Privacy Policy

The apps: your notes stay with you

The MindLake apps for Mac and iPhone record and transcribe meetings entirely on your device, using on-device speech recognition. Audio, transcripts and notes are written to a Markdown vault stored locally and, if you enable sync, in your own iCloud Drive under your Apple account. None of this content is sent to our servers unless you choose Mindlake Sync (below), and even then we cannot read it. The apps contain no third-party advertising or tracking SDKs and no analytics of any kind. If the app closes unexpectedly it writes a report to a folder on your own machine, which is never uploaded and which you can read or delete yourself.

AI features, and where your words go

Summaries, chat and AI editing are optional, and they are the main part of MindLake that can send your writing anywhere. Nothing is sent to an AI provider until you connect one, either with your own key or by pointing MindLake at an AI agent installed on your Mac. Once you have, AI features, including ones that run in the background such as titling a new note, can send the note or transcript involved from your device directly to that provider so that it can answer. A summary sent this way also carries the note’s title, type and people, the meeting’s date, your name from Settings ▸ Brain if you have set one, and up to 600 characters of the Summaries part of the memory.txt file in your vault, so that it can say who agreed to what and by when. We never receive it, cannot access it, and store none of it: what happens to it there is governed by that provider’s own terms and privacy policy, and your relationship is with them. Recording and transcription never use a cloud provider, and the iPhone app has no AI features.

Finding sources on the web

Finding sources for a topic is the one feature built to search the web, and it only runs when you ask it to. The searches it writes from your topic go to the search services you have switched on (Wikipedia, OpenAlex, Hacker News and Stack Overflow unless you change them, and any others you add a key for), and the pages it shortlists are then downloaded from their own sites. Those services see the searches and your IP address, as with any web request. If AI features are on and the assistant uses an AI provider you have connected, that provider also receives what it needs for the job: your topic; the titles of up to five of your notes that match it, so that it can search in your own words; the title and a short excerpt of each search result, so that it can choose the best; and up to about 6,000 characters of each page it shortlists, so that it can say why that page answers your topic. Finding more like a source you already have also sends up to about 4,000 characters of that source’s text, so that the provider can name its subject. If the assistant is set to a model on your Mac, all of this stays on your Mac, and with AI features off the feature runs as a plain search that sends nothing to an AI provider.

Web addresses in your notes

If a note references an image by web address, displaying that note fetches it from wherever it is hosted. Web links in a note show the site’s icon, fetched once per site, and pasting a bare link fetches that page’s title to label it; both can be switched off in Settings. Each of these tells the site concerned your IP address in the way any web request does. Images kept in your own vault are read from disk and involve no network at all.

Downloads the app makes

The Mac app checks for updates by fetching a small file from GitHub, where its releases are published, and speech models and voices are downloaded once, the first time you use the feature that needs them. When a note shows a diagram or a mathematical formula, the code that draws it is loaded from jsDelivr, a public code library. These requests identify the file being fetched and your IP address, and carry nothing about you or your notes: the diagram or formula itself is drawn on your device.

Recordings and other people

Recordings you make may capture other participants in your meetings. For MindLake, that data never leaves your device, so you (not we) are responsible for it: please make sure you have any consent required in your jurisdiction before recording. See our Terms for more.

Your trial and licence

To run the 14-day free trial and your licence, the Mac app checks in with our servers when the trial starts, every few days while it runs, and about once a month after you buy. Each check sends a one-way hash of your Mac’s hardware identifier (we cannot turn it back into the identifier, and use it for nothing else), the app’s version and, if you are signed in, your account token. For each Mac we keep that hash, when we first and last saw it, the app version, and which account it is licensed to. This is what limits the trial to once per Mac and a licence to three Macs. When you take your licence off a Mac we also note when, because a licence can move between Macs three times in 30 days. It never includes your notes or anything about them.

Your email at download

Before the Mac download starts, we ask for your email address. It is optional: skip it and the download starts anyway. If you leave it, we keep the address, the page you were on and the date, and use it only to ask how MindLake is working for you and to tell you about releases. Our basis is your consent, which you give by typing your address in. You can withdraw it at any time with the unsubscribe link in every email or by writing to us, and we then delete the address. We do not sell it or share it, and it is held by our email provider only so that it can send the messages for us.

Your account

Buying MindLake, publishing and Mindlake Sync are the parts of MindLake that have an account. You sign in from the app with your email address: we send a one-time code to it, and signing in the first time creates an account holding that address and a handle for your pages. Each Mac you sign in on is given its own token, labelled with the Mac’s name, which we store only as a hash and which signing out revokes. We keep no password and no browser session for your account. The one exception is a reader of a folder someone publishes behind a sign-in, described under Notes you publish.

Notes you publish

Publishing is a Mac feature and is never automatic. When you publish a note, its title, content, settings and any pictures it shows are sent to our servers so we can render it at a public web address, and they stay there, where we can access them, until you unpublish it, which removes it from the web immediately. If you password-protect a note, the password is stored only as a salted, peppered hash (never in plain text), and the note’s text is withheld until the correct password is entered. Its pictures are kept at addresses that cannot be guessed without already having the picture, but are not themselves behind the password.

A folder can be published behind a sign-in. The person publishing it adds each reader by email address, and we generate that reader a password, stored only as a salted, peppered hash (never in plain text). We keep the address, when it was added and when it last signed in, so that a reader can be signed in, signed out and removed. Until a reader is signed in, none of the folder’s text, titles or index is shown. A reader can change their own password; the publisher can reset it or remove them, which ends their sessions at once, and taking the folder down deletes its notes and its readers. On the folder’s pages its pictures are shown only to a signed-in reader, but the picture files themselves are not behind the sign-in: each sits at an address that cannot be guessed and that the pages do not show, yet anyone who is given that exact address can open the file, and a Markdown download of a note includes it.

Mindlake Sync

Mindlake Sync is an optional subscription that keeps your vaults in step across your devices without iCloud. Before anything leaves your device, the vault’s name and every file’s path and contents are encrypted with a key that reaches us only locked by your sync password, which we never receive, so we cannot read them. What we can see is which account each vault belongs to, how many files it holds and their sizes, when each one changed, and the name of the device that changed it. The encrypted files are stored with Cloudflare R2 in its EU jurisdiction, and the rest in our database. We keep each file’s earlier versions for 12 months, so you can go back to them. If your subscription ends, we keep your vaults for at least 30 days so you can resubscribe or download them. You can ask us to delete them at any time.

Buying MindLake and Pro

If you buy MindLake, Pro or Mindlake Sync, the sale is made by Paddle, our reseller and merchant of record, which collects your payment details and billing address under its own privacy policy. We never see your card. We receive the email address you paid with and what you bought (your licence, and for a subscription whether it is active and when it renews), and link it to the account with that address so that it works.

The waitlist

If you joined the waitlist we store the email address you provided, together with which page you signed up from, so we can contact you about access and launch. We do not sell it, share it, or use it for anything else, and we delete it on request.

Security and server logs

To protect the service, our servers keep short-lived rate-limit counters keyed by IP address and, for sign-in codes, by email address (pruned within roughly 24 hours) and standard request logs retained briefly by our hosting provider. We use these solely for security and abuse prevention.

Cookies and analytics

Who processes data for us

We use four processors: Supabase (database hosting for accounts, licences, waitlist and download emails, published notes and their pictures, Mindlake Sync’s records, rate-limit counters and the cookie consent log, and sign-in), Vercel (site hosting and analytics), Resend (sending sign-in codes and the emails after a download) and Cloudflare (storing Mindlake Sync’s encrypted files, in its EU jurisdiction). They may process data on servers outside the UK, including in the United States, under standard contractual safeguards. Paddle, when you buy MindLake, Pro or Mindlake Sync, acts for itself as the seller, not for us.

Legal bases and retention

We rely on consent for the waitlist and the emails after a download (withdraw any time by asking to be removed or with the unsubscribe link), performance of a contract for your trial, licence, account, publishing and subscriptions (we cannot run them, host your note, or honour what you bought, without the data above), legal obligation for the log of your cookie choices (the law requires us to be able to show what you agreed to), and legitimate interests for security measures such as rate limiting and for counting visits with Vercel Web Analytics. Waitlist entries are kept until launch or until you ask us to delete them; addresses left at download until you unsubscribe; publishing accounts until you ask us to close them; published notes until you unpublish them; Mindlake Sync vaults as described above; the cookie consent log for two years; security counters expire automatically.

Your rights

Under UK data protection law you can ask us for a copy of your personal data, ask us to correct or delete it, object to or restrict our processing, and ask for it in a portable format. Email kyle@goodanalysis.co.uk and we will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk).

Changes

If we change this policy we will update this page and the date above. If a change meaningfully affects data we already hold about you (for example, waitlist emails), we will email you first.

Contact

Questions about privacy? Email kyle@goodanalysis.co.uk.