1Who we are
Mindalike Technologies Private Limited, a company in India, runs Mindalike. We decide why and how your personal data is processed.
Under the Digital Personal Data Protection Act, 2023 of India, we are the Data Fiduciary. Under the GDPR, we are the controller.
For questions about your data, write to team@mind-alike.com.
2What we collect, and why
When you visit the site
- Our servers receive your IP address, your browser and device type, the page that you ask for and the time. We use them to deliver the site, to keep it secure and to limit abuse.
- The site keeps a few small values in your browser. The table in Cookies and local storage lists them.
- The site shows no ads. It has no analytics trackers and no advertising trackers.
When you sign in with Google or GitHub
- We receive your email address, your name, the link to your profile picture, the ID of your Google or GitHub account, and whether the provider verified your email address. If your GitHub account has no name, we use your GitHub username.
- From Google, we ask only for your basic profile and email address. From GitHub, we ask only to read your profile and your email addresses. We get no access to your repositories.
- We use the access token from the provider once, to read these details. We do not store it.
- We never receive your Google or GitHub password.
- We store your account: the details above, your status on the waitlist, your settings for theme and time zone, and the dates when the account was made and changed. We use them to run your account and to tell you when your access is ready.
Sessions and sign-in records
- Each sign-in starts a session. For each session, we store your IP address, your browser’s user agent, the time when the session started, and a hash of the session token. We do not store the token itself.
- We record each sign-in attempt: the sign-in method, whether it worked, your IP address, the time and, for a successful sign-in, your email address. We use these records to protect accounts and to find abuse.
Your profile
- When you complete onboarding, we store your answers: your role, interests, collaboration goals, tech stack, connection style and experience level. You can also add a bio, a location, a website, and links to GitHub, LinkedIn and X.
- We use your profile to show other members who you are. When matching opens, we also use it to suggest people.
- Other signed-in members can see your profile: your name, picture, bio, onboarding answers and links. At present, they can also see your email address.
Your work
- We store the projects and Canvases that you make, and their content: titles, descriptions, artifacts, files and the history of changes.
- We store the runs of your agents: your prompts, the plan steps and their status.
AI features
- Bio helper. When you ask for a bio, we send your onboarding answers to an AI model. The model is Llama 4 Scout from Meta, and Cloudflare runs it for us (Workers AI). When you ask for improvements, we send the text of your bio.
- To give the model examples, a request can include up to ten bios that other members wrote. So your bio can appear as an example in a request for another member.
- Agents in a Canvas. When an agent works for you, we send your prompt, the plan, your agent preferences and the design system of the project to an AI model. The request goes to Anthropic (Claude models). If Anthropic does not answer, the request goes to the same Claude models on Amazon Bedrock, which AWS runs for us. A research request that searches the web can also go to Google (Gemini on Vertex AI). Other agent requests never go to Google.
Logs
- Our servers write logs of requests and errors. A log entry can include the address of the request, your IP address, your account ID and technical details. Cloudflare stores these logs for us.
Mailing list
If you gave us your email address for product news, we store the address, its status and the date.
We can also disclose personal data when the law requires it, for example to a court or to the police. We do not use your data for advertising.
4Who processes your data
These companies help us run Mindalike. They process personal data for us.
| Company | What it does for us | Data |
|---|---|---|
| Amazon Web Services (AWS) | Hosting in the EU: the servers, the databases, file storage and backups. Email (Amazon SES). Claude models on Amazon Bedrock, when Anthropic does not answer. Agent runs (Amazon Bedrock AgentCore). | All the data in this policy |
| Cloudflare, Inc. | Hosting today, until our move to AWS ends: the database (D1), file storage (R2), the cache (KV), live Canvas state (Durable Objects), server logs, the bio model (Workers AI) and the AI Gateway. | All the data in this policy |
| Google LLC | Sign-in with Google, if you choose it. Gemini on Vertex AI, for research requests that search the web. | Sign-in details. Research requests. |
| GitHub, Inc. | Sign-in with GitHub, if you choose it. | Sign-in details |
| Anthropic, PBC | Claude models for the agents in a Canvas. | Agent requests |
| PostHog, Inc. | Product analytics, in its EU region. It receives only events that our servers send. The events have a pseudonymous ID and no content: no messages, prompts, file names or work. | Pseudonymous product events |
Google and GitHub also have their own relation with you when you sign in with them. Their privacy policies apply to that part.
5Where we store your data
We store your data and your work in the EU, with AWS in Europe (Ireland). AWS keeps recovery copies, such as backups, in Europe (Frankfurt).
Until our move to AWS ends, Cloudflare also stores and processes our data on its global network. So your data can be stored and processed in countries other than yours.
PostHog keeps our data in its EU region.
Many of the companies in the table above are in the United States. So your data can leave India, the EU or the UK.
6How long we keep your data
- Account, profile and work: until you delete them or your account.
- Sessions: a session ends after 3 days, or when you sign out. We keep the records of six sessions for each account at most.
- Sign-in records: today, no automatic job deletes them. We delete yours when you ask, or when we delete your account.
- Cache: a copy of your profile stays in the cache for up to 1 hour.
- Cookies and browser storage: as the table in Cookies and local storage shows.
- Logs: Cloudflare keeps them for a limited time, which our plan with it sets.
- Restore points: the database keeps restore points. Deleted data can stay in them for up to 30 days.
- Mailing list: until you unsubscribe or ask us to remove you.
7Your rights
You can ask us to:
- tell you what personal data we have about you and how we use it, and give you a copy;
- correct data that is wrong or out of date, or complete it;
- delete your data and your account;
- stop processing that depends on your consent. This does not change what we did before you withdrew it.
In India
Under the Digital Personal Data Protection Act, 2023, you also have the right to an answer to a grievance. You can also nominate a person who can use your rights if you die or cannot act. If our answer does not solve your grievance, you can complain to the Data Protection Board of India.
In the EU and the UK
Under the GDPR, you also have the right to restrict or object to processing, and to get your data in a portable format. You can complain to the data protection authority in your country. In the UK, this is the Information Commissioner’s Office.
We process your data to give you the service that you ask for, which is our contract with you. We process it to keep Mindalike secure and to fix errors, which are our legitimate interests. Where we ask for your consent, we process it with your consent.
How to ask
Write to team@mind-alike.com from the email address of your account. We can ask you to confirm who you are. We answer within 30 days.
The app has no buttons for export or deletion yet, so ask by email. When we delete your account, we end all your sessions and delete or anonymize your personal data.
8Children
Mindalike is for adults. You must be 18 or older to use it.
We do not knowingly collect personal data from people under 18.
If you think that a person under 18 uses Mindalike, write to us. We close the account and delete its data.
9Security
- The site uses HTTPS.
- Scripts on the page cannot read the session cookie. We store only a hash of the session token.
- We protect forms against requests that other sites forge, and we limit the rate of requests.
No system is completely secure. We cannot promise that your data is never lost or exposed.
If a breach affects your personal data, we tell you and the authorities, as the law requires.
10Changes to this policy
We can change this policy. The date at the top of this page shows the last change.
We tell you before an important change takes effect, in the app or by email.
11Contact
Mindalike Technologies Private Limited. Email: team@mind-alike.com.
Write to this address for questions, for requests about your rights and for grievances. The Terms of Service cover the rest of our agreement with you.