Privacy policy

Who we are

Myndory is a personal organiser app made and run by Chamod Madhusanka, an individual developer based in Sri Lanka (“we”, “us”). If you have a question about this policy or your data, email chamodm115@gmail.com.

This policy covers the Myndory apps for iOS and Android, the website myndory.com, and the Myndory service behind them.

The short version

• We store what you put into Myndory so you can see it on your devices. We don’t sell it, and we don’t use it for advertising.
• Your password vault is encrypted on your phone before it’s uploaded. We can’t read it.
• When you use the AI features, the information needed to answer is sent to our AI provider (Google). Your vault is never sent.
• You can delete your account at any time. Deleting it removes your data from our servers straight away.

What we collect

Your account

• Email address and password. We store the password only as a one-way hash, never the password itself.
• First and last name, if you add them, and a profile photo, if you upload one.
• Whether you’ve verified your email, and when you signed up.

What you save in Myndory

• Memories: title, category, description, date.
• Reminders: title, category, notes, due date, whether it’s done, and your notification time preferences.
• People: name, relationship, notes, birthday, and which memories and reminders you’ve linked to them.
• Attachments: files and photos you attach, with their name, type and size.

Your password vault

Vault items (logins, cards, bank details and so on) are encrypted on your device with a key made from your vault passphrase. We store only:

• the encrypted items, which we can’t read, including their type and title;
• the settings needed to turn your passphrase back into the key on another device, and your vault key in encrypted (“wrapped”) form.

We never receive your passphrase, PIN or biometric data. Unlocking with a PIN, Face ID or fingerprint happens on your device.

Sign-in and security data

• For each signed-in device: when the session started and expires, the device’s IP address and its browser/app description (user agent). We use this to keep your account secure.
• One-time codes for verifying your email and resetting your password, stored only in hashed form until they’re used or expire.

AI usage records

Each time you use an AI feature, we record which feature it was (chat or document scan), the AI model used, the number of words processed (“tokens”), and when. We don’t store your questions, the AI’s answers, or scanned photos.

What we don’t collect

We don’t use advertising or third-party analytics SDKs in the app, and we don’t track you across other apps or websites.

AI features

Ask Myndory (chat). To answer, we send our AI provider your question, the earlier messages in that conversation, and a summary of what you’ve saved: your memories, reminders and people, with their titles, categories, dates, and the first part of their notes and descriptions. We don’t keep the conversation on our servers; it stays in the app on your device.

Scan documents. The photo you take is sent to our AI provider to read the title, date and category. We don’t store the photo unless you then save it as an attachment.

Your password vault is never sent to AI features.

Our AI provider is Google.

How we use your data

• To run Myndory: store your data, sync it between your devices, and send the reminders you set up.
• To keep accounts secure: sign-in, email verification, password resets, detecting stolen sessions, and suspending accounts that break our Terms.
• To provide AI features when you use them, and to monitor their cost and fair use.
• To answer you when you contact support.

Who we share it with

We don’t sell or rent personal data. We share only what’s needed with service providers who process it on our behalf: cloud hosting, email delivery, and AI processing for the AI features when you use them. We may disclose data if required by law.

How long we keep it

We keep your data for as long as you have an account. When you delete your account, your account and everything in it (memories, reminders, people, attachments and their files, vault, sessions and AI usage records) are deleted from our live systems straight away.

Email verification codes expire after 24 hours and password-reset codes after 1 hour. Sign-in sessions expire after 30 days.

Your choices and rights

• See and change your data: everything you’ve saved is in the app, where you can edit or delete it.
• Delete your account: in the app, go to Profile, then Security, then Delete account. Or follow the steps on our account deletion page.
• Other requests: to ask for a copy of your data or object to how we use it, email chamodm115@gmail.com.

Data on your device

To work offline, the app keeps a copy of your data on your device and schedules reminder notifications locally. Your sign-in tokens are kept in your device’s secure storage. Signing out or deleting the app removes them.

Children

Myndory isn’t meant for children under 13, and we don’t knowingly collect their data. If you think a child has created an account, email chamodm115@gmail.com and we’ll delete it.

Security

We use encrypted connections (HTTPS), hash passwords and one-time codes, and encrypt the vault on your device. No system is perfectly secure, but we work to protect your data and will tell you if a breach affects it, as the law requires.

Changes to this policy

If we change this policy, we’ll update the date at the top. For significant changes, we’ll also tell you in the app or by email before they take effect.

Contact

Chamod Madhusanka, Sri Lanka chamodm115@gmail.com