Privacy Policy
Last updated: October 7, 2026
1. Who is responsible
The controller of your personal data is [Company legal name], [registered address], Republic of Kosovo. Privacy contact: info@mindstitch.dev. When an organization (for example, your employer) gives you access to MindStitch, that organization is the controller of its members' data and we process it on its behalf under a Data Processing Agreement.
2. This website
This website sets no cookies, runs no analytics or tracking, and loads no third-party fonts or scripts (our fonts are hosted on this site). Our host, Vercel, keeps standard server logs (such as IP address and pages requested) for security, for a short period. If you email us, we use your message and address only to reply.
3. What the Service processes
| Data | Why | Legal basis |
|---|---|---|
| Account data: name, email, sign-in method, organization and role | To run your account and organization | Contract |
| Code changes: the lines your AI agent changed, plus about 10 lines of context, with secrets redacted on your machine first | To detect concepts and write cards for you | Contract |
| Learning data: cards, concept status, check answers and scores | To show your progress and, for teams, insights as described below | Contract; for team insights, the organization's legitimate interest |
| Usage and device data: client version, timestamps, error reports | To keep the Service secure, reliable and within budget | Legitimate interest |
| Billing data: handled by Paddle, our reseller; we receive plan, seat count and country, not full card details | To charge for paid plans and meet tax rules | Contract; legal obligation |
4. What we never do
- We never send whole files or repositories, and we skip files matched by
.gitignore,.mindstitchignoreand common secret files (such as.envand key files). - We never sell personal data or code, and we don't use it to train AI models. Our AI provider does not train on data sent through its API.
- We never include your name or email in AI prompts.
5. Who can see what inside an organization
Managers and admins see concept status, check scores and card titles for the people they're responsible for. They do not see code snippets, and they see a typed check answer only if it has been flagged for review. Every member can see exactly what their manager sees.
6. Where data is stored and who processes it
Service data is stored in the European Union (AWS, Frankfurt). We use these subprocessors:
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, storage | EU (Frankfurt) |
| Anthropic | AI processing of redacted code changes | United States |
| Paddle | Payments, invoicing, tax | United Kingdom / EU |
| Sentry | Error monitoring | EU or United States |
| [Email provider] | Sign-in and service emails | [location] |
Transfers outside the EU/EEA are protected by the European Commission's Standard Contractual Clauses or an equivalent safeguard. Enterprise customers can use their own AI account (Anthropic, AWS Bedrock or Google Vertex) so that code never reaches ours.
7. How long we keep data
- Code snippets on cards: 30 days by default. Organizations can choose 0 to 365 days, or a "no code stored" mode.
- Raw change events: 90 days. Aggregated counts behind insights are kept while the account exists.
- Audit logs: 1 year.
- After you delete your account, your data is deleted within 30 days, and from backups when they rotate (35 days).
8. Security
Data is encrypted in transit (TLS 1.2+) and at rest. Each organization's data is isolated in the application and in the database. Our staff have no standing access to customer data. To report a vulnerability, see our security.txt.
9. Your rights
You can access, correct, export (JSON) or delete your data, object to or restrict processing, and withdraw consent where we rely on it. Most of this is self-service in your account settings; otherwise email info@mindstitch.dev and we'll answer within 30 days. If your account belongs to an organization, we may forward your request to it. You can complain to the Information and Privacy Agency of Kosovo or, in the EU, to your local data protection authority.
10. Children
MindStitch is not intended for anyone under 16.
11. Changes
We'll post updates here and, for material changes, tell account holders by email before they take effect.