Privacy policy

1. Who we are

The controller of your personal data is MELLEORISE - CONSULTING & INVESTMENTS LDA, trading as "Mindcarry", NIPC 518362175, Rua Lagoa de Quiaios, nº 14, Verdizela, 2855-626 Corroios, Portugal. Contact for any privacy question or GDPR request: info@mindcarry.dev. See also the legal notice.

We are the controller for your account, security, usage and billing data, and for processing the content of your sources to provide the service to you.

Business use. If you use Mindcarry for your business and bring in personal data of other people (clients, colleagues…), you decide on that processing: we carry it out on your behalf, as a processor under Article 28 GDPR. This use is allowed only once a data processing agreement has been signed between you and us: write to info@mindcarry.dev before importing that data. Your account data, security and billing remain under our responsibility, for our own purposes.

2. The short version

• Your memory lives with you. Your pages, your memory document and your graph are markdown files in your own storage (the /Mindcarry/ folder of your Google Drive). They belong to you.
• We keep a working copy. So that your agents can search quickly, our database holds an index of your memory: the titles and full text of your compiled pages, their sections and the links between them. It can be rebuilt from your storage, but it is your content, and we protect it as such (isolated per partition, in the EU).
• Our servers and database are in the EU (Render, Frankfurt, Germany). AI processing happens at Anthropic, in the United States.
• Your content is never used to train models, neither ours nor our AI provider's. We never sell your data.
• Our logs contain identifiers, counters and durations only, never your content.
• Deleting your account immediately erases your memory on our side (index, proposals, sources, tokens). What remains, and why, is detailed below.

3. Where your data lives

• In your storage (the /Mindcarry/ folder of your Google Drive): your compiled memory, the summaries of your sources, and the raw files you give us — imported files and forwarded e-mails (with their attachments) are saved in the partition's inbox/ folder. They stay there until you delete them (for example with "Delete this document"). We only read and write that folder and the files or folders you pick.
• In our database (Render, Frankfurt): your account, your settings, the index of your memory, your proposals and your usage counters. We keep no raw copy of your documents: during a compilation the document is processed in a temporary workspace on the server, erased when the job ends.
• At our providers: see "Processors and recipients" and "International transfers".

4. Partitions and sharing

Your memory is split into partitions (for example personal and work). Each partition is isolated: its index is filtered by partition, and an agent you connect sees only the partitions you granted it. Members of a shared partition see that partition only, never your private ones. Every fact in a shared partition records who contributed it.

5. What we store

• Account: e-mail address; if you sign in with Google, your Google account identifier and name; your language; the date of your last visit and the days you used the service (to measure activity, kept 120 days). Where you came from when you signed up: the campaign label of the link you followed (a link code or a campaign name) and the site that sent you to us (its domain name only, for example news.ycombinator.com). This travels in our sign-up links; it is kept in the sign-in cookie only while you sign in (15 minutes at most), never in a tracking cookie, then stored with your account for as long as it exists. Clicks on our campaign links (mindcarry.dev/c/…) are only counted per link and per day, without any identifier: no IP address, browser or cookie is kept with the count (to avoid counting the same visitor over and over, a keyed hash of the IP address is kept for about a day, as for our other rate limits). To see how many people are on the site right now, each page you open is counted without any cookie: we keep a keyed hash of your IP address and browser that changes every day (without our server secret it cannot be turned back into the address), the kind of page (never which partition or document), your country (looked up locally from the address, which is not kept) and whether you are signed in (yes or no, never who), for 15 minutes. To understand which pages lead to a sign-up, the pages you open while signed out are also kept in order, under the same daily hash: the kind of page (never which partition or document), where the visit came from (the label of the link you followed or the domain name of the site that sent you) and whether that browser created an account that day (never which one). Once you are signed in, no page is kept any more, and the day's path of someone who already had an account is erased. These paths are never linked to your account; they are kept 30 days, then only daily totals remain. When we test two versions of the homepage, which one you see is worked out on each visit from a keyed hash of your IP address and browser, without any cookie and without keeping that hash; the letter of the version (A or B) travels in our sign-up links and is stored with the account it creates, so we can compare both versions.
• Configuration: partitions (name, description), sources and their filters, members and invitations of shared partitions, the e-mail addresses you allow to forward to Mindcarry (allowed senders). Secrets (private calendar URL, storage access tokens) are encrypted with a key specific to your account.
• Index of your memory: titles, full text, sections and links of your compiled pages, names of the graph's entities (people, projects…). It follows your storage: a deleted page or partition is deleted from the index too.
• Proposals: the text of the facts you or your agents ask to remember (remember), and your decision.
• Feedback: the message you send with "Send feedback", with its technical context (page, browser, version, recent errors) and, if you leave it ticked, a screenshot of the page.
• Usage: volume of text ingested, tokens served to agents, estimated tokens saved, per call and per month.
• Security: hashes of session and agent tokens, connected agents and their permissions, a partition access log (identifiers only), hashes of received e-mail signatures (against replay). If we ban an account for abuse, we keep a hash (HMAC) of its people's e-mail addresses and Google account identifiers, never the addresses themselves, to keep them from signing up again, including after the account is deleted, until the ban is lifted.
• Billing: your plan, the identifiers of your customer and subscriptions at Stripe, their status and renewal date, your add-on purchases. We never see or store card details.

6. Sensitive data

Health and finance partitions are not available in the hosted service. The hosted service is not designed for health data or the other special categories of data (Article 9 GDPR: health, political opinions, religious beliefs, sexual orientation, biometric data…), and we have no legal basis to process them: do not bring them in, and never those of other people.

We do not read your content and cannot filter it automatically. If a document contains some anyway:

• you can remove it yourself, at once, with "Delete this document": the document, its summary and the facts that existed only because of it are removed from your memory and from our index, and it is no longer served to your agents;
• if you tell us at info@mindcarry.dev, or if we learn of it otherwise, we delete it the same way within 72 hours and let you know; until then we use it for nothing but that deletion;
• a copy already sent to Anthropic for compilation is deleted under its retention policy (see "Processors and recipients"); what your agents already read is governed by their provider.

7. Why (legal bases)

• Performance of the contract: providing the service (account, sources, AI compilation, index, serving agents, sharing, support, billing).
• Legitimate interest: securing the service and preventing abuse (logs, rate limits, e-mail signatures), measuring activity in aggregate to run the service, choosing the display language, sending you, within 9 days of signing up, at most three e-mails to help you get started (linking your storage, plugging in your AI; never a commercial offer), depending on the steps you have not done yet. Each one has a link to stop them, without signing in, and you can turn them off or back on in Account; we only keep which of these e-mails were sent to you and when, and whether you stopped them, until your account is deleted.
• Consent: the Google Ads measurement cookies, only if you accept them (see Cookies).
• Legal obligation: accounting and tax.

8. Processors and recipients

• Render (Render Services, Inc.) — hosting of the application, background jobs and database, EU region (Frankfurt, Germany).
• Anthropic (Anthropic, PBC, United States) — AI processing of the content of your sources to compile your memory (reading documents, including images and scanned PDFs, extraction, consolidation, summaries), with the Claude Haiku model. Content is sent only for that purpose and is never used to train models: Anthropic's commercial API terms exclude training on API data, and Anthropic deletes it at the latest 30 days after the request, unless its safety systems flag it as breaching its usage policies or the law requires otherwise (Anthropic's retention policy).
• Google (Google LLC / Google Ireland Limited) — Sign in with Google (optional), the Google Drive API to read and write the /Mindcarry/ folder of your Drive and the files or folders you pick, the Google Picker, and the "Mindcarry — <partition>" Google Doc we keep up to date in your Drive for Gemini.
• Mailgun (Sinch Mailgun), EU region — sending our e-mails (sign-in links, invitations, confirmations, getting-started e-mails) and receiving the e-mails you forward to your Mindcarry address.
• Stripe — payment processing, fraud prevention and disputes. Sold through Link, LLC (Link, Stripe Managed Payments) — merchant of record for paid plans: checkout, payment, tax, receipts and subscription management. It acts as an independent controller for the payment and tax data it collects; its own privacy notice applies.
• GitHub (GitHub, Inc.) — your feedback ("Send feedback") becomes an issue in a private repository only our team can read: message, technical context, your account identifier and e-mail address, plan and optional screenshot. The screenshot is erased from our database once the issue is created.
• LWS (France) — domain names (DNS) and our mailbox (info@mindcarry.dev). If you write to us, your message is stored there.

Other recipients, at your initiative:

• The AI agents you connect (Claude, ChatGPT, Cursor…) receive the content of the partitions you granted them, when they ask for it. What they do with it is governed by their provider and its terms.
• Google Ads, only if you accept its cookies (see Cookies): when you visit our public pages or the page shown after a purchase, Google receives your IP address, browser details, the page visited, the ad you clicked and, after a purchase, its amount and currency (never your identity), as an independent controller under its own policy, to tell us how many purchases followed an ad.
• Members of your shared partitions, and their agents, see the content of those partitions and the access log.
• People you give a secret export link to read the memory of that partition. The link is off by default and only the partition owner can create it; it does not expire, but you can revoke or regenerate it at any time (the old one then stops working) and see how many times it was read. Anyone who has it can pass it on: share it like a password. It never exists for a health or finance partition.
• When you add a private calendar URL, we fetch it from the address you gave; that host is chosen by you and is not our processor.

9. International transfers

Anthropic, Google, Stripe, Link, GitHub, and the US parent companies of Render and Mailgun are based in the United States or may access data from there. These transfers rely on the European Commission's standard contractual clauses, included in each provider's data processing agreement, and, for those certified under it, on the EU–US Data Privacy Framework. You can get a copy of these safeguards by writing to info@mindcarry.dev.

10. Google user data (Limited Use)

Mindcarry's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data (your Google sign-in identity and the Drive files in the /Mindcarry/ folder or that you pick) only to provide and improve user-facing features of Mindcarry: storing, compiling and serving your memory.
• We do not transfer this data to others unless necessary to provide or improve these features (for example to our AI provider to compile your memory), to comply with the law or for security, and with your consent where required.
• We never use it for advertising, including retargeting or personalised ads, and never sell it.
• No human reads it unless you ask us to (for example for support), it is needed for security (such as investigating abuse), to comply with the law, or it is aggregated and anonymised for internal operations.
• It is never used to train generalised AI models.

11. Cookies

Strictly necessary or functional, plus Google Ads measurement only if you accept it. No analytics cookies. Google's pages (sign-in, file picker) and the checkout apply their own cookies, under their own policies.

• __Host-mindcarry_session — Keeps you signed in (only a hash is kept on our side). Lifetime: 30 days, or until you sign out.
• __Host-mindcarry_csrf — Protects forms against cross-site request forgery. Lifetime: until you close the browser.
• mindcarry_oidc — Signed, temporary state during Google sign-in or a sign-in link. Lifetime: 15 minutes.
• mindcarry_lang — Remembers the language you chose (English or French). Lifetime: 1 year.
• mindcarry_theme — Remembers the theme you chose (light or dark). Lifetime: 1 year.
• mc_consent — Remembers whether you accepted or refused Google Ads measurement. Lifetime: 6 months.

The language and theme cookies are set only when you make that choice yourself.

Google Ads measurement, only if you accept. When we advertise on Google, our public pages (home, pricing, legal pages) and the page shown after a purchase ask whether you accept it. Nothing from Google is loaded before you answer, nor if you refuse, and refusing changes nothing else on the site. If you accept, those pages load Google's tag, which sets cookies whose names start with _gcl_ (such as _gcl_au and _gcl_aw, up to 90 days) to measure whether a click on one of our ads led to a purchase, while Google's own domains (such as googleads.g.doubleclick.net) may read and write their own cookies; the page shown after a purchase tells Google that a purchase happened, with the amount paid excluding tax, its currency and an order reference only we can link back to it, never your e-mail, name, account or anything from your memory. Personalised advertising stays off. Google may process this data in the United States (EU–US Data Privacy Framework). You can change your mind at any time with the "Cookies" link at the bottom of those pages: refusing then also deletes these cookies.

12. Choosing your language (IP address)

When you have not picked a language, we show French to visitors from France and English to everyone else. To do this, your IP address is looked up in memory, at the moment of the request, in a local copy of the DB-IP "IP to Country Lite" database installed on our own servers. The IP address and the resulting country are not stored, not logged, and not sent to any third party. Legal basis: our legitimate interest in showing the site in your language. You can override the choice at any time with the language switch.

13. Retention

• Account, configuration, index, proposals, feedback, usage, access log: until you delete your account. The index of a page, document or partition you delete is erased with it.
• Activity days: 120 days.
• Visit paths (pages seen signed out, under a hash that changes every day): 30 days, then only daily totals. Visitors right now: 15 minutes.
• Temporary copies during a compilation: erased when the job ends.
• Sign-in links: 15 minutes (erased the next day). Invitations: 7 days. Unconfirmed allowed senders: erased 3 days after the link expires. E-mail signature hashes: 9 days.
• Feedback: the screenshot is erased from our database as soon as the issue is created; the issue (with its screenshot) is closed once the problem is handled, and deleted from our private GitHub repository at the latest 12 months after it is closed, or earlier on request.
• Technical logs (identifiers, counters, durations, no content): 30 days at most.
• Database backups at Render: overwritten automatically, 7 days at most.
• At Anthropic: 30 days at most by default (see above).
• Billing: sales records (detached from your account once it is deleted) are kept for the statutory accounting retention period in Portugal (10 years). Your invoices and receipts are issued and kept by the merchant of record.

14. Your rights

Under the GDPR you can access, correct, export or delete your data, object to or restrict processing, and withdraw any consent. Most of this is self-service in the dashboard (export of each partition, deleting a document, a page or the account); otherwise write to info@mindcarry.dev and we answer within one month.

You can also complain to a supervisory authority: in Portugal the CNPD – Comissão Nacional de Proteção de Dados (www.cnpd.pt), or the authority of your country (for example the CNIL in France).

15. Deleting your account

Dashboard → Account → Delete. We cancel your subscriptions at Stripe, revoke our access to your Google Drive, then immediately erase your partitions and their index, your sources, proposals, feedback, usage counters, access log, sessions, agent tokens and storage tokens. Your sources in other people's shared partitions are removed, and the facts that existed only because of them are removed from those partitions within minutes. Facts you had added there with remember are part of the owner's memory, who can delete them; what agents already read cannot be recalled.

What remains: the /Mindcarry/ folder in your storage, which is yours (we do not touch it); the billing records required by law, detached from your account; feedback issues already created in our private GitHub repository (deleted on request); and our backups (7 days at most) and technical logs (30 days at most), until they expire.

16. Changes

We will announce material changes by e-mail at least 30 days in advance.