Privacy Policy
MindVault is a study app. You save things you want to remember, and it quizzes you on them over time. This policy explains what that requires us to store, who else sees it, and how to get rid of it.
What we collect
Account information
Your email address, and the display name and handle you choose. If you sign in with Google, we receive your email address and name from Google. We never receive your Google password.
What you save
The text you capture, whether pasted, dictated, scanned, or shared from another app. Also the concepts and quiz questions generated from it, and your answers to those questions. This is the substance of the product: without it there is nothing to review.
Your progress
XP, level, streak, review history, scheduling data, trophies, battles, friends, and any items you have unlocked. Also your time zone, so your day and your streak follow your clock.
How you use the app
We record which days you use MindVault and what kind of thing you did that day, such as saving something, reviewing, studying a lesson or sending a link. We use it to see how the app is used and to make it better. It is tied to your account and deleted with it.
We also use PostHog, an analytics service, to see how the app and the website are used: the screens you open and what you do there, such as starting a review or saving a suggestion, along with your device type, app version and approximate location worked out from your IP address. The address itself is not kept. It is tied to your account by an ID, never by your email or your name, and it never includes the text you save or the titles of your concepts. The website sets no cookies for it. In the iPhone app you can turn it off with Share usage data in Settings. It is deleted with your account.
What we suggest you save
The Capture screen suggests things you might want to save: things you already saw (pages auto-vault picked, things you saved for later, notes from an AI assistant, links friends sent you), more from the sources you save from, and new things in the subjects you study. To choose them, we keep a short record of what you saved and skipped there: where each one came from, such as a website or a YouTube channel, and its subject. Never the page itself. It is deleted with your account.
Purchases
If you subscribe in the iPhone app, Apple sends us a signed record of the purchase: which plan, its price, and when it renews or ends. We use it to unlock what you paid for and to keep our accounts. Apple handles the payment itself, and we never see your card or payment details.
Contacts and invites
If you choose Find friends from contacts, the app reads the email addresses in your contacts, turns each into a one-way fingerprint (a hash) on your phone, and checks those against MindVault accounts. We do not keep what is sent. If you invite a friend by text message, we keep a hash of their phone number with your account, so we can credit the invite when they join, and a hash of your device’s identifier, to stop invite fraud.
Notifications
If you allow notifications, we store your device’s push token so we can send them (a friend’s challenge, a reaction, a link someone sent you). Turn any of them off in the app’s settings or in iOS.
What we do not collect
We do not use advertising identifiers, we do not track you across other companies’ apps or websites, and we do not sell personal information. The analytics described above stay with us and PostHog, and are never used for advertising.
Photos and camera images are read on your device to extract their text. The images themselves are never uploaded. Only the text you choose to save leaves the device. Dictation is transcribed on your device wherever your language supports it.
The Chrome extension
Most of what the extension does starts with a click. Pressing Savein its toolbar menu sends the page’s text, or just the text you selected. Pressing Vaulton a YouTube video sends the video’s captions. Pressing Vault under a ChatGPT, Claude or Gemini response sends that response. What you send is handled exactly like anything else you save, as described above. Opening the toolbar menu reads the current page to show you a preview, and that preview stays in your browser.
One check happens without a click. While you are signed in, on a YouTube video or a ChatGPT, Claude or Gemini conversation, the extension asks MindVault whether that video or response is already in your vault, so its button can say In Vault. That check sends the page’s address and, for a chat response, its first 500 characters. They are compared against your vault and not stored.
The extension does not sign you in on its own. When you sign in at mindrank.app, it copies your session from that site so it can save to your account. The session is kept in the browser’s storage for the extension and removed when you sign out. The extension runs on YouTube, ChatGPT, Claude, Gemini and mindrank.app, on any other page when you open its menu there, and on the pages auto-vault picks, described next.
Auto-vault from your browsing history
Auto-vault reads your browsing history, so it is off until you turn it on in the extension’s menu, and Chrome asks for your permission first. Once it is on, the extension does this once a day. It reads your Chrome history on that computer, leaves out pages such as mail, social feeds, shopping, banking, search results, sign-in pages and private addresses, and sends the titles and links of up to 20 of the rest to MindVault. MindVault asks a language model, through OpenRouter, to pick the 1 to 3 most educational. Those titles and links are used for that pick and are not stored.
The extension then opens the picked pages in the background, reads them, and sends their text to MindVault. That text is kept for a week for your review and then deleted, unless you save it, in which case it is handled exactly like anything else you save. If you switch on Vault automatically, the picked pages are saved straight away instead. Turning auto-vault off stops all of this, and so does removing the extension’s history permission in Chrome.
MindVault’s use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use it only to save what you ask to save, to pick pages for your review when you turn auto-vault on, and to quiz you on what you save. We do not sell it, use it for advertising, or use it to determine creditworthiness.
Who else sees it
Turning saved text into concepts and quiz questions requires sending that text to a third-party language model. This is the most important disclosure on this page, so we will put it plainly: text you capture is transmitted to the providers listed below for processing. Do not save anything you are not willing to have processed this way.
- Google Firebase: Authentication, database hosting, and crash reporting for the mobile app.
- OpenRouter: Turns captured text into concepts and quiz questions, grades typed answers, and generates the embeddings used to group related concepts. It routes each request to the model provider serving that model.
- Vercel: Hosts the website.
- Render: Hosts the API and the live battle server the mobile app talks to.
- Apple: Processes subscriptions bought in the iPhone app, and delivers push notifications to it.
- PostHog: Product analytics for the app and the website: which screens are used and what is done there, and errors the website runs into. Never the text you save.
We share personal information with no one else, except where the law requires it.
What other people see
Your activity appears in the Feed: reviews, streaks, levels and battles. In the app’s settings you choose who sees it: everyone, friends only, or nobody. If you also choose to share your vault with friends, they see the titles of the concepts you save, how well you remember them, and links to the public articles and videos they came from. Never the text you saved.
In a battle, half the questions come from each player’s vault, so your opponent sees questions written from your concepts.
How other people can find you
Other signed-in users can find you by your handle, or by typing your email address in full. Partial email searches return nothing, so nobody can discover your address by guessing at it. A search result shows your display name, handle, trophy count and avatar. It never shows your email address, and it never shows anything in your vault.
How long we keep it
For as long as your account exists. Delete your account and it goes with it. Suggestions waiting for your review, from auto-vault or from an AI assistant, go sooner: each is deleted a week after it arrives unless you save it.
Purchase records are kept after you delete your account, because a sale happened whether or not the account still exists. What stays is the plan, the price, the date and any invite code it came through. Nothing in it identifies you.
Deleting your account
You can delete your account and everything in it from inside the app: You → Settings → Your data → Delete account, or the equivalent control on your profile on the web. Deleting your account does not cancel an App Store subscription; cancel that in your iPhone’s Settings. It is immediate and permanent. Your vault, your progress, your friendships and your handle are erased, and your handle becomes available for someone else to claim. There is no recovery period and no backup we can restore from.
If you cannot reach the app, email 24austin.giffen@gmail.com from your account’s email address and we will do it for you.
One exception, and it is about somebody else. If you reported another user for abuse, the report stays with us so we can still act on it. Your name comes off it and anything you wrote in it is removed. What is kept is the part about the person you reported, not the part about you. Reports made about you are deleted along with everything else.
Purchase records stay too, without your name, as described under How long we keep it.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete the personal information we hold about you, and to object to some of our processing. The deletion control above exercises the strongest of these directly. For anything else, write to 24austin.giffen@gmail.com.
Children
MindVault is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has created an account, contact us and we will delete it.
Security
Data is transmitted over encrypted connections and stored on Google Cloud infrastructure. No system is perfectly secure, and we do not claim otherwise.
Changes
If this policy changes in a way that affects what we collect or who we share it with, we will update the effective date above and, for material changes, tell you in the app.