Privacy Policy

MindMax is a desktop application for reading, thinking and writing with AI. It is operated by an independent developer ("we", "us"). This policy covers the MindMax app, the optional MindMax account and subscription, and this website.

The short version:

• Your files stay in your folder. Opening, reading, annotating, editing and searching happen on your machine. Nothing is uploaded to do them.
• AI work is sent to a model. When you use an AI feature, the content that task needs — which can be a whole document — goes to a model provider. Which provider, and whether it passes through us, depends on how you set MindMax up.
• We do not store the content of your AI requests. On the subscription path our servers pass requests through and keep only metering records: which model, how many tokens, how many credits.
• We do not sell your data, and we do not use your content to train models.

1. On your machine​

MindMax works on a folder you choose. Your documents, and everything MindMax produces from them — notes, annotations, canvases, drafts, translations — are ordinary files in that folder, plus a .mindmax subfolder holding indexes, caches, version history and AI annotation records. They stay on your disk, and they stay there if you uninstall MindMax or stop paying.

On your machine MindMax also keeps:

• your settings, and a local record of AI token usage, used to show you your usage;
• API keys you enter for your own model providers, encrypted with your operating system's secure storage. They are sent only to the provider they belong to, never to us.

We cannot see any of this. It is not synced to us.

2. When you use AI​

An AI feature can only work if a model reads the material involved. Depending on the task this is your question, the passages or pages MindMax retrieves from your folder, an entire document (for a summary, translation or review), an image or screenshot region you ask about, or audio from voice input. Files you have set to keep away from the AI are left out of AI retrieval, unless you reference one explicitly.

Where that content goes depends on your setup:

With your own key, the provider's own terms and privacy policy govern what it does with your requests; we are not a party to that.

The subscription path​

When you use AI through a MindMax account, requests go to our gateway, which checks your plan, forwards the request to the model provider, streams the answer back, and charges credits for what was used.

• We do not store prompts, documents or answers. The gateway does not write request or response bodies to a database or to logs. What it records for each request is: your account and device ID, the task type, the model and provider used, input and output token counts, the cost and credits charged, and whether the request was substituted or failed.
• Web search (on plans that include it) sends your search query to a search provider. We do not log the query text.
• Upstream providers. Subscription requests are processed by: Anthropic, OpenAI, Google, DeepSeek, Xiaomi (MiMo) and Groq. Which one handles a request depends on the model tier and the task. Under their standard API terms these providers do not train on API traffic, but they may retain requests for a limited period (commonly up to 30 days) to detect abuse. We have not signed zero-data-retention agreements with them. Some of them process data outside your country — in the United States and, for DeepSeek and Xiaomi, in China. If that matters for a particular document, use your own key with a provider you choose, or a local model.

3. Your MindMax account​

An account is optional. You need one only to use the subscription or to buy credits; the app, and every feature with your own key, works without one.

If you create an account we store:

• Identity: your email address, or your Google account's email and ID if you sign in with Google. We use passwordless email codes; we do not store a password.
• Devices and sessions: a hashed device identifier, the device name, platform and app version you sign in from, a hashed IP address, an approximate region, and session tokens (stored as hashes). This is how plan device limits and "sign out this device" work, and how we detect stolen sessions.
• Plan and credits: your plan, credit balances and grants, and the per-request usage records described above.
• Security and abuse signals: sign-in and account events, and signals of quota abuse.

4. Payments​

Payments are processed by Stripe. We never see or store your card number. We store the Stripe customer and subscription IDs, your order history (what you bought, when, for how much) and refund or dispute status. Stripe's own privacy policy governs the data it collects.

A one-time Supporter payment needs no account. We record the email address you paid with, so the supporter mark can be attached to an account if you later sign in with that address.

5. Other services the app talks to​

• Updates. MindMax checks GitHub Releases for new versions and downloads them from there. GitHub sees your IP address and app version, as it would for any download.
• Web search without a subscription. With your own search key (e.g. Tavily), searches go directly to that provider. Without one, MindMax can fall back to public sources such as DuckDuckGo and academic databases, which receive your query directly from your machine.
• Email. Sign-in codes and account emails are sent through Resend.

The app contains no advertising, and no third-party analytics or crash-reporting SDKs.

6. Who processes data for us​

7. How long we keep it​

Files on your machine are kept for as long as you keep them. We have no copy.

8. Your choices and rights​

You can, at any time:

• use MindMax without an account, or with a local model so that nothing leaves your machine;
• sign out a device or remove a sign-in method from your account settings;
• cancel your subscription from the billing page;
• ask us for a copy of your account data, to correct it, or to delete your account.

To delete your account or exercise any other right, email support@mindmax.me from the address on your account. We respond within 30 days. Deleting your account removes your identity, devices, sessions, credit balances and usage records; payment records we are legally required to keep are retained for that period only. Deleting your account does not touch anything in your folders.

Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you may have further rights, including to object to processing, to data portability, and to complain to your local data protection authority. We process account data because it is needed to provide the service you signed up for, and security data because we have a legitimate interest in keeping accounts safe. We do not sell or share personal information for advertising.

9. This website​

This website sets no advertising or tracking cookies and loads no third-party analytics. Your theme preference is stored in your browser's local storage. Our web host keeps standard server logs, such as IP address and pages requested, for security and operations.

10. Children​

MindMax is not directed at children under 13, and you must be at least 13 (or the minimum age in your country, if higher) to create an account. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes​

If we change what we collect or how we use it, we will update this page and its date. For material changes affecting account holders we will also notify you by email or in the app before they take effect.

Contact​

Questions about this policy or your data: support@mindmax.me.

Last updated: 2026-10-09.