English
MPRIVACY
Your data. Clear boundaries.
Understand what stays on your Mac, what an AI action sends, and what account, payment and support services process.
The website-enquiry provisions apply from publication. Production account and billing provisions apply when those features open. Paid checkout and public downloads are being prepared.
Production Google sign-in and Paddle checkout are not open. Before those features launch, processor location, retention, and seller details will be verified against the provider contracts and administration consoles.
1. Core principles
- Local vaults, Markdown originals, and exported files are not uploaded to a company cloud content store unless the user separately sends or shares them.
- File browsing, search, and graph rendering run on the user's computer.
- When the user starts an AI feature or separately configures the optional Codex connection, selected sources, the request, and project context needed for that request may be sent to OpenAI Codex.
- Google sign-in is used only for basic identity. MindStruo does not request Gmail or Google Drive access.
2. Purposes and information processed
Information is processed only as needed for account identity and sign-in, device and entitlement management, payment and subscription operations, security and abuse prevention, customer support, separately consented improvement research, and AI features started by the user.
Information required only by an optional feature is not collected when that feature is not used. MindStruo does not request permission to read Gmail or Google Drive content.
- Google sign-in
- Issuer, unique account identifier, verified email, name, and profile photo URL
- Device and entitlement
- Internal account ID, device ID, platform, app version, timestamps, plan, and access state
- Billing connection
- Paddle customer, transaction, subscription, and price identifiers; status, term, errors, and scheduled changes
- Billing events
- Paddle webhook ID, type, time, signature verification, processing, and error records
- Founding 100 eligibility
- A one-way SHA-256 eligibility marker made from the Google issuer and unique account identifier, Founding rank, Paddle subscription and transaction IDs, and assignment or forfeiture source and time
- Security and operations
- Request time and route, rate-limit hashes, and necessary error data
- Support
- Email, product and OS version, transaction ID, and problem description provided by the user
- Optional improvement research
- Limited technical summaries, explicitly selected analysis summaries and result ratings, purpose-specific pseudonymous identifiers, and receipt, consent, withdrawal and duplicate-prevention metadata
To improve MindStruo's usability and reliability, HUMAN & COMMUNICATIONS CO., LTD. may automatically receive feature categories, outcomes, duration ranges, error categories and counts from users who separately consent. This optional feature is distinct from improvement research sharing, in which users select material to send. Durations are ranges rather than exact execution timestamps; the server stores totals by the UTC date of receipt. These statistics contain no document or conversation content, file paths, vault/project/chat names or identifiers, account or device identifiers, or credentials.
3. Local sources and AI requests
Imported research material may be received as a private temporary file. The app verifies the file, reads it into memory, and removes the temporary source before text extraction starts. A temporary file left after an abnormal interruption is deleted after it is one hour old by the next app start or periodic cleanup. Filename, format, MIME type, size, source and extraction hashes, extracted text, and location data may remain in local app state.
A local backup may copy every ordinary file in the vault, including attachments and the hidden project ledger, and does not expire automatically. Extracted material, recovery copies, backups, personal context, and user settings may remain locally until the user runs the relevant delete or reset action. Uninstalling the app does not guarantee deletion of the local vault or all app state.
Project checkpoints, decisions, status, and next actions are stored in a continuity ledger at the dedicated local project store inside the selected local vault. The ledger is excluded from ordinary Markdown search and has no automatic expiry. The SQLite search index is derived and can be rebuilt from the ledger, so a derived-data reset alone does not delete the ledger. Vault backups may include it.
The original writing sample is neither stored nor sent to the model after local style analysis. If the user selects the personal-style option, the categorical style fingerprint stored locally may be sent as writing instructions for that document request.
Before document generation, the preflight view shows the categories, item counts, and character counts of selected evidence, project or legal context, and writing-control data. The actual generation input is captured as a snapshot in local server-process memory, and a one-time receipt valid for at most five minutes is issued for the same generation settings. Preflight alone does not send the snapshot to an external AI.
If the user activates the optional external Studio MCP connection for the current vault, Codex may use a restricted local capability to read unsaved Studio state and only the exact active-window project context, and to queue a proposal for review. Linked-project and whole-vault expansion requires a separate five-minute approval in MindStruo. The external capability cannot apply, save, delete, or export changes. Revoking the connection discards the existing capability and connection file so later calls stop. The default configuration copied by MindStruo requests approval before each enabled MCP tool call; user changes to Codex configuration may alter that behavior.
Personal context analyzes only user messages from local Codex conversations. It does not copy the full conversation into the personal-context database, but may store the conversation identifier, title and message count, a generated memory summary, and limited supporting excerpts, positions, and hashes from user messages.
The optional Work Profile is created as vault-bound local app state only when the user explicitly saves or resets it. It is not inferred from conversations or documents. Descriptions calculated from the user's direct work-style and reporting choices are not a personality or psychological diagnosis or a prediction of performance.
A Work Profile is not applied to AI requests automatically. Only when the user selects ‘apply once to this generation’ may six categorical reporting preferences—language, explanation density, information order, challenge level, uncertainty display, and option count—be included in that request. Work-style axes, the optional MBTI reference, summaries, the full profile, and the session purpose are excluded. Result feedback is a bounded local observation that stores neither source or output text nor profile values, and any resulting suggestion cannot change the profile without the user's acceptance.
A temporary Canvas copy for improvement review is off by default. If you choose it for a particular request, a review copy of that request and its generated proposal is temporarily retained on your device. This choice does not start tendency analysis or improvement research sharing. Deleting the copy or reaching its expiry does not delete the original Studio conversation or proposal history.
Tendency analysis is a separate choice. You must confirm that you are at least 18, consent to analysis, preview the text and confirm its transmission. Canvas analysis includes the request and the proposal reply and summary, but excludes operations, layout and other proposal fields. The selected text is sent to OpenAI through your signed-in Codex. Results and supporting evidence are held temporarily in the app; they are not a psychological diagnosis or an explanation or prediction of performance.
Improvement research sharing requires separate consent, explicit selection of any analysis summary and confirmation of the sharing preview. Optional result ratings are your own assessment and are sent only when the analysis component is included. This route sends limited technical and inference summaries to the central research store, excluding raw requests, conversations, proposals, evidence quotations, local paths and task identifiers. Ordinary support messages that you write and send are separate.
In-app support reports and improvement research have separate purposes and stores and use different pseudonymous identifiers. You can delete individual improvement submissions or withdraw research consent. Withdrawing only analysis sharing removes the analysis component while retaining technical summaries; withdrawing all improvement research deletes improvement content while retaining ordinary support reports. Deleting a local review copy or analysis is separate from deleting or withdrawing material already shared.
Optional Verified Engineering Pattern Packs are stored separately in vault-bound local app state. Signature verification for an external pack confirms only that the exact file bytes match the entered full key fingerprint; it does not certify the publisher's identity or the content's correctness or safety. The app does not automatically collect or synchronize packs, execute included code or commands, request included links, or merge pack content into canonical shared project knowledge.
Local license state may contain an installation device ID, account identifiers, a raw device token, a signed entitlement receipt, trusted-time state, and a pending logout token. Signing out or deleting the cloud account may leave the installation ID and trusted-time state; a full app-state reset removes the license folder.
The local server log used by the browser fallback may contain absolute vault and database paths, error messages, and stack traces, and it has no automatic expiry. It can be removed through log-derived-data deletion or a full app-state reset. A diagnostic bundle created by the user is not uploaded automatically.
If web research is approved and an adopted public URL is verified, the local app may send a direct HTTPS request to that website. The site may process the IP address, request time and URL, and the MindStruo user agent under its own policy.
Do not include passwords, full payment-card data, national identifiers, or unnecessary sensitive information in selected material or project context.
The feature is off by default. Declining does not prevent installation or use of other features. After separate consent to notice version 2026-09-27.1, counters are sent only when the receiver is available. You may withdraw in Settings at any time. Withdrawal stops future collection and transmission and removes locally queued counters. If saving the withdrawal is unconfirmed, the app tells you; you may need to check the setting again after restarting. Statistics already combined into daily totals without individual identifiers cannot be located or erased for an individual. Withdrawal does not guarantee reversal of a request already processed during transmission.
4. External providers
Each provider processes the information needed for the feature over HTTPS. Card numbers and CVCs are collected directly by Paddle Checkout and are not stored in the MindStruo database.
- Account sign-in and identity verification
- Paddle
- Payments, taxes, receipts, subscriptions, cancellations, refunds, and disputes
- Cloudflare, Inc. (processor)
- Current product-site Worker, CDN, and security operations; license, support and improvement-research services and separate stores being prepared for launch
- OpenAI Codex
- User-started AI features and project-context requests through the separately configured local connection
When you separately consent to optional anonymous usage statistics, Cloudflare-based services process counter delivery and daily aggregation.
5. Retention and deletion
After content is cleared, identifiers, hashes, receipt and expiry times, and deletion markers remain to prevent duplicate or replayed submissions until cleanup after the original expiry. Cleanup is configured every five minutes, but batch limits, preservation copying or failures may delay row deletion. These rules concern retrieval and cleanup in the operational store; existing encrypted backups are not necessarily deleted at the same time.
Separate pseudonymous consent and withdrawal metadata includes fields with no automatic expiry. Account-erasure markers become eligible for cleanup after 365 days when no linked records remain. Withdrawing analysis sharing alone clears the analysis component while retaining technical summaries.
- Desktop authentication requests
- Valid for five minutes; deleted by the next normal maintenance run after expiry
- Successfully processed billing-event body
- Minimized by the next normal maintenance run, normally scheduled about every five minutes
- Failed billing-event body
- May be retained until successful processing for an exact retry, then minimized by the next normal maintenance run. A long-running failure may remain longer until it succeeds or receives separate operational review
- Minimum billing-event metadata
- Deleted by normal maintenance after 90 days
- Account, device, and subscription-link data
- For the life of the account. Directly linked service-account data is deleted with the account; the detached billing-event ordering record, Founding ledger, and legally or dispute-required records below follow their separate retention rules
- Detached billing-event ordering record
- On account deletion, the account ID, Paddle customer ID, bootstrap transaction ID, and its event reference are removed. To prevent delayed or replayed webhooks from reconnecting a deleted billing relationship or reactivating the same terminally canceled subscription, the Paddle subscription and price IDs, final status, period and scheduled change, last-event type, ID and time, and state-freshness and redaction times remain separately for the operating life of the service. This is a pseudonymous record that may be re-identifiable when combined with Paddle data. Before sale, the representative will set its retention period, legal basis, and deletion-right limitations to match the product's actual behavior and the applicable rules of each sale territory. Independent legal review and representative approval must be completed before sales.
- Founding 100 ledger
- To prevent rank reuse and repeat assignment to the same account, an assigned rank, one-way eligibility marker, and Paddle source identifiers remain after cloud-account deletion for the operating life of the service. The raw Google account identifier is not stored in this ledger
- Checkout policy-acceptance records
- Unused records are deleted after expiry. Records consumed by checkout are retained for the life of the account and deleted with it, subject to any legal retention duty
- Contract, withdrawal, payment, and supply records
- Five years under Korean electronic-commerce law
- Consumer complaint and dispute records
- Three years under Korean electronic-commerce law
- Display and advertising records
- Six months under Korean electronic-commerce law
- General support records
- One year after the case is closed; three years where the record concerns a consumer complaint or dispute
- Local sources and app state
- Until the user runs the relevant delete or reset action
- Local Work Profile canonical record
- Until dedicated deletion or a full app-state reset. General derived-data deletion and cloud-account deletion do not remove it; an exported JSON file is separately controlled by the user
- Explicit Work Profile feedback observations
- Until dedicated feedback deletion, general derived-data deletion, or a full app-state reset. At most 512 observations are retained and older observations may be trimmed when new ones are recorded
- External engineering pattern packs and trust records
- Current content remains until that pack is removed. Rollback-prevention key pins and the highest sequence remain after removal until general derived-data deletion or a full app-state reset; the user's original file is outside app control
- Local license credentials
- The account session is deleted on sign-out or cloud-account deletion; installation ID and trusted-time state may remain until a full app-state reset
- Browser-fallback local server log
- Until log-derived-data deletion or a full app-state reset; no automatic expiry
- Project-continuity ledger
- Until the user deletes the hidden technical folder from the selected vault or deletes the vault; no automatic expiry
- Document-transmission preflight snapshot and receipt
- Held in local server memory for at most five minutes or until first use; may be removed earlier by bounded-memory cleanup or server shutdown
- External Studio MCP connection file
- Until revocation, vault change, or normal local-engine shutdown; expanded-context authorization remains valid for no more than five minutes
- Canvas improvement-review copy and analysis
- The app clears the review copy and analysis 30 minutes after request admission. The raw analysis preview lasts up to five minutes. Cleanup may be delayed while the device is asleep or app execution is suspended. Original Studio conversations and proposals are retained separately.
- In-app improvement research content
- Excluded from retrieval 180 days after receipt. Confirmed individual deletion or full research withdrawal clears the shared content in the operational store.
- In-app support report content
- Excluded from retrieval 365 days after receipt. Confirmed individual deletion clears the report content in the operational store. General email support and dispute records have separate retention rules.
- Optional anonymous usage statistics
- Optional anonymous usage-statistics daily totals: the operational aggregate table retains the most recent 30 UTC date buckets. Normal maintenance runs every five minutes to delete older totals. Outages or delayed scheduled runs may delay deletion. This aggregate retention rule replaces individual erasure for these totals. The aggregate table stores neither individual submission payloads nor individual event timestamps.
6. User rights and contact
Users may request access, correction, deletion, restriction, withdrawal of consent, and deletion of the cloud account. A privacy-rights request is accepted separately from subscription cancellation. To stop future billing, the subscription must also be canceled in the app or Paddle customer portal.
Deleting a cloud account does not delete the local vault, Markdown originals, project-continuity ledger, Work Profile, local engineering pattern packs and trust records, or downloaded outputs. The Work Profile requires its dedicated delete action or a full app-state reset; external pack and trust records require general derived-data deletion or a full app-state reset. Paddle transaction, tax, dispute, and legally required records may be retained separately. The one-way eligibility marker and minimum source record needed to prevent Founding-rank restoration, reuse, or duplicate assignment, and the detached billing-event ordering record needed to prevent reconnection or reactivation of a deleted billing relationship, remain for the retention periods above.
Before sale, the representative will set the purpose, legal basis, period, and deletion-right limitations for the Founding ledger and detached billing-event ordering record to match the product's actual behavior and the applicable rules of each sale territory. Independent legal review and representative approval must be completed before sales; MindStruo does not claim that review is complete before then. Production accounts and paid checkout will remain closed until a representative-approved privacy notice is ready.
Rights requests are accepted at privacy@mindstruo.com. Minimum information appropriate to the request may be required to verify the requester or a lawful representative.
- Privacy officer
- Representative HoonHee Jo
- Privacy requests and complaints
- privacy@mindstruo.com
- Telephone
- +82 10-3981-5924
7. Destruction and segregated retention
Personal information is destroyed without undue delay when its purpose or retention period ends. Electronic records are removed using a method intended to prevent practical recovery; any paper record is shredded or incinerated.
Records that must be retained by law are segregated from active account and support data and destroyed in the same manner when the statutory period ends. Local vaults and outputs remain under the user's control and must be removed through the applicable app reset or file-management action.
8. Current website hosting transfers and pre-sale verification
The current public product site uses the Worker, CDN, and security services of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When a visitor requests a page over HTTPS, the IP address, user agent, requested URL and path, time, and network, security, or error events may be processed continuously across Cloudflare's global network, including the United States, to deliver and cache pages, route traffic, mitigate DDoS attacks, secure the site, and diagnose failures.
MindStruo has not added advertising analytics or a separate visitor database to this product site, and Workers Logs is not enabled. Cloudflare's current DPA describes retention by the earlier of contract termination or the time processing is no longer necessary to provide the service. Actual retention for product-specific network and security logs may depend on the applicable service and operating configuration. A visitor who refuses this transfer may avoid the site and contact support@mindstruo.com instead.
Google, Paddle, and OpenAI may process information in multiple countries when their features open. Production Google sign-in and Paddle checkout are not open. Before paid sales, this policy will publish the verified recipient entity and contact, country, transferred items, purpose, timing and method, retention period, legal basis, and the method and effect of refusal based on the actual contracts and consoles.
When a user starts an AI feature through the user's own Codex account, selected material and request context are processed under the terms applicable to that OpenAI account. The user may review the transmission scope and choose not to start the AI feature.
Counters are sent over HTTPS to MindStruo and processed by Cloudflare-based services in a separate aggregate table. Network and security infrastructure may temporarily process connection metadata such as IP addresses, but neither IP addresses nor rate-limit hashes are stored in the product statistics aggregate table. Rate-limit information is not used as an account or device identifier for these counters. Cloudflare's international processing and retention of security or operational information follow the relevant policy disclosures and actual configuration. The aggregate table's retention rule is not a guarantee that every infrastructure log or recovery copy is erased within 30 days.
9. Automatic collection, safeguards, and changes
The product-introduction site does not directly set advertising-tracking cookies. Web hosting and security operations may nevertheless process IP address, user agent, request time and path, and error information temporarily. The desktop app's local API may use an HttpOnly, SameSite security cookie to verify that a request came from the same computer, and the checkout handoff may use a strictly necessary security cookie for up to ten minutes to protect a one-time handoff value. These cookies are not used for advertising or cross-site tracking. Local app settings and recovery information are not browser advertising identifiers.
When the user checks for updates, the operating system, architecture, update channel, current version, a Windows updater request identifier, and IP or HTTP metadata may be processed by the Cloudflare-based update service. The app does not store this information in a separate database, and observability logs and tracing are disabled for the update service.
The service uses transport encryption, hashed authentication state and tokens, billing-event signature verification, rate limits, least privilege, and data minimization. The continuity ledger's hash chain detects integrity breaks; it is not encryption of the ledger contents. The service does not promise app-level encryption of every local file or automatic detection of every sensitive value.
Material changes to purposes, providers, or retention will be posted here with an effective date. Separate consent will be requested when required.
Contact forms on this website
Form text stays in the current browser page. This HTML does not automatically submit or store it on a server. You review and send the draft from your email app. Refreshing clears unsent text. No advertising or analytics tools are included.