Mindivy Privacy Policy (US)
Version: v1.0 draft
Effective date: 2026-09-15
This version: users in the United States. For users in China, see Chinese version (Chinese).
1. Introduction
Mindivy ("the App") is a local-first AI knowledge-learning application developed and operated by 廊坊开发区知蔓软件开发工作室（个体工商户） ("we", "us"). This Privacy Policy explains our privacy practices.
Our honest commitments:
- Your knowledge base (imported documents, concept cards, translations, etc.) is stored on your own device, encrypted with SQLCipher. We operate no cloud servers that store your data.
- The App has no accounts, no telemetry, no advertising SDKs, and no automatic crash reporting.
- We do not sell, share, or collect your knowledge-base content. Apart from AI processing you initiate yourself, nothing leaves your device.
- We operate no AI inference servers. AI features work by sending requests directly from your device to the third-party AI provider you configure, using your own API key. We do not relay, store, or log your AI request content.
This policy does not cover the practices of third-party AI providers, which are governed by their own privacy policies (linked in Section 4).
2. Local-First Design: Information We Do Not Collect
We do not collect or have access to:
- Your documents, concept cards, review history, folders, or preferences
- Your AI request content, AI responses, or translation cache
- Your encryption passphrase (a 12-word mnemonic) or any credentials
All of the above remains in the App's local data directory (~/.mindivy/ or the platform-equivalent path) inside a locally encrypted database on your device.
3. Information That Leaves Your Device (Only When You Initiate It)
When — and only when — you trigger one of the following actions, text is sent directly from your device to the AI provider you have configured:
| Feature | What is sent | What is NOT sent |
|---|---|---|
| Concept extraction (text selection) | The word, phrase, or sentence you selected + up to ~100 characters of surrounding context | Document title, source, or filename |
| Document summary | Full document text (plain text) + title | — |
| AI classification & tags | Full document text (plain text; may include an existing summary) | Filename, source |
| Full translation | Full document text | — (results are cached locally) |
A cost estimate is shown before each operation and you may cancel. We cannot see the content you send.
4. Third-Party Services & AI Providers
AI providers. The App's built-in provider options are DeepSeek, GLM (Zhipu), and Kimi (Moonshot) — all accessed with your own API key, which you register directly with the provider. Their servers are located in mainland China. You may instead configure any OpenAI-compatible endpoint (including a self-hosted model).
- Your API key is stored only in the local encrypted database and is used solely to authenticate your requests.
- Provider privacy policies: DeepSeek
platform.deepseek.com/privacy; Zhipu GLMopen.bigmodel.cn/dev/privacy; Moonshot Kimiplatform.moonshot.cn/privacy. - Free-tier notice: free-tier terms may permit the provider to use API requests for model training. Please review the provider's current terms before use.
Resource packs. Installing learning resource packs downloads files from our first-party mirrors (public repositories on GitHub and Gitee). This involves only ordinary network request information. The packs contain public-domain works (e.g., Aesop's Fables) and our original learning materials, which we are entitled to distribute. They are provided for personal learning; if you republish or redistribute them, you are responsible for complying with applicable copyright rules.
Web scraping. When you enter a web address, the App fetches that page at your direction and stores it locally. This is a direct interaction between you and the target site; the interface includes a personal-study reminder.
5. Local API for External Agents (MCP)
If you enable External Agent Access in Settings, tools such as Claude Code or Cursor may query your knowledge base through a local, read-only connection (5 read-only tools; nothing can be modified or deleted). Every access is recorded in a local log (including the caller's name and version). You can revoke the access token at any time to cut off access immediately.
6. Data Storage & Security
- Local encryption: all data is stored in a SQLCipher-encrypted database (AES-256) on your device.
- Access: the database is unlocked by a 12-word mnemonic (BIP39) chosen by you. The mnemonic is held only by you — if it is lost, the data cannot be recovered, by us or anyone.
- No cloud backup: backups export the encrypted database file; restoring it requires your mnemonic.
- Reasonable, not absolute, security: we apply security measures proportionate to the local-first architecture (local encryption; no server-side data surface). No software can guarantee absolute security — the security of your device and of the AI providers you configure is outside our control.
7. Your Privacy Rights
Depending on your state of residence (e.g., California residents under CCPA/CPRA, and residents of other states with similar laws), you may have the right to know, access, correct, delete, and opt out of the "sale" or "sharing" of your personal information.
Honest and practical notes:
- We do not sell or share your personal information, so there is nothing to opt out of.
- Access and correction: your data is already fully visible and editable in the App.
- Deletion: deleting local data or uninstalling the App completes deletion — we hold no copy of your data on any server.
We do not discriminate against users who exercise their rights. To exercise any right, contact us at auth@mindivy.app.
8. Children's Privacy
The App is a learning tool and collects no personal information from anyone — including children (there is no account system). Children may use the App's learning features (importing documents, concept review, etc. — all data stays on the device). Children under 13 should use AI features (concept extraction, summaries, classification, translation) only with parental consent and supervision, because those features send text to third-party AI providers — parents should review the providers' terms for their applicability to children.
9. International Data Transfers
The built-in AI providers process requests on servers located in mainland China. Data is transferred only when you actively use an AI feature. If you configure a provider outside China, you direct that transfer yourself; you can review and change providers in Settings at any time.
10. Changes to This Policy
We may update this policy as the App evolves. Material changes will be announced in the App. The current version is published at https://mindivy.app and in the App's settings.
11. Contact Us
Questions or comments about this policy: auth@mindivy.app.