Privacy policy

What ClearMind collects, why, who handles it, and how to delete it.

Effective 13 October 2026. Last updated 13 October 2026.

This policy covers the ClearMind iPhone app ("the app") and this website. Chase Williams, chase.mwilliams@outlook.com ("we", "us") is responsible for your personal data. Contact: chase.mwilliams@outlook.com.

In short

Your notes live on your iPhone. ClearMind is local-first. Without an account, nothing you write leaves your device: not in Local Only mode, not in Demo mode.
An account is optional. If you sign in (Sign in with Apple only), we store your account, your subscription status and, depending on which features you use, backups, synced data and usage counters on our cloud storage.
AI is opt-in. Your notes go to our AI processor (OpenAI) only with a Pro plan and only while the app's AI setting is on.
No advertising, no tracking, no third-party analytics. We do not sell your data and we do not share it for advertising. The app contains no analytics or advertising SDKs.
You can delete everything. In the app: Settings, Account, Delete account. It erases the account and all cloud data immediately. See how to delete your account.

What stays on your device

Your captures, tasks, projects, wiki pages, attachments, history and settings are stored in a database on your iPhone. We do not receive them unless you use a feature in the next section. The app asks for the microphone (voice notes) and for notifications (task reminders) when you first use them. It does not ask for your location, contacts or calendar or for access to your whole photo library (photos you pick are attached through the system photo picker), and it does not track you across other companies' apps or websites.

What we collect, by feature

Each row is a feature that talks to our servers, what is sent, and how long we keep it. The table below is generated from the app's actual server interface (docs/privacy-inventory.md in the source code), so it covers every request the app can make.

Feature	What leaves your device	Why	How long we keep it
Account and sign-in Only if you choose Sign in with Apple.	Apple's identity token (it contains your Apple user ID and, if you allow it, your email or Apple's private relay address), a one-time nonce, and a description of this device (a random device ID, the device's generic model name, OS version, app version). If Apple provides your name, our server discards it; it stays on your device.	To create your ClearMind account, recognise you on your devices and keep you signed in.	Apple user id (`sub`) and the email Apple shares (often a private relay address) are stored with the account until it is deleted. The identity token is verified and discarded; the nonce's hash is kept 15 minutes against replay. Device id, generic model name, model identifier, OS and app version are stored until the device or account is removed. `full_name` is accepted and dropped (kept on the device only); `authorization_code` is not stored. Only a SHA-256 hash of each refresh token is stored, 90 days (sliding) or until sign-out / account deletion.
Subscription (ClearMind Pro) Only if you start a trial or subscribe, or restore purchases.	The signed App Store transaction for your subscription (product, dates, status, the App Store's transaction identifiers). Apple also sends us renewal, expiry and refund notifications. We never receive your payment card or Apple Account password.	To confirm that you are subscribed, switch Pro features on and off, and honour renewals, cancellations and refunds.	Entitlement fields (original transaction id, product, status, dates, environment, app account token) are stored until the account is deleted. The signed notification is stored for idempotency and deleted with the account it belongs to.
AI processing, voice, wiki and assistant Only with a Pro plan and only when the app's "Send captures to AI" setting is on. Never in Local Only or Demo mode.	The note being sorted (text, or the transcript of a voice note) and a small, bounded amount of context: your time zone, text extracted on your device from the attachments of that note, titles of a few relevant projects and tasks, recent corrections and processing rules you wrote. For voice notes, the recording. For the wiki and the assistant: your question or message and the wiki pages that are relevant to it. Photo, PDF and document files themselves are never sent for AI processing.	To sort your notes into tasks and projects, transcribe voice, update and search your wiki, and answer your questions. Our server passes the request to OpenAI, our AI processor.	Not stored by the Worker (logs hold counts and identifiers only); forwarded to OpenAI's API, whose API data-retention terms apply. Usage counts (requests, tokens) are kept per account per day. Audio is forwarded to OpenAI's API and not stored by the Worker; daily audio byte counts are kept per account.
Cloud sync between your devices Only when you are signed in and sync is on.	Your changed notes, tasks, projects, wiki pages, history and attachment details (the full content of each changed record), and attachment files (photos, audio, documents) identified by a checksum.	To keep your devices in step.	Stored in the account's change log until the account is deleted (not compacted in v4). Stored in R2 (attachments/<account>/<sha256>) until the account is deleted.
Cloud backup and restore Only when you are signed in and a backup runs, or you restore on a device.	A complete copy of your ClearMind data: every table of your database, attachments and Markdown copies, as one archive, with its checksum, size, the app version and the time.	To let you restore your data after losing or replacing a device.	Stored in R2 (backups/<account>/…); the newest 14 are kept; all are deleted with the account. A backup row (size, checksum, device, app version, time) until the backup is pruned or the account deleted.
Crash and performance reports On by default; turn it off in Settings › Privacy › Share crash and performance reports. Nothing is sent while it is off.	When the app crashes, freezes, uses too much CPU or writes too much to storage, Apple's MetricKit hands the app a report. We send only its technical parts: app version, OS version, device model, the kind of failure, which parts of the app's code were running (library names and positions), and performance numbers. We remove everything that could contain your content, and never send note text, titles, file names or attachments. If you are signed in the report is linked to your account; otherwise only to a random ID created on your device.	To find and fix crashes and slowdowns.	Stored 90 days: a random report id, a random install id (reset with the app's data), the account id only when you are signed in (deleted with the account), app version, OS version, device model and the stripped summary (at most 64 KB). Never note text, titles, file names or breadcrumbs. Rate-limited per hashed IP and 50 reports per install per day.
Deleting your account and downloading your data When you delete your account in the app, or download your newest backup.	A fresh one-time authorisation code from Apple, so that we can revoke ClearMind's access to your Apple ID.	To erase the account and everything stored for it, and to tell Apple that ClearMind no longer has access.	The fresh Apple authorization code is exchanged with Apple at once; if Apple or the key is unavailable it is queued at most 5 minutes (its lifetime) and then cleared, and an Apple token obtained from it is kept only until revoked. Afterwards only an audit row remains: a SHA-256 hash of the account id, request/completion times and counts. Nothing is sent beyond the session.

If you sign in, Apple tells us your Apple user ID, and your email address or a private relay address if you choose to share one; you can hide your email with Apple's relay. We use the account to identify you, to attach your subscription, and to sync and back up your data. We do not receive your Apple Account password. Apple handles the sign-in under Apple's own privacy policy. You can see and revoke ClearMind's access any time in iOS Settings, your name, Sign-In & Security, Sign in with Apple. Deleting your account in the app also revokes the connection.

Subscriptions through Apple

ClearMind Pro is an auto-renewing subscription sold and billed by Apple. Apple, not us, collects your payment details and processes the payment, and keeps its own records under its own terms. We receive only the signed transaction and renewal, expiry and refund notices described above. See the terms for price, renewal and cancellation.

AI processing by OpenAI

When AI features run, our server forwards the request to OpenAI (OpenAI, L.L.C.) through its API. OpenAI acts as our processor. We ask OpenAI not to store the response for later retrieval (the store: false setting), and OpenAI states that data sent through its API is not used to train its models unless a customer opts in. OpenAI may keep API requests for up to 30 days to monitor abuse, longer if the law requires it, under its own policies. Our server does not save your notes, transcripts or the AI's answers; its logs hold only counts and identifiers (route, status, response time, model, token counts). We keep per-day usage counters per account to enforce fair-use limits. Because OpenAI processes data in the United States, this is an international transfer (see below). Do not use AI features for content you could not send to such a provider. Turning the AI setting off stops sending immediately; it does not recall what was already sent.

Where your data is stored

We use Cloudflare, Inc. as our only hosting and storage provider: Cloudflare Workers run our server code, and your account data is kept in Cloudflare D1 (database), R2 (files: attachments and backups) and KV (short-lived counters), all with encryption at rest, and sent over TLS in transit. Cloudflare also serves this website. Where this policy says "the Worker", it means our server code running on Cloudflare Workers. In detail:

D1 accounts (Apple user id, email, relay flag, plan, storage counters), devices, sessions (refresh-token hashes), entitlements, usage_daily (AI requests, audio bytes, input/output tokens per UTC day), changelog, device_cursors, attachments_blobs, backups: every row is deleted on account deletion.
D1 apple_notifications: App Store notifications; those of the account's transactions are deleted on account deletion.
D1 deletion_audit, apple_token_revocations: hash of the account id only; Apple codes/tokens cleared once used.
D1 cost_daily: one row per UTC day with totals and per-model cost estimates (CP-60); no account ids.
R2 attachments/<account>/ and backups/<account>/: deleted (paginated, verified empty) on account deletion.
KV: rate-limit, daily budget and per-minute AI quota counters (q:<account>:m:<minute>, 120 s TTL) keyed by account (expire within a day; deleted on account deletion); the remote-config document config (no personal data); Apple JWKS cache; sign-in nonce hashes (15 minutes).
Logs and Analytics Engine: route, status, latency, model, plan, escalation flag, token counts, audio bytes, cost estimate, error class — never account ids, request bodies, tokens or content.

Cloud data is encrypted in transit and at rest by the provider. It is not end-to-end encrypted: we and our provider can technically access it, which is why we limit what we keep and do not read it.

What we do not collect

No advertising identifier, no precise or coarse location, no contacts, no health data, no access to your photo library beyond the photos you pick, no browsing history, no analytics or crash-reporting SDK. If you have chosen "Share with App Developers" in iOS Settings, Apple may give us anonymous crash and usage data; that is Apple's feature and contains no ClearMind content. This website sets no cookies and runs no scripts; our host may keep standard request logs (IP address, time, page) for security and capacity.

How long we keep data

Local data: until you delete it or delete the app. Settings, Delete All Personal Data erases the on-device database.
Account, synced data, attachments and entitlements: until you delete your account. Then everything is erased at once (see below).
Backups: the newest 14 backups per account; older ones are deleted automatically.
Refresh tokens: stored only as a hash, for up to 90 days after last use, or until you sign out.
Rate-limit and daily budget counters: expire within a day.
After deletion: one audit record that contains no personal data (a one-way hash of the account ID, request and completion times, counts of rows and files removed), kept to prove the deletion happened.
Apple and OpenAI keep data under their own policies, described above.

Deleting your data and your rights

You can delete the account in the app (Settings, Account, Delete account). Deletion removes your account row, devices, sessions, entitlement records, sync change log, attachments and backups from our systems, confirms that nothing is left, and asks Apple to revoke the Sign in with Apple connection. If a step temporarily fails, the app tells you and our server retries every hour until it completes. Deleting the account does not cancel your App Store subscription: cancel it first in iOS Settings, your name, Subscriptions, or Apple keeps billing you. Steps: delete your account.

Depending on where you live (for example the EU, UK, Switzerland, California and other US states), you may have the right to access, correct, delete, restrict or object to our use of your personal data, to receive it in a portable form, to withdraw consent, and to complain to your data-protection authority. The app's Export All Data and cloud backup give you a copy of your data; to exercise any other right, write to chase.mwilliams@outlook.com. We do not sell personal data or share it for cross-context behavioural advertising, and we do not make decisions about you by automated means that have legal or similarly significant effects. The AI sorts your own notes for you; it does not profile you.

Legal bases (EU and UK)

We process your data to perform the contract with you (providing the account, sync, backup, AI features and subscription), on your consent where you switch on AI processing or optional features, to meet legal obligations (tax and accounting records kept by Apple, deletion audit), and for our legitimate interests in securing the service and preventing abuse.

International transfers

Our providers (Cloudflare, OpenAI, Apple) may process data in the United States and other countries. Where required, transfers rely on the provider's approved safeguards, such as standard contractual clauses or the EU-US Data Privacy Framework.

Children

ClearMind is not directed to children under 13 (or the minimum age of digital consent where you live), and we do not knowingly collect their personal data. If you believe a child has an account, write to chase.mwilliams@outlook.com and we will delete it.

Changes

If we change this policy in a way that matters, we will update the date above and tell you in the app before the change applies to data collected after it. The current text is always at https://clearmind-site-5az.pages.dev/privacy.

Contact

Chase Williams, chase.mwilliams@outlook.com. Email chase.mwilliams@outlook.com.

Technical appendix: every request the app can make

Generated from the source code. Each authenticated request also carries a session token (account ID, device ID, plan). Requests that only Apple or our operators make are not listed; they are ClearMind's App Store notification endpoint, operator health checks and public keys: GET /v1/whoami, GET /v1/auth/jwks, GET /v1/auth/dev-jwks, GET /v1/admin/accounts/:id/footprint, POST /v1/billing/apple-notifications, GET /v1/admin/config, PUT /v1/admin/config, GET /v1/admin/ops/:report, POST /v1/admin/verify-capture, POST /v1/admin/verify-wiki-ingest, POST /v1/admin/verify-assist.

Request	Access	Fields sent	Purpose	Retention
`GET /health`	public	none	Liveness check.	Nothing is sent or stored.
`POST /v1/auth/apple`	public	`identity_token`, `nonce`, `authorization_code`, `full_name`, `device`, `id`, `name`, `model`, `os`, `app_version`	Sign in with Apple: verify Apple's identity token and create or load the ClearMind account; register this device.	Apple user id (`sub`) and the email Apple shares (often a private relay address) are stored with the account until it is deleted. The identity token is verified and discarded; the nonce's hash is kept 15 minutes against replay. Device id, generic model name, model identifier, OS and app version are stored until the device or account is removed. `full_name` is accepted and dropped (kept on the device only); `authorization_code` is not stored.
`POST /v1/auth/refresh`	public	`refresh_token`	Rotate the session (refresh token).	Only a SHA-256 hash of each refresh token is stored, 90 days (sliding) or until sign-out / account deletion.
`POST /v1/auth/logout`	session	none	End this device's session.	The session is marked revoked; rows are deleted with the account.
`GET /v1/me`	session	none	Account page: plan, email, devices.	Nothing is sent beyond the session.
`DELETE /v1/me/devices/:id`	session	`path id`	Remove a device from the account (revokes its sessions).	The device row is marked revoked; deleted with the account.
`DELETE /v1/me`	session	`authorization_code`	Delete the account (App Review 5.1.1(v)): revoke sessions, purge every server-side row and object, revoke the Sign in with Apple token.	The fresh Apple authorization code is exchanged with Apple at once; if Apple or the key is unavailable it is queued at most 5 minutes (its lifetime) and then cleared, and an Apple token obtained from it is kept only until revoked. Afterwards only an audit row remains: a SHA-256 hash of the account id, request/completion times and counts.
`GET /v1/me/export`	session	none	Download the newest cloud backup (server copy of the export archive).	Nothing is sent beyond the session.
`POST /v1/billing/transactions`	session	`signed_transaction`	Verify an App Store purchase (signed transaction) and grant the plan.	Entitlement fields (original transaction id, product, status, dates, environment, app account token) are stored until the account is deleted.
`POST /v1/billing/restore`	session	`signed_transactions`	Restore purchases: verify the device's current App Store transactions.	As POST /v1/billing/transactions.
`GET /v1/billing/status`	session	none	Current plan and entitlement.	Nothing is sent beyond the session.
`GET /v1/config`	public	none	Remote config for the app (CP-60): AI kill switch, status banner, minimum app version, models and plan quotas; with a session also the caller's plan, today's usage and the reset time.	Nothing stored; usage is read from `usage_daily`. Rate-limited per hashed IP.
`POST /v1/diagnostics`	public	`id`, `install_id`, `kind`, `app_version`, `os`, `device`, `summary`	Crash, hang, CPU and disk-write reports and daily performance summaries from Apple's MetricKit (Settings › Privacy › Share crash and performance reports, on by default, can be turned off). The app strips each report to metadata, exception fields, binary names and offsets, and numbers; the Worker strips it again.	Stored 90 days: a random report id, a random install id (reset with the app's data), the account id only when you are signed in (deleted with the account), app version, OS version, device model and the stripped summary (at most 64 KB). Never note text, titles, file names or breadcrumbs. Rate-limited per hashed IP and 50 reports per install per day.
`POST /v1/process-capture`	session (AI)	`schema_version`, `capture_id`, `capture_text`, `captured_at`, `time_zone`, `source_type`, `attachment_excerpts`, `existing_projects`, `candidate_tasks`, `corrections`, `preferences`, `processor_version`	AI sorting of one note (Live AI with sending on): the note and a small bounded context.	Not stored by the Worker (logs hold counts and identifiers only); forwarded to OpenAI's API, whose API data-retention terms apply. Usage counts (requests, tokens) are kept per account per day.
`POST /v1/transcribe`	session (AI)	`multipart file`, `multipart prompt`, `multipart languages`	Transcribe a voice note (multipart audio).	Audio is forwarded to OpenAI's API and not stored by the Worker; daily audio byte counts are kept per account.
`POST /v1/wiki-ingest`	session (AI)	`schema_version`, `request_id`, `source {item_id, title, kind, text, url, url_title, attachment_excerpts, captured_at, time_zone}`, `wiki_schema_text`, `index_markdown`, `candidate_pages`, `recent_log_lines`, `existing_slugs`, `processor_version`	AI wiki update from one source note.	Not stored by the Worker; forwarded to OpenAI's API. Usage counts per day.
`POST /v1/wiki-query`	session (AI)	`schema_version`, `request_id`, `question`, `wiki_schema_text`, `index_markdown`, `candidate_pages`, `recent_log_lines`, `processor_version`	AI answer from the wiki pages that matter for a question.	Not stored by the Worker; forwarded to OpenAI's API. Usage counts per day.
`POST /v1/wiki-lint`	session (AI)	`schema_version`, `request_id`, `wiki_schema_text`, `index_markdown`, `sampled_pages`, `deterministic_findings {type, slugs, description}`, `processor_version`	AI wiki health check on sampled pages.	Not stored by the Worker; forwarded to OpenAI's API. Usage counts per day.
`POST /v1/assist`	session (AI)	`schema_version`, `request_id`, `message`, `conversation`, `context {captured_at, time_zone, today, existing_projects, candidate_tasks, index_markdown, candidate_pages, preferences, wiki_schema_text}`, `processor_version`	Assist: an answer or proposed actions from a message and bounded context.	Not stored by the Worker; forwarded to OpenAI's API. Usage counts per day.
`POST /v1/sync/push`	session	`device_id`, `ops`, `seq`, `table`, `row_id`, `op`, `version`, `updated_at`, `payload`, `id`	Cloud sync: changed rows of the user's notes, tasks, projects, wiki, history and attachment metadata (each op's `payload` is the full row).	Stored in the account's change log until the account is deleted (not compacted in v4).
`GET /v1/sync/pull`	session	`?since`, `?limit`, `?exclude_own`	Cloud sync: fetch other devices' changes since a cursor.	Only the device's cursor is stored.
`GET /v1/sync/status`	session	none	Sync state and storage used.	Nothing is sent beyond the session.
`POST /v1/attachments/check`	session	`hashes`	Which attachment files (by SHA-256) the cloud does not have yet.	Hashes are compared, not stored.
`PUT /v1/attachments/:hash`	session	`path hash`, `raw body bytes`	Upload an attachment file (photo, audio, document) for sync.	Stored in R2 (attachments/<account>/<sha256>) until the account is deleted.
`GET /v1/attachments/:hash`	session	`path hash`	Download an attachment file on another device.	Nothing is sent beyond the session.
`POST /v1/backups`	session	`?takeover`, `header x-content-sha256`, `header x-app-version`, `raw body bytes`	Cloud backup: the full export archive (every table, attachments, Markdown copies) in one request.	Stored in R2 (backups/<account>/…); the newest 14 are kept; all are deleted with the account.
`GET /v1/backups`	session	none	List the account's cloud backups (date, size, device).	Nothing is sent beyond the session.
`GET /v1/backups/:id`	session	`path id`	Download a cloud backup (restore, device migration).	Nothing is sent beyond the session.
`POST /v1/backups/uploads`	session	`size`, `sha256`, `app_version`, `takeover`	Start a multipart cloud backup (archives over 90 MiB): size and checksum.	A backup row (size, checksum, device, app version, time) until the backup is pruned or the account deleted.
`PUT /v1/backups/uploads/:id/parts/:n`	session	`path id`, `path n`, `raw body bytes`	One part of a multipart cloud backup archive.	As POST /v1/backups.
`POST /v1/backups/uploads/:id/complete`	session	`path id`, `parts`, `part_number`, `etag`, `takeover`	Finish a multipart cloud backup.	As POST /v1/backups.