is ever shared with us
• Work content: the projects, issues, plans, comments and attachments you create, stored in our database and in Supabase Storage
• Usage data: pages visited, performance metrics and actions performed in the application, measured with PostHog. The “Usage measurement” section explains how your cookie choice affects collection
• Push notifications: if you enable them, we store the push subscription of your browser or of the desktop app: an address issued by its push service, and the keys used to encrypt what we send. Delivery goes through the push service of your browser's vendor (Google, Apple or Mozilla depending on the device), which sees that address but not the content — the payload is encrypted end to end and can only be read by the device that subscribed
• Data submitted to AI: content sent to Numo and its routines, dictation, feedback review, and Smart Fill with its relation suggestions is transmitted to the configured model provider for processing. When Numo reads a linked pull request, this includes the parts it needs, such as its description, review comments and code changes
• Git connections: access tokens for your GitHub or GitLab repositories are encrypted (AES-256-GCM) before storage. We only reach the repository when you trigger an action that requires it
• Personal AI keys: if you provide your own OpenRouter key, it is encrypted (AES-256-GCM) before storage and decrypted only to run your own requests
• Billing data: handled by Stripe; we do not store your banking details, only the customer id and the subscription status
• Public board participants: email address verified by one-time code, votes, posted feedback and comments, and the audio of a dictated post. Verification emails are delivered by Resend; the text of posts and the audio of dictations are processed by AI models, described below

Purposes of processing

• Providing and operating the minddy service
• Managing your account, subscription and associated quotas
• Running the AI features you trigger or enable (Numo and its routines, dictation, feedback review, Smart Fill)
• Improving the product (minimized technical measurement and persistent analytics with your consent)
• Service-related communication (updates, incidents, billing)

Legal bases

• Performance of the contract: processing the data needed to provide the service and to bill for it
• Legitimate interest: service security, abuse prevention, anonymous traffic measurement with nothing written to your device before your choice, and minimized server-side technical events that also exist without a browser (MCP, webhooks and scheduled jobs)
• Consent: analytics cookies (PostHog), which link your successive visits; collected via the consent banner and revocable at any time
• Legal obligation: retention of accounting and invoicing records

Retention periods

• Account data: kept until your account is deleted
• Work content: kept until you delete it or until your account is closed
• Notifications: deleted 6 months after being read
• Board participants: kept as long as the project that owns the board exists, and deleted with it. An identity that never posted anything; address verified, then nothing; is deleted after 90 days. Feedback set aside as junk is deleted after 30 days. You can ask the board's publisher to erase your identity at any time: the address and name go, the contributions stay online under a pseudonym
• Analytics data: 12 months maximum
• Billing data: as required by law (10 years for accounting records)

Transfers and sub-processors

Your data is hosted within the European Union (Supabase EU region, Ireland). The application is hosted by Vercel (a company based in the United States); any transfers to third countries are covered by appropriate safeguards (Standard Contractual Clauses). Data processing agreements (DPAs) are in place with our sub-processors.

Sub-processors involved: Supabase (database, storage, authentication), Vercel (application hosting), Stripe (payment), OpenRouter (AI processing), PostHog (technical usage measurement and persistent analytics with consent), Resend (transactional email).

If you choose to sign in with Google or GitHub, those services handle your authentication as independent controllers, under their own policies. If you link a GitHub or GitLab repository, access to that repository happens at your initiative and under your responsibility.

Feedback boards: minddy as a processor

When you open a public feedback board, you become the controller for the data of the people who take part in it, and minddy acts as a processor: we process that data only to provide you with the board, on your instructions.

Categories involved: verified email address, votes, published feedback and comments, and the audio of a dictated post. minddy uses them for no commercial purpose and trains no model on them. You can ask the board's publisher to erase them; minddy gives them a tool for exactly that; and they are in any case deleted along with the project that owns the board.

These contributions are processed by AI models before publication: every post is screened to set junk aside and flag what should not be made public, sorted by topic, matched against neighbouring posts, and translated into the team's language when it differs; a dictation adds the transcription of the audio. These steps go through the same providers as the rest of the service; see “AI model providers” below, whose caveat about retention applies here too. Neither the participant's email address nor their name is sent to them: only the text they wrote, or the sound of their voice.

Pull requests and Git providers

When you link a GitHub or GitLab repository, minddy reads through that provider the pull requests linked to your issues (title, description, status, checks, review conversations and code changes) to show them in minddy. Numo reads a linked pull request when a conversation or routine needs it and, when you ask, comments on it, updates its title or description, resolves review conversations, or merges it after your confirmation. To offer repository skills, minddy also reads skill files from the linked repository. minddy does not clone your repositories, run their code or push commits to them.

AI model providers

OpenRouter is not the final recipient of your content: it is a gateway. Each request is routed to the provider of the model in use; DeepSeek, Anthropic, OpenAI or Google depending on the model; which processes it on its own servers, in the United States.

Retention policies differ from one provider to the next: some keep nothing, some log requests for a limited time, some may use them to improve their models. This step is outside our control and we cannot give you any guarantee about it.

You choose the model and reasoning level for each Numo conversation. Routines use your default Numo model, and features such as Smart Fill and feedback review use the models configured for the service. If you configure your own key, compatible model calls go to your provider under your contract with them.

Usage measurement

minddy measures how the service is used with PostHog, hosted in the European Union. What we collect depends on your choice on the cookie banner, across three states:

Until you answer the banner, PostHog measures visits without storing an analytics cookie or a persistent identifier on your device. Depending on the instance configuration, a temporary identifier generated by PostHog can group anonymous visits, or the identifier lasts only for the current page load. This measurement is not linked to your account.

If you accept: a cookie is set, which lets us link your successive visits and, when you are signed in, attach them to your account so we can understand usage journeys over time.

If you decline: the browser stops all PostHog collection, anonymous or account-linked, and no analytics tracker is written to or read from your device. Server-side technical events may still be emitted to measure actions that also exist without a browser, for example through MCP, a webhook or a scheduled job.

The browser sends pageviews and performance metrics; the browser and server also send a defined catalog of technical product events. Issue content, comments, assistant messages and file names are excluded from these product events. Browser page titles and URL queries are removed before sending. Automatic click capture and session replay are disabled.

Connected third-party applications

When you authorize a third-party application (an AI assistant over MCP, for example), it receives an access token and can read and modify your account's data within the permissions granted. The list of these applications, and the ability to revoke them, lives in your account settings.

Your rights (GDPR)

Under the GDPR, you have the following rights over your data:

• Right of access
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to object
• Right to restriction of processing
• Right to lodge a complaint with a supervisory authority

To exercise these rights, write to us at hello@minddy.app. If a dispute remains unresolved, you may refer the matter to the CNIL.

Exercising your rights from the app

Two of your rights can be exercised without writing to us, from Settings → Data:

• Export your data; a JSON file with your account, projects, issues, comments and conversations. No keys or tokens are included.
• Delete your account; immediately and permanently, with no grace period.

Deleting your account also deletes the projects you own: their issues, their files and their other members' access. The confirmation screen tells you exactly what will be destroyed before you commit.

The other rights (rectification, objection, restriction) are exercised by writing to us; we reply within one month.

Data breach notification

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, along with the competent supervisory authority (CNIL), in accordance with articles 33 and 34 of the GDPR.