MPRIVACY

Your data. Clear boundaries.

Understand what stays on your Mac, what an AI action sends, and what account, payment and support services process.

Pre-launch policy

The website-enquiry provisions apply from publication. Production account and billing provisions apply when those features open. Paid checkout and public downloads are being prepared.

Production Google sign-in and Paddle checkout are not open. Before those features launch, processor location, retention, and seller details will be verified against the provider contracts and administration consoles.

1. Core principles

  • Local vaults, Markdown originals, and exported files are not uploaded to a company cloud content store unless the user separately sends or shares them.
  • File browsing, search, and graph rendering run on the user's computer.
  • When the user starts an AI feature or separately configures the optional Codex connection, selected sources, the request, and project context needed for that request may be sent to OpenAI Codex.
  • Google sign-in is used only for basic identity. MindStruo does not request Gmail or Google Drive access.

2. Purposes and information processed

Information is processed only as needed for account identity and sign-in, device and entitlement management, payment and subscription operations, security and abuse prevention, customer support, separately consented improvement research, and AI features started by the user.

Information required only by an optional feature is not collected when that feature is not used. MindStruo does not request permission to read Gmail or Google Drive content.

Google sign-in
Issuer, unique account identifier, verified email, name, and profile photo URL
Device and entitlement
Internal account ID, device ID, platform, app version, timestamps, plan, and access state
Billing connection
Paddle customer, transaction, subscription, and price identifiers; status, term, errors, and scheduled changes
Billing events
Paddle webhook ID, type, time, signature verification, processing, and error records
Founding 100 eligibility
A one-way SHA-256 eligibility marker made from the Google issuer and unique account identifier, Founding rank, Paddle subscription and transaction IDs, and assignment or forfeiture source and time
Security and operations
Request time and route, rate-limit hashes, and necessary error data
Support
Email, product and OS version, transaction ID, and problem description provided by the user
Optional improvement research
Limited technical summaries, explicitly selected analysis summaries and result ratings, purpose-specific pseudonymous identifiers, and receipt, consent, withdrawal and duplicate-prevention metadata

3. Local sources and AI requests

Imported research material may be received as a private temporary file. The app verifies the file, reads it into memory, and removes the temporary source before text extraction starts. A temporary file left after an abnormal interruption is deleted after it is one hour old by the next app start or periodic cleanup. Filename, format, MIME type, size, source and extraction hashes, extracted text, and location data may remain in local app state.

A local backup may copy every ordinary file in the vault, including attachments and the hidden project ledger, and does not expire automatically. Extracted material, recovery copies, backups, personal context, and user settings may remain locally until the user runs the relevant delete or reset action. Uninstalling the app does not guarantee deletion of the local vault or all app state.

Project checkpoints, decisions, status, and next actions are stored in a continuity ledger at the dedicated local project store inside the selected local vault. The ledger is excluded from ordinary Markdown search and has no automatic expiry. The SQLite search index is derived and can be rebuilt from the ledger, so a derived-data reset alone does not delete the ledger. Vault backups may include it.

The original writing sample is neither stored nor sent to the model after local style analysis. If the user selects the personal-style option, the categorical style fingerprint stored locally may be sent as writing instructions for that document request.

Before document generation, the preflight view shows the categories, item counts, and character counts of selected evidence, project or legal context, and writing-control data. The actual generation input is captured as a snapshot in local server-process memory, and a one-time receipt valid for at most five minutes is issued for the same generation settings. Preflight alone does not send the snapshot to an external AI.

If the user activates the optional external Studio MCP connection for the current vault, Codex may use a restricted local capability to read unsaved Studio state and only the exact active-window project context, and to queue a proposal for review. Linked-project and whole-vault expansion requires a separate five-minute approval in MindStruo. The external capability cannot apply, save, delete, or export changes. Revoking the connection discards the existing capability and connection file so later calls stop. The default configuration copied by MindStruo requests approval before each enabled MCP tool call; user changes to Codex configuration may alter that behavior.

Personal context analyzes only user messages from local Codex conversations. It does not copy the full conversation into the personal-context database, but may store the conversation identifier, title and message count, a generated memory summary, and limited supporting excerpts, positions, and hashes from user messages.

The optional Work Profile is created as vault-bound local app state only when the user explicitly saves or resets it. It is not inferred from conversations or documents. Descriptions calculated from the user's direct work-style and reporting choices are not a personality or psychological diagnosis or a prediction of performance.

A Work Profile is not applied to AI requests automatically. Only when the user selects ‘apply once to this generation’ may six categorical reporting preferences—language, explanation density, information order, challenge level, uncertainty display, and option count—be included in that request. Work-style axes, the optional MBTI reference, summaries, the full profile, and the session purpose are excluded. Result feedback is a bounded local observation that stores neither source or output text nor profile values, and any resulting suggestion cannot change the profile without the user's acceptance.

A temporary Canvas copy for improvement review is off by default. If you choose it for a particular request, a review copy of that request and its generated proposal is temporarily retained on your device. This choice does not start tendency analysis or improvement research sharing. Deleting the copy or reaching its expiry does not delete the original Studio conversation or proposal history.

Tendency analysis is a separate choice. You must confirm that you are at least 18, consent to analysis, preview the text and confirm its transmission. Canvas analysis includes the request and the proposal reply and summary, but excludes operations, layout and other proposal fields. The selected text is sent to OpenAI through your signed-in Codex. Results and supporting evidence are held temporarily in the app; they are not a psychological diagnosis or an explanation or prediction of performance.

Improvement research sharing requires separate consent, explicit selection of any analysis summary and confirmation of the sharing preview. Optional result ratings are your own assessment and are sent only when the analysis component is included. This route sends limited technical and inference summaries to the central research store, excluding raw requests, conversations, proposals, evidence quotations, local paths and task identifiers. Ordinary support messages that you write and send are separate.

In-app support reports and improvement research have separate purposes and stores and use different pseudonymous identifiers. You can delete individual improvement submissions or withdraw research consent. Withdrawing only analysis sharing removes the analysis component while retaining technical summaries; withdrawing all improvement research deletes improvement content while retaining ordinary support reports. Deleting a local review copy or analysis is separate from deleting or withdrawing material already shared.

Optional Verified Engineering Pattern Packs are stored separately in vault-bound local app state. Signature verification for an external pack confirms only that the exact file bytes match the entered full key fingerprint; it does not certify the publisher's identity or the content's correctness or safety. The app does not automatically collect or synchronize packs, execute included code or commands, request included links, or merge pack content into canonical shared project knowledge.

Local license state may contain an installation device ID, account identifiers, a raw device token, a signed entitlement receipt, trusted-time state, and a pending logout token. Signing out or deleting the cloud account may leave the installation ID and trusted-time state; a full app-state reset removes the license folder.

The local server log used by the browser fallback may contain absolute vault and database paths, error messages, and stack traces, and it has no automatic expiry. It can be removed through log-derived-data deletion or a full app-state reset. A diagnostic bundle created by the user is not uploaded automatically.

If web research is approved and an adopted public URL is verified, the local app may send a direct HTTPS request to that website. The site may process the IP address, request time and URL, and the MindStruo user agent under its own policy.

Do not include passwords, full payment-card data, national identifiers, or unnecessary sensitive information in selected material or project context.

4. External providers

Each provider processes the information needed for the feature over HTTPS. Card numbers and CVCs are collected directly by Paddle Checkout and are not stored in the MindStruo database.

Google
Account sign-in and identity verification
Paddle
Payments, taxes, receipts, subscriptions, cancellations, refunds, and disputes
Cloudflare, Inc. (processor)
Current product-site Worker, CDN, and security operations; license, support and improvement-research services and separate stores being prepared for launch
OpenAI Codex
User-started AI features and project-context requests through the separately configured local connection

5. Retention and deletion

After content is cleared, identifiers, hashes, receipt and expiry times, and deletion markers remain to prevent duplicate or replayed submissions until cleanup after the original expiry. Cleanup is configured every five minutes, but batch limits, preservation copying or failures may delay row deletion. These rules concern retrieval and cleanup in the operational store; existing encrypted backups are not necessarily deleted at the same time.

Separate pseudonymous consent and withdrawal metadata includes fields with no automatic expiry. Account-erasure markers become eligible for cleanup after 365 days when no linked records remain. Withdrawing analysis sharing alone clears the analysis component while retaining technical summaries.

Desktop authentication requests
Valid for five minutes; deleted by the next normal maintenance run after expiry
Successfully processed billing-event body
Minimized by the next normal maintenance run, normally scheduled about every five minutes
Failed billing-event body
May be retained until successful processing for an exact retry, then minimized by the next normal maintenance run. A long-running failure may remain longer until it succeeds or receives separate operational review
Minimum billing-event metadata
Deleted by normal maintenance after 90 days
Account, device, and subscription-link data
For the life of the account. Directly linked service-account data is deleted with the account; the detached billing-event ordering record, Founding ledger, and legally or dispute-required records below follow their separate retention rules
Detached billing-event ordering record
On account deletion, the account ID, Paddle customer ID, bootstrap transaction ID, and its event reference are removed. To prevent delayed or replayed webhooks from reconnecting a deleted billing relationship or reactivating the same terminally canceled subscription, the Paddle subscription and price IDs, final status, period and scheduled change, last-event type, ID and time, and state-freshness and redaction times remain separately for the operating life of the service. This is a pseudonymous record that may be re-identifiable when combined with Paddle data. Before sale, the representative will set its retention period, legal basis, and deletion-right limitations to match the product's actual behavior and the applicable rules of each sale territory. Independent legal review and representative approval must be completed before sales.
Founding 100 ledger
To prevent rank reuse and repeat assignment to the same account, an assigned rank, one-way eligibility marker, and Paddle source identifiers remain after cloud-account deletion for the operating life of the service. The raw Google account identifier is not stored in this ledger
Checkout policy-acceptance records
Unused records are deleted after expiry. Records consumed by checkout are retained for the life of the account and deleted with it, subject to any legal retention duty
Contract, withdrawal, payment, and supply records
Five years under Korean electronic-commerce law
Consumer complaint and dispute records
Three years under Korean electronic-commerce law
Display and advertising records
Six months under Korean electronic-commerce law
General support records
One year after the case is closed; three years where the record concerns a consumer complaint or dispute
Local sources and app state
Until the user runs the relevant delete or reset action
Local Work Profile canonical record
Until dedicated deletion or a full app-state reset. General derived-data deletion and cloud-account deletion do not remove it; an exported JSON file is separately controlled by the user
Explicit Work Profile feedback observations
Until dedicated feedback deletion, general derived-data deletion, or a full app-state reset. At most 512 observations are retained and older observations may be trimmed when new ones are recorded
External engineering pattern packs and trust records
Current content remains until that pack is removed. Rollback-prevention key pins and the highest sequence remain after removal until general derived-data deletion or a full app-state reset; the user's original file is outside app control
Local license credentials
The account session is deleted on sign-out or cloud-account deletion; installation ID and trusted-time state may remain until a full app-state reset
Browser-fallback local server log
Until log-derived-data deletion or a full app-state reset; no automatic expiry
Project-continuity ledger
Until the user deletes the hidden technical folder from the selected vault or deletes the vault; no automatic expiry
Document-transmission preflight snapshot and receipt
Held in local server memory for at most five minutes or until first use; may be removed earlier by bounded-memory cleanup or server shutdown
External Studio MCP connection file
Until revocation, vault change, or normal local-engine shutdown; expanded-context authorization remains valid for no more than five minutes
Canvas improvement-review copy and analysis
The app clears the review copy and analysis 30 minutes after request admission. The raw analysis preview lasts up to five minutes. Cleanup may be delayed while the device is asleep or app execution is suspended. Original Studio conversations and proposals are retained separately.
In-app improvement research content
Excluded from retrieval 180 days after receipt. Confirmed individual deletion or full research withdrawal clears the shared content in the operational store.
In-app support report content
Excluded from retrieval 365 days after receipt. Confirmed individual deletion clears the report content in the operational store. General email support and dispute records have separate retention rules.

6. User rights and contact

Users may request access, correction, deletion, restriction, withdrawal of consent, and deletion of the cloud account. A privacy-rights request is accepted separately from subscription cancellation. To stop future billing, the subscription must also be canceled in the app or Paddle customer portal.

Deleting a cloud account does not delete the local vault, Markdown originals, project-continuity ledger, Work Profile, local engineering pattern packs and trust records, or downloaded outputs. The Work Profile requires its dedicated delete action or a full app-state reset; external pack and trust records require general derived-data deletion or a full app-state reset. Paddle transaction, tax, dispute, and legally required records may be retained separately. The one-way eligibility marker and minimum source record needed to prevent Founding-rank restoration, reuse, or duplicate assignment, and the detached billing-event ordering record needed to prevent reconnection or reactivation of a deleted billing relationship, remain for the retention periods above.

Before sale, the representative will set the purpose, legal basis, period, and deletion-right limitations for the Founding ledger and detached billing-event ordering record to match the product's actual behavior and the applicable rules of each sale territory. Independent legal review and representative approval must be completed before sales; MindStruo does not claim that review is complete before then. Production accounts and paid checkout will remain closed until a representative-approved privacy notice is ready.

Rights requests are accepted at privacy@mindstruo.com. Minimum information appropriate to the request may be required to verify the requester or a lawful representative.

Privacy officer
Representative HoonHee Jo
Privacy requests and complaints
privacy@mindstruo.com
Telephone
+82 10-3981-5924

7. Destruction and segregated retention

Personal information is destroyed without undue delay when its purpose or retention period ends. Electronic records are removed using a method intended to prevent practical recovery; any paper record is shredded or incinerated.

Records that must be retained by law are segregated from active account and support data and destroyed in the same manner when the statutory period ends. Local vaults and outputs remain under the user's control and must be removed through the applicable app reset or file-management action.

8. Current website hosting transfers and pre-sale verification

The current public product site uses the Worker, CDN, and security services of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. When a visitor requests a page over HTTPS, the IP address, user agent, requested URL and path, time, and network, security, or error events may be processed continuously across Cloudflare's global network, including the United States, to deliver and cache pages, route traffic, mitigate DDoS attacks, secure the site, and diagnose failures.

MindStruo has not added advertising analytics or a separate visitor database to this product site, and Workers Logs is not enabled. Cloudflare's current DPA describes retention by the earlier of contract termination or the time processing is no longer necessary to provide the service. Actual retention for product-specific network and security logs may depend on the applicable service and operating configuration. A visitor who refuses this transfer may avoid the site and contact support@mindstruo.com instead.

Google, Paddle, and OpenAI may process information in multiple countries when their features open. Production Google sign-in and Paddle checkout are not open. Before paid sales, this policy will publish the verified recipient entity and contact, country, transferred items, purpose, timing and method, retention period, legal basis, and the method and effect of refusal based on the actual contracts and consoles.

When a user starts an AI feature through the user's own Codex account, selected material and request context are processed under the terms applicable to that OpenAI account. The user may review the transmission scope and choose not to start the AI feature.

9. Automatic collection, safeguards, and changes

The product-introduction site does not directly set advertising-tracking cookies. Web hosting and security operations may nevertheless process IP address, user agent, request time and path, and error information temporarily. The desktop app's local API may use an HttpOnly, SameSite security cookie to verify that a request came from the same computer, and the checkout handoff may use a strictly necessary security cookie for up to ten minutes to protect a one-time handoff value. These cookies are not used for advertising or cross-site tracking. Local app settings and recovery information are not browser advertising identifiers.

When the user checks for updates, the operating system, architecture, update channel, current version, a Windows updater request identifier, and IP or HTTP metadata may be processed by the Cloudflare-based update service. The app does not store this information in a separate database, and observability logs and tracing are disabled for the update service.

The service uses transport encryption, hashed authentication state and tokens, billing-event signature verification, rate limits, least privilege, and data minimization. The continuity ledger's hash chain detects integrity breaks; it is not encryption of the ledger contents. The service does not promise app-level encryption of every local file or automatic detection of every sensitive value.

Material changes to purposes, providers, or retention will be posted here with an effective date. Separate consent will be requested when required.

Contact forms on this website

Form text stays in the current browser page. This HTML does not automatically submit or store it on a server. You review and send the draft from your email app. Refreshing clears unsent text. No advertising or analytics tools are included.

프로젝트 이어가기

Actual app capture · September 20, 2026 · Example data

WHY I BUILT MINDSTRUO

I wanted to build a small app. I ended up building a way to keep going.

In early 2026, ChatGPT and Gemini made me curious about what I could build. I was impressed, but longer, more complicated work still felt difficult. After hearing about vibe coding on YouTube, I wanted to try making a calendar app or a small game.

I barely knew where to start. I pasted AI-generated code into development tools and brought the errors back to the chat. Getting something to run took time. Getting it to run didn't mean it worked well.

I later experimented with more autonomous coding setups, including OpenHands. A different problem became clearer: I kept explaining past decisions, failed approaches, and unfinished work. I started exploring how that context could carry into the next task.

For a while, the coding models in my setup still felt like the larger bottleneck, and I stepped back. Codex was the turning point for me. I found it easier to finish real tasks, so I returned to those earlier experiments and developed them around a Codex workflow.

I didn't want starting the next conversation to mean rebuilding the whole project.

That work became MindStruo. Using it made the connection between decisions, evidence, reviewed results, and next steps increasingly clear. There is still a lot I want to improve and build on this foundation.

Now I want to know whether it helps people who work differently from me. That's why I want to hear about the useful moments, the frustrating ones, and the experience that didn't match what you expected.

MAKE MINDSTRUO MORE USEFUL

사용 경험을 들려주세요.

One concrete experience is enough.

Your message is not stored on a server or sent automatically. Review it in your email app before sending. Do not include passwords, API keys, or sensitive source content.