Privacy Policy

1. Who we are

Mindora is an AI assistant available as a browser app, installable PWA, Telegram bot, and Telegram Mini App. It helps you manage personal information through four informational areas: Health, Legal info, Finance, and Assistant. This policy describes what data Mindora collects, how it is used, how it is stored, and what choices you have.

2. Data we collect

• Telegram profile data. When you start the bot or log in via the web dashboard, we receive your Telegram user ID, first name, and username if public. We do not receive your phone number.
• Email account data. If you register with email, we store your normalized email address, email-verification state, and authentication-provider links. We never store your password itself: only a one-way Argon2id password hash is retained.
• Security codes. When email confirmation and password recovery are enabled, we store only a digest of each one-time code together with its purpose, expiry time, attempt counters, and delivery status. Codes are short-lived and cannot be recovered from the digest.
• Messages. The text of messages you send to the bot is processed by our AI pipeline and stored in your personal conversation history.
• Documents. Files you upload, such as PDFs, images, and text files, are stored for the purpose of analysis, retrieval, and answering your future questions.
• Memory chunks. Structured facts extracted from your conversations and documents are stored as vectorised memory fragments to enable context-aware replies.
• Usage metadata. We log non-content metadata such as agent type, token counts, response latency, and error events. Message text, document content, Google OAuth tokens, and Google Calendar event content are not written to application logs.

3. Google Calendar data

Google Calendar integration is optional. If you choose to connect your Google Calendar, Mindora requests access through Google's OAuth consent screen and uses only the scopes needed for the calendar features you enable.

When you connect Google Calendar, Mindora may collect and use:

• OAuth credentials. Access tokens, refresh tokens, granted scopes, token expiry, and related OAuth metadata required to keep the integration working.
• Calendar event data. Upcoming event metadata such as title, start time, end time, location, and description when needed to answer your request.
• Event creation details. Event title, time, duration, description, and location that you ask Mindora to create in your calendar.

Mindora uses Google Calendar data only to:

• show your calendar connection status;
• answer your questions about upcoming events and schedule conflicts;
• create calendar events or reminders when you explicitly ask Mindora to do so;
• maintain and secure the calendar integration.

Mindora does not sell Google user data, does not use it for advertising, and does not use it to build, train, or improve generalised AI or machine learning models.

4. Where data is stored

• Database. Structured data such as users, authentication identities, password hashes, conversations, messages, documents, memory, and integration status is stored in a PostgreSQL database hosted on our infrastructure.
• Encrypted credentials. Google OAuth credentials are encrypted before being stored and are associated with your Mindora user account.
• File storage. Uploaded files are stored either on the server's local disk or in an S3-compatible object store, depending on our deployment configuration.
• Cache. Short-lived rate-limit counters and session metadata are kept in Redis and expire automatically.

5. Third-party processing and sharing

We do not sell personal data and do not use personal data for advertising.

We share or process data with third parties only as needed to provide Mindora:

• Google. If you connect Google Calendar, Mindora exchanges OAuth tokens with Google and calls the Google Calendar API to read upcoming events or create events according to your requests.
• OpenAI. Your messages, document excerpts, and relevant calendar details may be sent to OpenAI's API when necessary to generate an AI response or perform a requested calendar action. OpenAI processes this data under its Privacy Policy.
• YooKassa. When you choose to buy Mindora Pro, the email address entered for that payment and the payment details required by law are sent to YooKassa to process the payment and issue the receipt. Mindora does not store that address as a receipt or payment-profile field and requests it again for each payment. This is separate from any email address you choose to use as your Mindora login.
• Transactional email provider. When email confirmation and password recovery delivery are enabled, the account email and the required message metadata are sent to our configured mail provider solely to deliver security codes. Until a provider is configured, Mindora does not claim that such a message has been sent.
• Infrastructure providers. Hosting, database, cache, and storage providers process data only to operate the service.

6. Data retention and deletion

Your Mindora data is retained until you delete it or disconnect an integration.

• In Telegram: send /forget to the bot. A two-step confirmation is required.
• In the web dashboard: use the "Delete all my data" button under the Danger Zone section.
• In the PWA: use the account and local-data controls in Settings. Clearing local history removes only the offline cache; deleting the account removes server-side data as well.
• For Google Calendar: use the calendar integration controls in the Telegram Mini App, dashboard, or bot to disconnect your calendar. You can also revoke Mindora's access in your Google Account security settings.

Hard deletion removes your user record, linked authentication identities, pending security codes, conversations, messages, documents, memory chunks, and stored integration credentials from Mindora's database. This is irreversible.

7. Your rights and choices

• Export. Send /export to the bot to receive a JSON archive of your Mindora data.
• Deletion. Use /forget in Telegram or the dashboard/PWA account controls to delete your Mindora data permanently.
• Access. Your dashboard at /dashboard shows your profile, memory statistics, recent conversations, documents, and integration status.
• Calendar control. You decide whether to connect Google Calendar and can disconnect it at any time.

8. Security

• Database access is filtered by your user ID to prevent cross-user data access.
• Session cookies are signed and configured as HttpOnly and SameSite=Lax.
• Passwords are hashed with Argon2id; one-time email codes are stored only as digests.
• Authentication attempts and code requests are rate-limited to reduce automated abuse.
• Uploaded files have restrictive server-side permissions.
• Critical operations are written to an audit log without secrets or message content.
• OAuth credentials are encrypted at rest and are not exposed in logs.

9. Important disclaimer

Mindora is not a medical, legal, or financial service provider. The Health area does not provide medical diagnoses. The Legal info area does not provide legal advice. The Finance area does not provide investment recommendations. Always consult a licensed professional for serious decisions.

10. Contact

Questions about this policy? Contact us via Telegram: @Mindoraapp_bot or support: @mindora01.