BETA privacy

onemind BETA Privacy Policy

This policy explains how onemind handles information during the public BETA across our website, apps, accounts, team Mind, Matrix, AI connections, billing, and related services.

Last updated: October 15, 2026

Who is responsible

This policy applies to onemind.team, onemind apps and command-line tools, and the hosted onemind BETA service. onemind is responsible for account, service, security, and direct-contact information processed for the BETA. A customer organization may separately control content its members place in a shared workspace; onemind then processes that content to provide the service, and the team administrator is normally the first contact for workspace-content requests.

Information we collect

  • Account and authentication information: email address, login name, display name, teams and roles, password verifier, sign-in session and invitation records, and email-verification status. Passwords are kept as a one-way PBKDF2-SHA256 verifier; a password saved in an older format is converted to this verifier the next time you sign in with it. onemind's servers store session tokens only in hashed form; your browser or the Mac app keeps the token itself so you stay signed in. When you request an email code, for example to sign up, sign in, or reset a password, we record the email address, a hashed copy of the code, and the IP address that made the request.
  • Profile information: your display name and, if you add one, a profile picture (a PNG or JPEG image you upload). Your profile picture is stored with your account and shown to members of the teams you belong to.
  • Google sign-in information: Google's stable account identifier (sub), email address, and display name when Google provides it. onemind checks that Google has verified the email address. onemind does not import your Google profile picture and does not receive your Google password.
  • Connected apps: records of the access you grant to AI tools and other apps that connect to onemind on your behalf, such as the app, the requested scope, the team, and when access was granted. onemind's servers store the related access tokens only in hashed form.
  • Team and service content: shared Mind content, proposals, project information, Mind files and paths, files uploaded to Matrix, comments or decisions, notifications, and related version or activity records that you or your team submit.
  • Mind Sync backups: before Mind Sync changes AI-tool instruction files in a project folder on your Mac, the onemind app backs up the files it is about to change (their paths and previous contents) together with a short change list, and uploads that backup to onemind so it can be restored later.
  • AI connection and analysis information: the provider name, API origin, model, and encrypted API key of any AI provider connection you save, and your personal AI analysis setting for each device. For each personal AI analysis run, we record the team, user, project, Mind, and device involved; a SHA-256 fingerprint of the analyzed source material (not the material itself); the provider and model names; and the run's status, source types, source count, number of proposals produced, and any error code.
  • Billing information: Paddle customer and subscription identifiers, plan or price identifier, seat quantity, subscription status, billing-period dates, scheduled changes, and billing-event metadata. Paddle, as Merchant of Record, receives and processes payment details, tax information, receipts, and refund information under its own privacy terms; onemind does not store complete payment-card details.
  • Feedback and diagnostics: the category and message you submit, your language and platform, and a snapshot of your name, email address, and team name. If you choose to attach diagnostics, the report also contains your app version, platform, browser and operating-system family, the page you were on, up to 50 technical events from the previous five minutes (page changes, error types, and the operation, status code, and duration of failed requests, excluding sign-in, session, analytics, feedback, and management requests), and the status of up to 10 recent Mind Sync items. Diagnostics do not include message text, URLs, request contents, or Mind Sync content.
  • Email: we use your email address to send service email, including sign-up verification, sign-in, and password-reset codes. When a free trial is granted to a new workspace, we email the workspace founder and keep a delivery record with that workspace.
  • Security and operational information: device name, platform, and architecture used for device authorization; timestamps; and security, audit, rate-limit, and diagnostic records. General request rate limits use a one-way hash of your IP address rather than the address itself; limits on email-code requests use the IP address stored with those requests.
  • Waitlist, contact, and privacy-request information: the name, email, country, phone number, requested access type (personal, team, or enterprise), and use case or message you submit, together with the IP address used to submit the form. Privacy requests sent through the privacy-request form are stored the same way.

Matrix, connected AI tools and your devices

When your team uses Matrix or connects AI tools through the onemind app for Mac, we also collect:

  • Project sessions: the Mac app reads your connected AI tools' own logs to find sessions in folders bound to a onemind Project on that Mac, including git worktrees of the bound repository. It uploads a bounded record: tool, title, running or idle status, branch, step and file-activity summaries, to-dos, pull-request and issue links, and the last assistant message (up to 16,000 characters), together with Project, member, device and session identifiers and activity times. The Mac and server mask summary text and the last assistant message; titles and branches are also masked before storage. Recognized credentials and tokens are masked and home-folder paths shortened, but the patterns may miss secrets. Links are limited to supported GitHub and GitLab pull requests and issues. Project-session diffs stay on the Mac unless you choose “Share changes,” which uploads a masked, size-limited snapshot.
  • Session sharing controls: sharing is on by default, with a one-time Matrix notice and one Settings switch for all connected AI tools. All active Team members can see shared Project sessions. Hiding a session keeps its stored record visible only to you; turning sharing off stops uploads and deletes your already uploaded Project-session records in that Team. It does not erase existing Matrix task history. Session records have no automatic time-based deletion.
  • Project Mind learning: when this feature is available, new Projects learn automatically by default, and a Team admin can switch a Project to manual. The Team Project does not learn. While a Project learns automatically, onemind sends the shared Project-session records of its members (tool, title, branch, step summaries, to-dos, links and the AI tool's last reply cut to 2,000 characters, with recognized secrets hidden) and, once task-outcome learning is available, task outcomes to the third-party model providers onemind selects, to propose or apply changes to that Project's Mind. Changes pass Safe Check, are attributed and can be undone. Members who turn session sharing off are excluded.
  • Matrix task discussions: tasks, assignments, progress updates, the messages and attachments (up to four files per message) that members post in task discussions, and the replies and tool activity that an AI tool running a task posts there. An AI tool's reply is stored essentially as the tool produced it, so it can contain anything the tool included in its output, such as file paths or other details from that device.
  • Tool-permission requests and answers: when an AI tool running a Matrix task on a member's Mac asks for permission or asks a question, onemind relays the request and stores it with the answer given. Only the owner of that Mac can answer a permission request; unanswered requests expire and are treated as declined.
  • Tool catalogs and usage figures: the list of tools an AI tool makes available, and its context-window and usage figures, as reported by the Mac that runs the task.
  • Task run summaries: short summaries of a task run, such as steps, to-dos, and pull-request links. Before a summary is stored, onemind masks the credentials and tokens it recognizes and home-folder paths; this masking is pattern-based and may not catch every secret.
  • Task run records: when task contracts are enabled, onemind stores per-run token counts, cost, and duration. For runs with a task contract, onemind also stores the Git branch, start and end commit SHAs, up to 200 uncommitted file paths, and the checks the tool ran, including their kind, result and command. Token counts, cost, and individual check results (names and statuses) are visible to all Team members in the run detail. The task reports accessible to Team admins carry only count-level figures—token counts, cost, review and repair minutes, and aggregate check counts—and do not include the branch, commit SHAs, file paths, or individual check names. No automatic deletion applies to run records.
  • Task reviews: when a member reviews or repairs a task run, onemind stores the outcome decision, criteria results, an optional note, and the time spent reviewing and repairing. The task reports accessible to Team admins show the outcome decision, how many criteria were met out of the total, and the review and repair minutes—not the note text or the individual criterion results. When a Project learns automatically, the decision, criteria results, and note—with recognized secrets hidden—may be sent to the model providers onemind selects to support task-outcome learning.
  • Automatic development: where a member turns on automatic development for a Project, onemind schedules tasks on that member's AI tool and reads the repository and any linked GitHub issues. onemind stores the repository name, base branch, and short excerpts of the tool's worker and review replies (up to 600 and 400 characters respectively, with recognized secrets hidden) for history. So the independent review step can judge the work, onemind also supplies the selected review tool the worker's full bounded report: the complete persisted worker message after global redaction, within a fixed size limit, rather than only the short excerpt. That report is the stored worker message and does not include the tool's unseen output or raw tool logs. The member's Mac app uses the GitHub CLI login on that Mac to read issues of the configured repository, open or closed, and their authors' access, and sends onemind bounded observations of them (title and body with recognized secrets hidden, author ID, username and permission, state and timestamps) for the issue queue, even before the author has connected a GitHub account or a task exists; it also uses that login to fetch the base branch and, when all checks pass, push the task branch. In the current flow, onemind then creates the draft pull request on its server with the connected GitHub account of the member who created the task, as described in GitHub account connection; if that account is not connected or lacks access, the task waits instead of using another account. Mac apps on older task contracts may still open the draft pull request with that Mac's GitHub CLI login, attributed to "OneMind Development." The pull-request link appears in the task and is visible to Team members. onemind waits up to 60 minutes for CI checks before considering an attempt complete.
  • GitHub account connection: when this feature is available, you can connect your GitHub account from Settings. onemind receives your GitHub user ID and username from GitHub and stores the GitHub access and refresh tokens encrypted on its server, separately from other credentials; they are never sent to your browser, the Mac app, or AI tools. onemind uses them only to confirm your GitHub identity and your access to the configured repository, to read a GitHub issue you wrote before it becomes a development task (its title and body, cut to a fixed size with recognized secrets hidden, are stored with the task and supplied to the AI tool as untrusted data), and to open draft pull requests for development tasks you create, so those pull requests show you as their author; the branch itself is still pushed by the Mac app. onemind keeps receipts of these checks, including the result and repository permission, without the tokens. If you are not connected or lose write access, onemind does not open the pull request and never uses another person's or device's GitHub account instead. Disconnecting deletes the stored tokens and asks GitHub to revoke the grant; onemind keeps a record that a connection existed and the pull-request links it opened.
  • Installed AI tools and app version: the onemind app version on each connected device; the AI tools the app detects there, with their versions and connection status; the plan and usage information those tools report; the names and folder labels of projects set up for Mind Sync, with their sync status; and changes you make to AI-tool connection profiles.
  • Device identifiers: the device name, platform, and architecture, and a random installation identifier that the Mac app creates and keeps on your Mac. The identifier is not derived from your hardware, and a new one is created if the stored one is deleted.
  • onemind agent conversations: the conversations and messages you exchange with the onemind agent, and any ratings you give its replies. The conversation itself is private to the member who starts it within the team, but each conversation is also tracked as a Matrix task that team members can see, showing the conversation's title and up to the first 2,000 characters of its opening message.
  • Proposals and checks: learning proposals, including their text, author, and any AI-generated rationale, and the requests and reports of Safe Check reviews.

Some information stays on your device. Unsent Mind and Matrix drafts are kept in your browser or the Mac app until you submit or send them. The Mac app keeps its AI-tool connection profiles, the Mind Sync files it writes into your project folders, and local backups on your Mac. When you open an AI tool's instruction file in the Mac app, the file is read and shown on your device only.

BETA testing and diagnostics

Because onemind is an incomplete BETA, we may use service events, error codes, feature usage, compatibility information, support reports, and limited diagnostic records to reproduce defects, protect users, and decide what to improve or discontinue. Authorized personnel may review these records and, only when reasonably necessary to investigate a reported problem, related account or workspace information. Do not place production secrets, regulated data, highly sensitive personal information, or irreplaceable records in the BETA.

Purposes and legal bases

We process information as needed to perform our contract by providing accounts, workspaces, storage, synchronization, Matrix tasks on connected devices, requested AI features, service email, subscriptions, and support. We process security, audit, capacity, reliability, analytics, product-improvement, and fraud-prevention information for our legitimate interests in operating and protecting the service, balanced against user rights. We process information where you give consent, including optional AI connections and personal AI analysis, and where necessary to comply with law, accounting requirements, or valid legal process. You may withdraw consent without affecting processing already carried out, although a feature that depends on that information may stop working. You need an email address and a password or Google sign-in to create an account; without them we cannot provide the service. Billing information is needed only for a paid subscription, and other information, such as a profile picture or personal AI analysis, is optional.

AI services and user-configured providers

AI features operated by onemind

Mind Check, Safe Check, Mind Generator, personal AI analysis, and the onemind agent are AI features that onemind runs as part of the service. When you or your team use one of these features, onemind sends the relevant content to third-party model providers that onemind selects: for Mind Check and Safe Check, the Mind content being reviewed and its reference material; for Mind Generator and personal AI analysis, the source material supplied for the run and the current Project Mind; for the onemind agent, your conversation and the team context the agent needs to answer; and for Mind learning, the shared Project-session records and task outcomes described in Project Mind learning. Before sending source material, onemind masks the credentials it recognizes; this masking is pattern-based and may not catch every secret. Personal AI analysis is off until you turn it on for a device; when it is on, the Mac app supplies skills and work-history records from your AI tools on that device as its source material. You cannot choose the provider for these features, and those providers may process the content outside your country. AI output does not become shared team memory on its own: suggested changes are normally presented as proposals or drafts for people to review. The one exception is Project Mind learning: where that feature is available and an ordinary Project is in automatic mode, an eligible addition-only change can be approved and published to that Project's Mind automatically after it passes Safe Check and the conflict and authorization checks, while removals, conflicts, and stale or changed authorization still wait for a person. The Team Project never learns this way, and automatic development still opens a draft pull request for people to review rather than merging on its own.

AI provider connections you save

You can save an AI provider connection, including its provider, endpoint, model, and API key, in your settings. onemind encrypts the stored API key, does not return the raw key after it is saved, and deletes it when you remove it or when your account is deactivated. In the current version, onemind does not send your content to a provider through a saved connection. Do not save a connection unless you are authorized to use that provider account.

Google sign-in data flow

Google receives browser requests needed to display its official sign-in control and authenticate the account you select. onemind verifies the resulting credential for its configured OAuth client, using Google's published signing certificates, and uses the stable Google account identifier—not an email address alone—to recognize a linked identity. This sign-in flow does not request access to Google Drive, Gmail, Calendar, or other Google product data, and onemind does not send project or shared Mind content to Google through the sign-in flow.

How information is shared

onemind does not sell personal information or share it for cross-context behavioral advertising, does not sell Google sign-in information, and does not use Google sign-in information for advertising. We share information only as follows:

  • Your team: authorized members and administrators of your team can see workspace content, display names, profile pictures, Matrix activity, and other information needed to collaborate, according to their roles.
  • Hosting and infrastructure: Alibaba Cloud hosts onemind's servers, databases, and backups, and other providers help deliver, secure, and operate the service.
  • Model providers onemind selects: content needed for Mind Check, Safe Check, Mind Generator, personal AI analysis, the onemind agent, and Mind learning, as described above.
  • AI tools you choose: when a Matrix task runs on a member's device, the AI tool selected there receives the task and related content and processes it under the terms between that member and the tool's provider.
  • Google: for the sign-in flow.
  • Paddle: for orders, subscriptions, and checkout.
  • GitHub: the onemind app for Mac is downloaded from, and checks for updates on, GitHub. GitHub receives your IP address and standard request information when you download the app or when it checks for updates. When automatic development is active for a Project, the Mac app reads issues and pushes branches with the member's GitHub CLI login, and onemind's server reads the task creator's issue and opens draft pull requests with that creator's connected GitHub account, as described above.
  • Email delivery: the email service we use to send service email receives your email address and the message.
  • VibeLoft: for limited telemetry on the public landing page, as described below.
  • Others: professional advisers under confidentiality duties; a successor in a business transfer; or authorities when disclosure is legally required or reasonably necessary to protect people and the service.

Each provider receives only the information reasonably needed for its role and is subject to its own terms and applicable data-protection duties.

Product analytics, VibeLoft telemetry, cookies, and local storage

onemind does not set its own cookies. It uses browser storage (local storage, session storage, and IndexedDB) and, in the Mac app, the macOS Keychain and app storage to keep you signed in, remember interface preferences, protect sessions, keep unsent drafts, and provide requested features. Google, Paddle, and VibeLoft may use their own cookies or similar technologies when their features load, under their own policies.

We also use privacy-minimized first-party product analytics on onemind.team to understand page views, unique visitors, sessions, sources of visits, and which normalized pages are used. The browser creates random visitor and session identifiers; the visitor identifier rotates every 30 days, and the session identifier lasts only for the browser tab. onemind hashes those identifiers on receipt and, for each page view, stores only: the hashed visitor and session identifiers; the normalized route; the page category; the interface language; the category of traffic source (for example direct, search engine, AI assistant, social, email, paid, or referral); whether you are signed in; whether the visitor identifier was first seen on an earlier day; when you are signed in, your team's plan status (free, trial, or paid); a hashed key used to discard duplicate events; and the server receipt time. Analytics records do not store an IP address, user agent, query string, account identity, or customer content, and raw events are removed after 400 days. Aggregated daily reports are emailed only to the configured onemind development recipient. The Mac app does not send these analytics.

Separately, onemind loads VibeLoft's telemetry only on the public landing page at the exact origin https://onemind.team, and only for visitors who are not signed in. onemind gives VibeLoft only the homepage address, without any path, query string, or fragment. According to VibeLoft, it uses anonymous device and IP identifiers to deduplicate visits daily and does not use browser fingerprinting. onemind does not receive VibeLoft's deduplication identifiers.

When your browser sends a Do Not Track (DNT) or Global Privacy Control (GPC) signal, onemind disables its first-party analytics and does not load VibeLoft. onemind does not use data from either system for behavioral advertising.

Retention and deletion

We retain account and subscription information while the account or commercial relationship is active. Workspace content remains until an authorized user deletes it or the workspace is closed. Security, audit, transaction, tax, and dispute records are retained only for the period reasonably necessary for security and applicable legal or accounting obligations. Other records, including email-code records and the IP addresses stored with them, waitlist and privacy-request submissions, device records, and personal AI analysis records, are kept only as long as reasonably necessary for the purposes described in this policy.

Some periods are fixed: raw analytics events are removed after 400 days, and the browser analytics identifier rotates every 30 days. Trial-email delivery records are deleted with their workspace. Mind Sync backups and onemind agent conversations do not expire automatically; you can ask us to delete them through the privacy-request form. Feedback submissions, including the name, email address, and team name captured with them, are kept as support records even after the related account or team is deleted.

When a team administrator removes a member, the member loses access to that team. If the member has no other active team, onemind also deactivates the account: it revokes authentication state and deletes the member's Google identity link, saved AI credential, and analysis consent. Deactivation does not erase the account; limited inactive-account and historical team records may remain to preserve workspace integrity and meet legal obligations. There is currently no self-service account deletion; to ask us to delete your account or personal information, use the privacy-request form. Deleted information may remain temporarily in access-controlled backups until routine overwrite. We periodically review retained information and delete or de-identify it when no business or legal purpose remains.

Security

We use access controls, scoped team permissions, credential hashing or encryption, session expiration and revocation, encrypted connections for hosted services and AI provider requests, encryption at rest for Mind Sync backups, and audit records designed to protect information. No system is completely secure, so you remain responsible for protecting your credentials, devices, provider keys, and the content you choose to submit.

Your choices and requests

You can update certain settings and your profile picture, sign out, remove configured AI credentials, turn personal AI analysis on or off for each device, delete individual Mind files, and manage a paid subscription through the controls available to your role. You can also set your browser to send a Do Not Track or Global Privacy Control signal to turn off onemind's analytics and VibeLoft telemetry. Depending on applicable law, you may request access, correction, deletion, restriction, objection, portability, consent withdrawal, or review of a privacy complaint, and may complain to your local data-protection authority. Submit requests, including account-deletion requests, through the private onemind privacy-request form; never place personal information in a public GitHub issue. We may verify your identity, explain any lawful limitation, and direct customer-controlled workspace requests to the relevant team administrator. For Paddle transaction data, contact Paddle Buyer Support.

International transfers

For the current version of onemind, we store hosted service data, including account information, team content, and backups, on Alibaba Cloud in Singapore. If you use onemind from outside Singapore, the information described in "Information we collect" (except information that stays on your device) is transferred to Singapore continuously, over encrypted connections, as you use the service. The recipient is Alibaba Cloud, acting as our hosting provider; the purpose is operating the service; and the information is kept for the periods described in "Retention and deletion." If you do not want your information transferred this way, you can stop using the service or send a privacy request; because the hosted service cannot operate without this transfer, we may then be unable to continue providing it to you.

Other providers process information in the countries where they operate, which may be outside your country: Paddle, Google for sign-in, GitHub for Mac app downloads and update checks, and, when automatic development is active, for issue reads, branch pushes and pull-request creation, our email delivery service, the third-party model providers onemind selects, and the AI tools you run on your own devices. Where required, we use contractual or other recognized safeguards intended to provide protection comparable to applicable law. A customer must not upload information whose transfer or processing is prohibited.

Age restriction

onemind is a business and professional collaboration service and is not intended for anyone under 18. Do not create an account for, or submit personal information about, a child unless onemind has expressly agreed in writing to a lawful organizational arrangement.

Data-protection contact

Use the private privacy-request form for questions, complaints, or rights requests. Requests enter onemind's access-controlled management queue and may require identity verification before action is taken.

Changes to this policy

We may update this policy as the service changes. We will update the date above and provide additional notice when required by law. Material changes apply prospectively.