Privacy

Your memory lives on a computer you own. We never see it.

Last updated: 2 October 2026

Who this covers

This policy covers the Mindbaton website (this site), the Mindbaton server and web app you install, the terminal installer, and the Mindbaton browser extension. Mindbaton is an open-source project published by DkshByte at github.com/DkshByte/mindbaton.

The website

• It sets no cookies and uses no analytics, trackers or third-party scripts. Fonts and images are served from this site.
• The site is hosted on GitHub Pages. GitHub may log technical data such as your IP address to run and protect its service; see GitHub's privacy statement.

Mindbaton on your computer

• Everything Mindbaton remembers (facts, chats, hand-off packs, topics) is stored in files in your own data folder, on the computer where you installed it. It is not sent to us or anyone else.
• Each person on an install has their own account and their own separate memory. Whoever runs the install (its admin) is responsible for it and for the people they add.
• Passwords are stored only as salted hashes. Anything that looks like a password, API key or card number is redacted before it is saved.
• You can forget any memory, export everything, or delete an account at any time from the app.

Cookies in the app

The web app on your own server uses one cookie, mb_session, to keep you signed in (HttpOnly, SameSite=Lax, up to 30 days). It is strictly necessary for signing in, is set by your own server and is never used for tracking. No consent banner is needed for it.

Update check

Once a day your Mindbaton server asks GitHub whether a newer version has been released, so admins can see an "update available" notice. Like any website visit, GitHub sees your server's IP address; nothing about you or your memories is sent. Turn it off with MINDBATON_UPDATE_CHECK=0.

Optional AI features

Mindbaton works fully offline. If you choose to add an API key for Google Gemini, Groq, OpenAI or Anthropic's Claude, this is what happens:

• What is sent. Your server sends the text needed for one hand-off summary, set of topic names or search answer (the chat or the memories it is about) to the provider that answers, and nothing else. It goes straight from your server to that provider, never through the Mindbaton project.
• Who receives it. Only the providers you added a key for. By default free keys are tried first and a paid key only when they can't answer; you can choose which one answers first in Setup. Each provider handles what it receives under its own terms and privacy policy, which may include keeping it for a time: Google, Groq, OpenAI, Anthropic.
• Your keys. A key is stored in a file on your own server that only the server's user can read. It is used only to call its own provider. It is never shown again in the app, never written to a log and never sent to the Mindbaton project.
• What it costs. The running total Mindbaton shows for paid keys is counted and kept on your own computer. The project never sees it, and has no access to your account or bill with any provider.
• Stopping it. Remove a key in Setup and nothing more is sent to that provider. Without any key, nothing leaves your computer.

Experimental shared projects

When a host explicitly enables Team Baton, selected conversations are shared with invited members of that project on that host. Personal memory remains separate. Project browser access uses a separate HttpOnly cookie scoped to the project API. Client queues, credentials and cached briefings are stored locally by project. If the host separately enables external project processing, the selected shared text goes to the chosen provider using the host's key. Teammates see that setting when joining. Revocation stops future access; already received project material cannot be remotely erased from another person's copies.

The browser extension

• On AI chat sites it supports (such as ChatGPT, Claude and Gemini), it reads what you type and, in Live mode, the conversation on the page, and sends it only to the Mindbaton server address you entered, using a key that your server issued to your browser.
• It stores your server's address, that key and any messages waiting to be sent in your browser's local extension storage.
• It does not sell or share data, does not use it for advertising or credit decisions, and does not send it to the Mindbaton project. You can pause saving at any time, and removing the extension deletes its stored data.

Coding agents and imports

The installer can connect coding agents (such as Claude Code, Codex, Gemini CLI and OpenCode) to your server, and can import their memory files or an export you paste from a chatbot. It asks first, shows what it found, and reads only those files. Everything goes to your own server.

Children

Mindbaton is not directed at children under 13, and the project collects no data from anyone.

Your rights

Because your data is on your own computer, you control it directly: see, export, correct and delete it in the app. The project holds no personal data about you to request. Laws such as India's Digital Personal Data Protection Act and the EU's GDPR give you rights over data held about you; the person or organisation running your Mindbaton install is the one holding it.

Changes and contact

Changes to this policy are published on this page and in the project's history on GitHub. Questions: email support@mindbaton.com or open an issue on GitHub. For security problems, follow SECURITY.md.