Privacy
Last updated 28 September 2026
What Mindtote collects, what it does not, and where everything lives.
Your account
Signing in with Apple or Google sends their account identifier and, when provided, their verified email address and name to our Convex backend. We use these to authenticate you, provide account access, check subscription eligibility and meter usage. We do not store a password. Sign-in refresh tokens are stored in the device keychain. For Apple, our backend relays authorization codes and refresh tokens to Apple to renew access or revoke it during account deletion; it does not persist these tokens.
Where your tasks live
Your task list, schedule, settings and AI choice are stored on your device. Your full task list is not uploaded to our backend. The text you submit for AI processing is handled as described below. Device backups may contain locally stored app data, depending on your device settings.
Your calendar
With calendar permission, Mindtote reads calendars available on your device to display your day. It does not write to those calendars. If you also turn on AI features, event titles and whether events are all-day are sent through Convex to OpenAI to identify actionable entries. Event descriptions, attendees and locations are not sent by this feature. You can turn AI features off independently of calendar access in Settings.
Speech
Dictation uses your phone’s speech recognizer and prefers on-device recognition where supported. Apple may process audio when network recognition is used, under Apple’s terms. Mindtote sends the resulting text and the current date/time with timezone to Convex and OpenAI only when you have turned AI features on. We do not send recordings to OpenAI.
Places
A task can carry a place, and the map that shows it is Apple’s. When you search for a place or ask for somewhere near you, Mindtote uses your device location and sends what you typed to Apple’s geocoding service to turn it into an address and a point on the map; Apple processes that under its own terms. Location is requested only while you are using the app, only when you open the map or ask for somewhere nearby, and the app works without it — a task simply has no pin. The place saved on a task, and your location, stay on your device: neither is uploaded to our backend. When AI features are on, the words you dictate are sent to be read and may name a place, because that is the sentence you spoke; your coordinates are never sent.
AI features and your choice
When you turn AI features on, Mindtote sends three things for reading: the text of what you dictate, the titles of your calendar events and whether each is all-day, and your current date, time and timezone. They travel through our backend, run by Convex, to OpenAI, which turns a spoken sentence into a dated task and works out which calendar entries are things you can tick off. Your recordings, your task list and everything else inside your events — descriptions, locations, who else is invited — are never sent. OpenAI does not use this content to train its models. It may keep abuse-monitoring logs for up to 30 days, or longer where the law requires. Mindtote works without this: dictation and your calendar still run, with a simpler reading of what you said. You can turn it off whenever you like in Settings, which stops anything further being sent — though nothing can recall what was sent already.
Retention and service providers
We retain account records while your account exists and remove them when account deletion completes. Short-lived usage, entitlement and abuse-prevention records expire or are removed according to the periods and criteria described below. AI request content is processed transiently by our functions rather than saved to our application database. OpenAI may retain API abuse-monitoring logs for up to 30 days, or longer when legally required; disabling response storage is not zero data retention. Diagnostic and usage records are kept only as long as reasonably needed to diagnose faults, secure the service and understand aggregate product use, subject to our provider settings. Convex, Apple, Google, Expo, RevenueCat and PostHog also process data needed to provide their services under their applicable terms and retention requirements.
Abuse prevention
We enforce request limits on our servers. Short-lived hashed account and credential identifiers and request counters may be retained for up to four days, including after account deletion, to prevent quota resets and service abuse. Raw authentication credentials are not stored in these counters.
Where your data is processed
Mindtote is operated from the United States. Our providers may process information in the United States and other countries where they operate. If you use Mindtote from the United Kingdom, the European Economic Area or Switzerland, this can transfer information outside your country. Where required, we rely on approved transfer safeguards offered by our providers, such as standard contractual clauses or another lawful mechanism. You may contact us for information about the safeguards relevant to your data. We also limit transfers technically: your task list stays on your device, AI content is not saved to our application database, and diagnostics do not use your account identity.
Why we are allowed to process it
We process your account identifier to provide the service you asked for and to meter usage under our agreement with you. We process AI content on the basis of the consent you give in Settings, which you can withdraw at any time. We process diagnostics and abuse-prevention counters on the basis of our legitimate interest in keeping Mindtote working, secure and affordable to run — an interest we have weighed against your privacy by sending no task content, no dictation and no account identity in those reports.
Your rights
Depending on where you live, you may ask for access to or a portable copy of your information, correction, deletion, restriction, or an objection to certain processing. You may withdraw AI consent in Settings at any time without affecting processing that happened before withdrawal. Deleting your account from inside the app removes your account record, clears saved sign-in credentials and app data from that device, and revokes Apple authorization when you signed in with Apple. Write to support@mindtote.app and we will verify and respond to your request within the time the law allows. If you are in the UK, EEA or Switzerland and think we have got this wrong, you may complain to your local data protection authority.
Diagnostics and how the app is used
Mindtote reports sanitized crashes and handled errors to PostHog so faults can be found and fixed. It also records app lifecycle events and a small, fixed set of product events: which onboarding step you reached; that a subscription screen was shown; that a purchase was started, completed or cancelled; and that a dictation was made and how many items it produced. Reports include an identifier generated on the device and technical context such as app version, operating system, device type, locale, timezone and network metadata such as IP address received by the provider. They never contain your tasks, dictation text, calendar content, account name or account email, and no event carries text you typed or spoke. Mindtote does not use session recording and does not automatically capture what you tap or type. We do not use this information for advertising or cross-app tracking.
Subscriptions
Apple handles payment. RevenueCat processes purchase receipts, subscription status and an app user identifier to provide and restore access. We do not receive your payment-card details. Subscription and transaction records may be retained by these providers for billing, fraud prevention and legal obligations.
What we do not do
We do not sell personal data or use it for advertising or cross-app tracking. We do not use your AI requests to train models.
United States privacy requests
Residents of some U.S. states may have rights to know the categories or specific pieces of personal information we process, receive a copy, correct or delete information, and appeal a denied request. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, so there is no sale or advertising opt-out to exercise. You will not be discriminated against for making a privacy request. You or an authorized agent may email support@mindtote.app; we may need information to verify the request and the agent’s authority.
Children
Mindtote is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child under 13 has provided personal information, contact support@mindtote.app so we can investigate and delete it. Additional age rules may apply where you live.
Security
We use administrative and technical safeguards designed to limit the information we collect, protect credentials in transit and at rest, restrict backend access, rate-limit abuse and remove account data on request. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. Contact support@mindtote.app if you believe your account or information is at risk.
Deleting your account
Use Delete account in Settings to delete your account records from our active database and clear this device’s app data and AI choice. Apple authorization is revoked as part of deletion; you may need to sign in again to complete it. Deleting the app alone does not delete your server account or necessarily erase keychain entries. Account deletion does not cancel an App Store subscription: manage that in your Apple subscription settings. Provider retention and any existing device or service backups remain subject to their retention policies. Contact support@mindtote.app about access or deletion requests.
Contact
Fig Tree Labs LLC is the data controller. Contact support@mindtote.app with privacy questions or requests about your information.
Changes to this policy
We may update this policy when Mindtote, our providers or the law changes. We will change the date above and provide additional notice in the app or by another appropriate method when a change is material or the law requires it. Earlier versions may be requested from support@mindtote.app.
Getting in touch
Questions, or a request about your data: support@mindtote.app. Fig Tree Labs LLC is the data controller.