What leaves your computer

The same summary is in the app: Settings, About, What leaves this computer. This page covers the Minda app on your computer; Minda SI for Chrome and Minda Files are not on it yet.

1. Sent in the background

The "Through Hide my IP" column also says how a request that does not go through it leaves the computer. No, direct: Minda's main program connects straight to the destination, whatever the computer's proxy settings say. No, system proxy: the request goes out through the same network engine as a browser tab (Chromium's), in a session of its own that holds no cookies and keeps no cache. It uses this computer's proxy settings (a PAC script, automatic detection or a company proxy; none means a direct connection), its root certificates (so a company proxy or an antivirus that inspects HTTPS works) and the Secure DNS setting. Either way a request never goes through Hide my IP, Tor, the proxy servers you add in Minda or a team's proxy. A proxy that signs in with Windows (NTLM, Kerberos) is answered by the engine itself; one that asks for a user name and password cannot be answered there, and Minda then reports the Minda server as unreachable. Every request to the Minda server leaves this way (the account, sync and its change notices, teams, Minda AI's replies, pictures, videos and voice, the update check, feedback, the skills gallery), and so do an update's download and Minda Live (through an HTTP proxy that needs no sign-in; behind a SOCKS proxy or one that asks for a password, Minda Live goes direct only when the proxy settings also allow a direct connection (DIRECT), and otherwise does not connect).

2. Sent only when you use a feature

Page actions of the AI agent (click, type, press keys) happen in the page, like your own input. All agent runs use Auto mode: chat, saved agents, background tasks, schedules and delegated agents execute their tool actions without permission cards, including navigation to new web addresses, connected tools, media generation, memory changes and calendar writes. Actions can send data, change pages, save files and spend credits. One step still waits for the user's OK while Ask before paying is on (Settings → AI agent → Access, on by default): a press that pays, buys or places an order, and card or bank details typed. The agent's tool scope, Access capabilities, blocked sites, organization policies, plan allowances, run limits, Stop and Take over still apply. The agent opens web addresses only, never a file: or extension page. In a site-scoped background task, pages and background reading stay within its sites; history, bookmarks and saved-knowledge searches return only results with permitted source URLs, and AI memory is omitted. Explicitly supplied context and connected-tool results may still enter the model prompt. Web search, text translation and connected-app calls run automatically. Whole-page translation remains unavailable in a scoped task. A chat's run-limit continuation question is separate from tool approval.

The AI agent runs in your own browser (the card on Settings → AI agent → Agents):

• Your tabs, your sign-ins: a chat reply acts in the window's own tabs, and a background task or a schedule's run in off-screen pages of the window's (or the schedule's) workspace, with that workspace's cookie partition, so its sign-ins apply, and a chat reply opens a page in another workspace (or gives a helper one) only when the user's own words name it or ask for every workspace or account, or any one while Auto is on in the chat box's Modes menu; a private window's own in-memory session is used instead. The Minda server has no module that loads pages or runs an agent: for the agent it only forwards Minda AI model requests.
• What the model sees: the AI chat rows above. A model in Ollama sends nothing out; Minda AI passes through the Minda server, which records each request's model, tier, credits and time, not the messages. The agent's web search and translation are their own rows, and "Keep AI on this computer" refuses them.
• Sites: a site the user blocked is refused before a page loads or is read; an allowed site's page actions need no card.
• Stop and Take over: Take over moves a task's page into the window's tab strip and the task waits.
• Log: the AI agent activity log row in section 3: the tool, the host, the result, who started it and the saved agent's name, never a label, an argument, page text or typed text; none for a private window or a temporary chat.
• Not claimed: that private windows are refused. The agent runs in one, with no log lines, no saved chat and no schedule; only the coding-agent bridge never reaches them.

Coding agents (Settings → Developer, off by default; the DeveloperAutomationEnabled policy can forbid it): while on, Minda listens on 127.0.0.1 at a random port, and only a request with the bearer token from userData/automation.json is served; one with an Origin header (a web page) or another Host (DNS rebinding) is refused. A task's tabs are ordinary background tabs of the window's active workspace, so its pages use the user's sign-ins there. A page action (click, type, press a key) waits for the user's Allow in the window unless "Ask before actions" is off; one of the user's own tabs and the history always ask ("Allow for 10 minutes" covers that task and scope). Private windows are never reachable. Settings lists the recent calls (tool, task, site, result), kept in memory only; page text and typed text are never kept.

Keep AI on this computer (Settings → AI → Privacy, or the AiLocalOnly policy) makes the whole AI rows above local: main refuses every cloud provider, Minda AI, the voice assistant's cloud speech-to-text (it hears with Windows' own recognizer instead), and the agent's search, translation, connector and picture tools before anything is sent (at the one place every model request passes); Listen then reads with the computer's own voice. Not even a model list is fetched from a cloud provider while it is on.

Connectors (Settings → Connectors, off until the user pastes an address or a token): the calendar and Notion are only read, never written. The address and the token are safeStorage blobs that never go back to the UI, into a log or into what the model sees (it sees the host and the events, or the page text). "Keep AI on this computer" refuses the three connector tools before anything is fetched, and the ConnectorsEnabled policy turns connectors off entirely. Remove deletes the saved address or token from this computer; revoking the integration or resetting the calendar's secret address is done at Notion or the calendar.

Calendar (Settings → Calendar): Minda's own calendar is a table in browser.db on this computer, like notes. The AI's calendar tools work on it with the local model too: they are not "connector" tools and send nothing anywhere; adds, changes and deletes run automatically for your task. Signed in to Google Calendar, the events sync with the account as the row above lists. The OAuth client id and secret and the tokens are one safeStorage blob that never goes back to the UI, into a log or into what the model sees, and is never in a backup. Signing out revokes the token at Google, forgets the blob and this computer's copies of Google's events (they stay in Google); a change that never reached Google stays here. The ConnectorsEnabled policy turns Google Calendar off; the local calendar keeps working. Calendar events do not sync with a Minda account.

AI activity (Settings → AI → Privacy → AI activity) lists every model request: the provider, the model, the host it went to, how many characters and pictures, which pages and attachments by title, and whether it came from a private window. The words themselves are never kept. It is stored in userData/ai-activity.json (5,000 entries, 90 days); a private window's requests stay in memory. "Clear browsing data" with history clears it too, and so does its own Clear button.

Temporary chats (the chat header's ghost button; always in private windows) are never saved: main refuses to write them, and the AI neither reads nor writes its memory in them.

Organizations can fix all of this with policies: see docs/enterprise-policies.md.

Minda on your phone (<account server>/app/, Settings → Account → Sync shows the address): a web app the account server serves, on every plan. It signs in with an email code, pulls what you sync as the server holds it (sealed), and decrypts it in the phone's browser with the key Minda keeps (sent to the phone's session), or with your passphrase (scrypt and AES-256-GCM, the same as on a computer). With a passphrase the server sees only sealed items. On the phone, in that browser's storage for the server's site: the session token, the sealed items (files included), the server's salt and key check, and, only if you tick "Remember on this phone", the two keys made from the passphrase as non-extractable keys (never the passphrase or the key it makes). Decrypted text lives in memory only. The app's offline cache holds its own files, never an API reply. Sign out revokes the session and deletes all of it; "Lock" forgets the keys. The page sends nothing to anyone but the account server (its security policy allows no other host).

3. Kept on this computer

Saved call audio sends nothing anywhere: the page's call watch mixes the call's sound in the page, hands the pieces to Minda on this computer, and they are written to the file; no request carries them, no sync, no AI model, no Minda server. It records only calls placed or taken in a call-site tab of Minda; a phone call runs in your system's phone app and a WeChat call in the WeChat app, which Minda cannot hear or record. The switch says that in many places everyone on a call must agree before it is recorded: tell the other person at the start; when Minda talks for you it says "This call is recorded." in its first sentence. A call list records only while the switch is on, and only the calls it places on this computer.

Text from images (Windows OCR), extract data, reading documents (pdf.js in a worker), the tab organizer and passage ranking all run on this computer and send nothing. So does "Save as PDF": the answer is printed by Chromium in a hidden page with JavaScript off, a policy that loads nothing, and a session of its own that cancels every request but its own temp file. Reject cookie pop-ups (Settings → Privacy, off by default) runs in the page on this computer: built-in rules click the site's own reject controls and read its consent cookie to check. No address, page content or result leaves the computer; the outcome stays in memory for the tab.

Send feedback (the main menu, Settings → About) shows the whole report first; Copy and Save as file keep it on this computer, and only Send hands it to the Minda server (section 2). The site's host name (never its address), a few settings, a screenshot and your email go in only if you tick them, and a private window's report never names the site or has a screenshot.

4. Private windows

In-memory cookie partitions, no history, no saved chats, passwords never saved, no extensions, no scripts from skills, no search suggestions (what is typed in its address bar goes nowhere until Enter); a private window's AI chat is temporary. Closing the window drops all of it. Sync can't be turned on, run or changed from a private window, a private window gets no team data and can't create, join or change a team, and community skills can be browsed there but never installed, shared or reported. A page the AI makes there is kept in memory and goes with the window. The AI agent keeps no activity log lines for a private window, Record a workflow does not start in one, and record_gif is not available in one. Minda's own screens run in the normal session, so they never load a private tab's site icon themselves (that request could carry your normal cookies for the icon's host and stay in the disk cache): the icon is fetched in the private window's own in-memory session and handed to the screen as data:. An allowance to open a site over plain HTTP (below) lasts only as long as the private window. The shield's blocked counts for a private window's pages stay with those pages and never add to the all-sites total; a site's ad-blocking exception made there is still saved in the profile. Its sidebar lists your saved apps, read only: one opens there in the private window's own memory-only session, signed out, and shows only that window's unread dots; it cannot pin a page to the sidebar, and main refuses its adds, changes, moves and removals. Automations never run for a private window: its messages, downloads and tasks are not events, its settings page reads an empty list and changes nothing, and its AI chat cannot make, list or change one. Its pages on social sites show no logo stacks beside the people kept on Library → People: main answers a private window's tab with nothing, and its pages never learn who is kept. Notes, highlights and bookmarks saved from one are kept like any others (by design) and so sync like any others.

5. Known gaps, stated plainly

• Hide my IP covers browsing only: Minda's own downloads (lists, Tor, extensions), the AI providers, Whisper, the Web Store and the Notion connector are reached directly, so those services see your IP. The Minda server's other requests (the account, sync, teams, Minda AI's replies, pictures, videos and voice, the update check, feedback, the skills gallery), an update's download and Minda Live (an HTTP proxy that needs no sign-in) go through this computer's own proxy settings when it has any, and direct when it has none; never through Hide my IP, Tor, a proxy you added in Minda or a team's proxy.
• Minda trusts the root certificates your operating system trusts (since 2026-10-10): for the Minda server's requests, which leave through the same network engine as a tab, and for every other connection Minda's main program makes (the AI providers, Minda Live, downloads), which add the system's roots to the ones that come with Minda and any named in NODE_EXTRA_CA_CERTS. Before, those connections failed behind a company proxy or an antivirus that inspects HTTPS, because its root is in the system's store and not in the list that comes with Minda. On Windows only the certificates in its root stores count (Trusted Root Certification Authorities, the computer's and yours, and Third-Party Root Certification Authorities), never the Intermediate Certification Authorities store, where any program running as you can add one with no prompt. Until Windows' list is read, about half a second after Minda starts (or the whole run, if it cannot be read), these connections trust only the roots that come with Minda. The price: whoever can add a root to the system's root store can now read this traffic, as they can any browser's on the computer: an administrator or a program running as one, a company's policy (Group Policy, device management), and you, or a program that gets you to accept the one Windows prompt for your own store (on macOS and Linux, the system's own rules). There is no switch for it: remove the root from the system's store.
• The Minda server's requests follow this computer's proxy settings, automatic detection included (since 2026-10-10): the account's token, sync and its change notices, Minda AI's content and Minda Live go through a fixed proxy, a PAC script or WPAD when the system names one. Windows turns "Automatically detect settings" on by default, so on a network you do not control a device that answers WPAD can make itself the proxy: it sees which Minda hosts are reached and when. If it asks for a Windows sign-in, the network engine answers on its own and the device can collect a NetNTLMv2 hash of your account from background calls (the hourly refresh, the sync stream), with no prompt. TLS still protects the content. To avoid it, turn off Settings → Network & internet → Proxy → Automatically detect settings on networks you do not trust.
• A free proxy is a stranger's server: a location picked in Hide my IP connects through a free public proxy whose operator is unknown; it sees every host name you open and any plain-http page in full. The location list asks first ("Use this proxy" or "Keep Tor"), and the switch itself means Tor. On a system with no built-in Tor (macOS, Windows on ARM) the switch connects to a free proxy without that question.
• Your own proxy servers and a team proxy see what they carry (Settings → Privacy → Proxy servers): a proxy you add for some sites or every site, and the one a paid team's admin sets for its members (the ManagedProxy policy), sees the host names of the pages it carries, and anything not encrypted (plain-http pages) in full; an HTTPS proxy also encrypts the connection to itself. Like Hide my IP they cover browsing only. A proxy's sign-in is kept on this computer, encrypted by the OS, sent only to that proxy when it asks, and never shown again; no sign-in travels in a team's policy. A site sent to a proxy never falls back to a direct connection when the proxy fails.
• Minda AI's media goes on to its vendors: a picture's description (and a picture to change), a reply read aloud and the voice assistant's speech pass through the Minda server to the model's vendor (OpenAI, fal.ai, Microsoft Azure AI Speech for the native voices of languages other than English, or another the server's admins picked), which handles them under its own terms. The Minda server keeps only each request's record, and its error log may hold a vendor's refusal message.
• A social site can tell whom you keep on Library → People: the logo stacks beside a kept person's name are drawn in the site's own page. Nothing is sent anywhere: which profiles are kept is looked up on this computer, only for the profiles of the site the page is on, and the page's scripts cannot read a stack (a closed shadow root, its clicks and hovers stopped inside it). They can still see that an element appeared after a name. The setting socialBadges turns the stacks off (on by default; its switch is not in Settings yet).
• Calendar events and Notion pages carry other people's words (invitations, shared pages): the AI gets them fenced as data, never as instructions, but they still go to the model you use.
• Mail is other people's words, and the AI can send mail: what the AI reads in Gmail goes to the model you use, fenced as data, and a mail can still try to steer it. The AI never sends to an address that neither you wrote nor the mail it answers named, and a mail to an address you did not write waits for your Send in a chat (a background run saves a draft instead), but what it writes in a reply you approve is the model's text: read the card before pressing Send.
• Your chatbot answers strangers with your notes and its knowledge: the bot's instructions, its knowledge entries and the notes with its tag go to the model for every message it answers, and what it replies is the model's text. An answer you approve from Learning becomes knowledge every person can be told, so take personal details out of it first. What it remembers of a person goes back only into that person's chat. Its check holds back a reply with a link, price, date or time your instructions and notes lack, and a message can still try to steer it: keep in those notes only what you would tell anyone who writes to the bot. Telegram keeps the messages under its terms.
• Cloud automations are plaintext on Minda's server, like team data: the rules, their texts and the notices they leave can be read by whoever runs or breaks into the server. A webhook's address and a web check's page are the server's to reach, so a page that changes what it shows to a server is checked as the server sees it.
• Saved credentials reach a site's pages on each load of a site with saved logins, login form or not.
• AI memory is not fenced in the prompt: a malicious memory that you approve could steer later replies. Agent memory changes run automatically, and Settings → AI lists memories for deletion.
• Saved AI chats and history are plain files readable by anyone with your OS account.
• Sync's default key is Minda's: with the Minda-managed key (the default, so a sign-in with Google, Apple or a password is all it takes), Minda's server holds the key wrapped with its own secret and could read, alter or forge what you sync, as Chrome's default sync does. A forged page script or community prompt still arrives off and marked for review; synced settings pass the same checks as the Settings page. Set your own passphrase to make it end to end. The same goes for handoff: with Minda's key the server could read or fake computer names, shared tabs and sent tabs; removing a computer takes it off the list but doesn't lock it out.
• Sync hides content, not activity: Minda's server sees your IP (direct), how many items of each kind you sync, their sizes and when they change. With a passphrase it can't read, alter or forge an item, but a hostile server could withhold one or serve an older copy of it. A weak passphrase can be guessed offline by whoever holds the server's data: Minda asks for at least 10 characters.
• The account data export is a plain file: Settings → Account → Download your data saves everything the server holds about a signed-in account as one JSON file (account, devices, plan, Minda AI usage by model, teams, shared skills, sync by kind and size; never a token, hash or key) where you choose. It is not encrypted, and it holds your email and Stripe customer id: keep it somewhere you trust. It covers the server's copy only; history, bookmarks, passwords and notes stay on this computer (Import & export backs them up). Deleting the account (Settings → Account) also deletes its Stripe customer; Stripe keeps the invoices tax law requires, and the staff log keeps what staff did to an account for up to a year.
• Signing in tells whether an address has a Minda account: after Continue, the dialog asks the server whether the email has an account and a password, to show the right next step (as Google, Microsoft and ChatGPT do), so anyone can learn whether an address uses Minda. It is limited per IP, and never says more than that.
• Clearing history clears it everywhere it syncs: with sync on, pages you delete from history (or clear) are deleted on your other computers too; pages older than 90 days don't sync.
• A computer away from sync for over a year keeps what was deleted meanwhile: Minda on a computer that last synced more than a year ago keeps its copy of an item deleted elsewhere since, because the deletion's sealed record is emptied after a year and an emptied deletion is not applied over what the computer has; Minda SI for Chrome and the phone remove it.
• The staff log keeps the address of an account staff acted on: when Minda's staff edit, suspend, sign out or delete an account, the email address of that account is kept with the action for up to a year, also after the account is deleted.
• Team data is plaintext on Minda's server: team names, members' names, emails and roles, shared workflows and shared results are stored as they are, so whoever runs or breaks into the server can read them, as can every member of the team. Keep secrets out of a task you share; results are shared only when you turn it on for that task.
• A paid team's admins set policies on your computers while you have a seat in it: they can keep AI local, allow only some providers, turn off saved chats, memory, sync, extensions, connectors or coding agents, and delete saved chats after some days. They see none of your data; this computer's own policies win, and leaving the team (or the seats ending) lifts them.
• A shared skill is public: unpublishing takes it out of the community and off the /skills page, not off the computers of people who installed it. Minda's server keeps who installed and who reported each skill (one row per account, deleted with the skill or the account) and never shows it to anyone.
• Minda on your phone keeps its session token in the phone browser's storage, readable by anyone who can use that browser; with "Remember on this phone" they can read what you sync there too. Signing out elsewhere ("sign out everywhere") ends the phone's session; a phone that signs out while offline deletes its data but can't end its session on the server.
• The default-browser answer is the app's word: the server can't check it, so a patched app can claim the bonus. It is capped at +100 Minda AI credits a month, whatever is sent.
• A page the AI made can put what it holds in a link: it sends nothing by itself, but a link you click opens in a normal tab like any link, address and all. A model steered by a web page could write such a page; look at where a link goes before you click it.
• Coding agents' token: any program running as you can read automation.json while the developer bridge is on, and so connect to Minda as a coding agent (page actions and your own tabs still wait for your Allow). Turn the bridge off when no agent needs it.