Privacy policy

1. Who is responsible

The controller of your personal data is Martin Vichnál, Budapest, Hungary (“we”, “us”). Write to [email protected] about anything in this policy. We have not appointed a data protection officer because the law does not require one for a service of this size; the email address above reaches the person responsible.

2. What we handle and why

We only handle data for a clear reason, and each reason has a legal basis under Article 6 of the GDPR. “Contract” means it is needed to give you the service you signed up for (Art. 6(1)(b)); “consent” means you agreed and can take it back at any time (Art. 6(1)(a)); “legitimate interest” means a reasonable interest of ours or yours that does not override your rights (Art. 6(1)(f)); “legal obligation” means a law requires it (Art. 6(1)(c)).

We do not use your data for advertising, we do not sell or rent it, and we do not build profiles of you for anyone else. MindWren does not take decisions about you that have legal or similarly significant effects by automated means alone (Art. 22 GDPR).

3. Information about other people

Your mail, calendar and notes naturally mention other people: who wrote to you, who you meet, who owes you a reply. MindWren handles that information only to run your assistant for you, keeps it private to your account, and never contacts those people. If you are such a person and want to exercise your rights, write to [email protected]; we will help as far as we can without reading into someone else's account more than needed. The legal basis is our and our user's legitimate interest in managing their own correspondence and appointments (Art. 6(1)(f)); for information we did not get from you, this section is the notice under Article 14 of the GDPR.

4. How MindWren uses AI

MindWren is an AI system. When you talk to it in the app, on Telegram or by email, you are talking to an AI, not a person, and its replies, briefs, summaries and the tasks and notes it files are generated by AI. It runs on Claude, a model by Anthropic (currently Claude Haiku), used through Anthropic's commercial API.

What it does: files what you tell it, reads new mail and decides what it means, reads pictures you send (such as a screenshot of a calendar), answers questions about your tasks, notes, projects and calendar, and writes your briefs and project summaries. When you correct it, it remembers for next time; that learning stays in your account and does not change the model.

What it sees: for each item, MindWren sends the AI that item and a short, relevant extract of your tasks, notes, projects and calendar, usually titles and summaries. It does not send your whole account.

• Anything you mark as kept away from the AI (projects, calendars, repositories, mail senders) is left out first, also for AI apps you connect.
• Under its commercial terms, Anthropic does not use this data to train its models, and deletes it within 30 days, unless it is flagged under its usage policy or the law requires longer.
• We do not use your data to train or fine-tune any AI model ourselves.

What you control: under Settings, “What MindWren may do”, each kind of change can be set to Do it, Ask me first, or Never, for MindWren and for every AI app you connect. Every action is recorded in Activity, and most can be undone.

Its limits: it can misunderstand, pick the wrong project or date, or state something wrong with confidence. Check important facts, dates, amounts and commitments. It gives no legal, medical or financial advice and makes no decisions about you with legal or similarly significant effects.

5. Google user data and the Limited Use requirements

Signing in with Google gives MindWren only your name, email address and profile picture (openid, email, profile). When you connect Gmail or Google Calendar, MindWren asks Google for these permissions only:

• gmail.readonly: to read your mail. MindWren cannot send, delete or change mail.
• calendar.events and calendar.calendarlist.readonly: to read your events and calendars, and to add, move or cancel events when you ask.

MindWren's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the features you see in MindWren (filing mail into tasks, notes and waiting-fors; showing and changing your calendar).
• We transfer it to others only as needed to provide those features (the AI model described above, and our server and database providers), to comply with the law, or as part of a merger or sale with the same protections.
• We do not use it for advertising, we do not sell it, and we do not use it to determine creditworthiness or for lending.
• No person reads your Google data, unless you ask us to (for example for support and with your agreement), it is needed for security or to investigate abuse, or the law requires it.
• We do not use Google user data, and do not let anyone use it, to develop, improve or train generalized or non-personalized AI or machine-learning models.

You can disconnect Google at any time in MindWren under Plugins, and remove MindWren's access in your Google Account under Security, Third-party connections. Disconnecting deletes the mail and calendar copies MindWren keeps; tasks and notes made from them stay until you delete them.

6. Who else handles your data

These companies help us run MindWren and handle data on our behalf, under data processing agreements that bind them to our instructions and to keeping it safe. We update this list before adding a new one.

Services you connect yourself (Google, Telegram, GitHub, calendar links, and AI apps such as Claude, ChatGPT, Codex or Claude Code) are separate companies under your own agreement with them. Data flows between them and MindWren only because you connected them, and stops when you disconnect.

We disclose data to authorities only when the law obliges us to, and we check each request.

7. Data outside the EU

Our database is located in EU, West (Ireland). Some providers, such as Anthropic and Cloudflare, are based in the United States or process data there. Where data leaves the European Economic Area, it is protected by an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified companies) or by the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

8. How long we keep it

• Your account and everything in it: for as long as you have an account. You can delete single items at any time.
• When you delete your account: your data is deleted from the live database within 30 days. Encrypted backup copies are overwritten within a further 60 days at most.
• Mail and calendar copies: while the connection is on. Disconnecting deletes them.
• Telegram and GitHub: the stored chat ID, Telegram name, bot token and GitHub items are deleted when you disconnect.
• Early-access list: until you are invited and have made an account, until you ask us to remove you, or at most 2 years.
• Server logs: up to 30 days, unless needed longer to investigate a specific security incident.
• Billing records and invoices: 8 years, as Hungarian accounting law requires (Act C of 2000, Section 169).
• Complaints: 5 years, as Hungarian consumer protection law requires.
• At the AI provider: up to 30 days, as described above.

9. Your rights

Under the GDPR you can ask us, free of charge:

• Access: what data we hold about you, and a copy of it.
• Correction: to fix data that is wrong or incomplete. Most of it you can edit yourself in MindWren.
• Deletion: to delete your data. You can delete items yourself, and deleting your account deletes the rest.
• Restriction: to pause the use of your data while a question about it is being settled.
• Portability: your data in a common machine-readable format (JSON), to take elsewhere.
• Objection: to object to use based on legitimate interest. We then stop unless we have compelling reasons that override yours.
• Withdraw consent: where we rely on consent (the early-access list), at any time, without affecting what happened before.

Write to [email protected] from the address on your account. We answer within one month (extendable by two more months for complex requests, in which case we tell you why). We may ask you to confirm your identity.

Many controls are built in: “What MindWren may do” and “Kept away from the AI” in Settings, Switch off for every connected app and plugin, and Undo in Activity.

10. Complaining to the authority

If you think we handle your data unlawfully, please tell us first so we can fix it. You also have the right to complain to a data protection authority, in particular in the EU country where you live or work, or to go to court. In Hungary the authority is:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
1055 Budapest, Falk Miksa utca 9–11.
Postal: 1363 Budapest, Pf. 9.
Phone: +36 1 391 1400 · naih.hu · [email protected]

In Hungary you can bring a court case before the regional court (törvényszék) of your home or of our seat.

11. How we keep it safe

• All connections are encrypted (HTTPS/TLS).
• Tokens for the services you connect are encrypted (AES-256) before they are stored; keys for AI apps are stored only as secure hashes.
• Each account's data is kept separate in the database, and every action taken on it, by you, MindWren or a connected app, is recorded in the activity log.
• Access to the servers and database is limited to the operator and protected by strong authentication.
• If a breach puts your rights at risk, we notify the authority within 72 hours and tell you without undue delay.

12. Children

MindWren is not meant for children. You must be at least 16 to use it. If we learn that someone younger has an account, we delete it.

13. Cookies

The website keeps only what it needs to work. No advertising or tracking cookies, no analytics, so there is nothing to agree to (EU ePrivacy Directive Art. 5(3); in Hungary Act C of 2003, Section 155(4)).

You can delete these in your browser settings at any time; you will then be signed out.

14. Changes to this policy

When we change this policy, we update the date at the top. If a change matters for how your data is used, we tell you in the app or by email before it takes effect. Earlier versions are available on request.