Privacy Policy
OpenMindAI Desktop and Mobile Applications
Platforms: Windows, macOS, Linux, Android, iOS, and iPadOS
Effective Date: September 5, 2026
Last Updated: September 5, 2026
Website: https://www.openmindai.org
Privacy Contact: https://www.openmindai.org/contact
Important publishing note: This Privacy Policy is written for the current OpenMindAI local-first architecture reviewed in September 2026. Before publishing a new application release, the policy, store privacy disclosures, analytics configuration, permissions, connected-service behavior, and actual production data flows should be reviewed together. A privacy policy must describe what the released software actually does.
Table of Contents
- Introduction
- Who This Policy Applies To
- Our Local-First Privacy Approach
- Summary of OpenMindAI Data Handling
- Information Stored Locally on Your Device
- Information That May Be Processed Online
- AI Prompts, Responses, and Local Inference
- Conversation History
- Documents, Attachments, Images, and Project Files
- Local AI Models and Runtime Files
- Search and Deep Research
- Mobile Analytics and Firebase
- Camera, Microphone, Photos, Notifications, and Biometrics
- Connected Apps and Third-Party Services
- GitHub Integration
- Google Workspace and Microsoft 365
- Slack, Notion, Dropbox, and MCP
- Website Data and Cookies
- How We Use Information
- Legal Bases Under the GDPR
- GDPR Principles
- Your Rights Under the GDPR
- California Privacy Rights
- Sale, Sharing, and Advertising
- Data Retention
- Data Deletion
- Data Export and Portability
- Security
- International Data Transfers
- Children's Privacy
- AI-Generated Content and Automated Decisions
- Third-Party Model and Download Sources
- Open Source and Diagnostic Information
- Business Transfers and Legal Requirements
- Changes to This Privacy Policy
- How to Exercise Privacy Rights
- Supervisory Authority and Complaints
- Contact Us
- Data-Flow Reference Table
- Mobile Permission Reference Table
- GDPR Compliance Mapping
- Publication and Store-Review Checklist
1. Introduction
OpenMindAI is a local-first artificial intelligence platform designed to give users more control over where AI processing happens, which models are used, where local data is stored, and when internet-connected services are involved.
This Privacy Policy explains how OpenMindAI handles information when you use the OpenMindAI desktop application, OpenMindAI Mobile, the OpenMindAI website, optional online capabilities, and connected third-party services.
The most important privacy distinction in OpenMindAI is the difference between local processing and remote processing.
When you use a supported local AI model for normal local inference, the prompt, local context, and generated response can be processed directly on your device. Those local AI interactions do not need to be transmitted to OpenMindAI simply to obtain an AI response.
When you intentionally use a network-dependent capability such as Search, Deep Research, a connected application, a model download, a software update, mobile analytics, or another external service, relevant information may be transmitted over the internet because that specific feature cannot operate entirely locally.
This Policy is intended to make that boundary clear.
2. Who This Policy Applies To
This Policy applies to people who use OpenMindAI on supported desktop or mobile platforms, visit OpenMindAI-operated websites, contact OpenMindAI for support, or use optional OpenMindAI features that communicate with external providers.
For the purposes of this Policy, "OpenMindAI," "we," "us," and "our" refer to the OpenMindAI application and the developer or publisher identified in the applicable official OpenMindAI distribution channel.
Where data-protection law applies and OpenMindAI determines the purposes and means of processing personal data, OpenMindAI may act as a data controller.
Where a third-party provider processes information on our behalf, that provider may act as a processor or service provider, depending on the applicable legal framework and the provider's contractual role.
Where you independently connect OpenMindAI to a third-party service such as GitHub, Google Workspace, Microsoft 365, Slack, Notion, or Dropbox, that third party may also process information under its own privacy policy and terms.
3. Our Local-First Privacy Approach
OpenMindAI is designed around a local-first architecture.
Local-first means that the product attempts to keep ordinary AI inference and local working data on the user's device whenever the selected feature can reasonably operate that way.
For example, a supported local language model can generate a normal Chat response without sending the prompt to a commercial cloud AI model. Local conversation history can be stored in a device-local database. Desktop Projects can use user-approved local folders. Mobile model files can remain inside application-private storage.
Local-first does not mean that OpenMindAI never uses the internet.
Model downloads, updates, Web Search, Deep Research, Firebase Analytics on mobile, connected apps, remote repositories, and other external services require network communication.
Our privacy goal is therefore not to make unrealistic claims about being completely offline. Our goal is to make online processing purposeful, understandable, and tied to the feature the user chooses.
4. Summary of OpenMindAI Data Handling
| Data or Activity | Primary Location | Sent to OpenMindAI or Third Party? | Main Purpose |
|---|---|---|---|
| Local Chat prompt | Your device | Not required for local inference | Generate a local AI response |
| Local AI response | Your device | Not required for local inference | Provide the requested response |
| Desktop conversation history | Local SQLite database | Not required for local use | Conversation continuity |
| Mobile conversation history | Local SQLite database | Current mobile design does not send chat history through Firebase | Conversation continuity |
| Mobile chat attachments | App-private storage | Current mobile design does not send attachments through Firebase | Preserve user-selected context |
| Desktop Project files | User-approved local workspace | Not required unless a remote feature is chosen | Project and agent context |
| Local models | User-selected desktop storage or mobile app-private storage | Downloaded from model source; not uploaded for local inference | Local AI execution |
| Search requests | Network-dependent | Yes, relevant query/context may be sent to retrieval services | Obtain current public web information |
| Deep Research | Network-dependent | Yes | Gather public evidence for research |
| Firebase Analytics | Mobile analytics service | Yes, app-level usage analytics | Product usage analytics |
| Camera input | Local device initially | Only sent remotely if a remote feature explicitly requires it | Vision/Lens workflow |
| Microphone input | Local device initially | Current local speech workflow is designed for on-device use | Voice input |
| Connected-app data | External provider + OpenMindAI workflow | Yes, when the user connects and uses that provider | Perform user-requested connected actions |
| Support message | Support channel | Yes, if the user sends one | User support |
| Website request logs | Hosting/network infrastructure | May be processed by hosting infrastructure | Security and site operation |
This table describes the intended current architecture. If OpenMindAI adds cloud synchronization, remote AI inference, advertising, crash reporting, additional telemetry, user accounts, or another remote service, this Policy must be updated before or at the time that behavior is introduced.
5. Information Stored Locally on Your Device
OpenMindAI may store information locally so the application can work without depending on a remote account.
Depending on platform and enabled features, local information may include conversation history, model metadata, AI model files, runtime files, local settings, application preferences, user profile information, project metadata, attached project folders, local file references, generated artifacts, caches, logs, attachment copies, and other application state.
On desktop, conversation history is stored in a local SQLite database, and the selected OpenMindAI data root may contain model files, runtimes, cache, logs, generated artifacts, workspaces, knowledge data, and backups.
On mobile, OpenMindAI uses local SQLite conversation history and stores model files and durable chat attachment copies in application-managed private storage.
Unless a feature specifically transmits information to a remote service, local storage does not mean that OpenMindAI's publisher has possession of that local information.
If data exists only on your device and has never been transmitted to us, we may not have the technical ability to access, recover, export, or delete it remotely.
6. Information That May Be Processed Online
Some OpenMindAI capabilities require an internet connection and can result in data being processed outside the local device.
These capabilities can include model downloads, runtime downloads, software update checks, Search, Deep Research, mobile Firebase Analytics, GitHub, Google Workspace, Microsoft 365, Slack, Notion, Dropbox, MCP servers, support requests, and website access.
The information transmitted depends on the feature.
A model download may communicate the requested file and normal network metadata to a hosting service. Search may transmit a search query or relevant request context to a retrieval service. A GitHub integration may transmit repository requests and authentication credentials to GitHub. Firebase Analytics may receive app-level usage events and associated technical identifiers according to the configured Firebase implementation.
We do not treat the existence of a network connection as permission to send all local OpenMindAI content to remote services.
7. AI Prompts, Responses, and Local Inference
When you use a supported local model in an ordinary local OpenMindAI workflow, the prompt and generated response are processed on your device.
OpenMindAI's current local-first architecture does not require prompts and responses to be sent to a paid cloud AI provider simply to generate a local answer.
This distinction is important for private work, source code, research notes, documents, and other content that users may prefer to keep local.
However, if you intentionally select a feature that requires remote information or a connected provider, some content may need to leave the device.
For example, a Search query must be sent to a search or retrieval service. A connected-app request may need to send relevant request information to that provider.
Before using a network-dependent feature with highly sensitive material, consider whether the remote processing is appropriate for that information.
8. Conversation History
OpenMindAI stores normal conversation history locally.
Desktop conversation history is stored using a local SQLite-based data architecture.
OpenMindAI Mobile also uses SQLite conversation history and includes functionality for chat search, rename, delete, export, and full-history cleanup.
Current OpenMindAI Mobile documentation states that prompts, AI responses, attachments, local model files, and chat history are not sent through the application's Firebase service.
Conversation history is user-controlled local data unless another feature specifically exports or transmits it.
Users should protect their devices with appropriate operating-system security because anyone with sufficient access to an unlocked device or local storage may be able to access local application data.
9. Documents, Attachments, Images, and Project Files
OpenMindAI can work with documents and files that you intentionally select.
Depending on platform, supported content may include PDF, DOCX, text, Markdown, source code, JSON, YAML, CSV, images, and other supported formats.
On mobile, chat attachments can be copied into durable application-private storage so older conversations do not depend on temporary file-picker paths.
On desktop, Projects can be linked to a user-approved local folder.
Local Project Agent capabilities can inspect or modify content inside the approved workspace according to the permissions granted by the user.
OpenMindAI does not need unrestricted access to an entire filesystem simply to analyze one selected file or folder.
You should avoid granting broad file or terminal access when a smaller scope is sufficient.
10. Local AI Models and Runtime Files
Local AI model files are stored on the user's device.
On desktop, models can live under the selected OpenMindAI AI data root.
On mobile, models are stored in application-private storage.
OpenMindAI Mobile currently downloads models separately instead of bundling the complete model catalog into the application package.
Model downloads communicate with the remote source from which the model is retrieved.
After a model is installed, ordinary local inference does not require the model file to be uploaded to OpenMindAI.
Current OpenMindAI Mobile documentation states that local model files are not sent through Firebase Analytics.
11. Search and Deep Research
Search and Deep Research are intentionally online features.
When you select Search, OpenMindAI may send a query or relevant request context to web retrieval services so current public information can be located.
Deep Research can perform broader public-source retrieval and therefore may involve multiple requests to external information sources.
Search and Research results are treated as external evidence rather than trusted local instructions.
You should avoid including unnecessary confidential or personal information in a web-search query.
If the task can be completed entirely with a local model and local files, normal Chat or a local Project workflow may provide a more private alternative.
12. Mobile Analytics and Firebase
OpenMindAI Mobile currently includes Firebase Core and Firebase Analytics.
The current implementation is documented as using Firebase for app-level usage analytics.
The current mobile repository documentation specifically states that OpenMindAI does not send prompts, AI responses, attachments, local model files, or chat history through its Firebase service.
Firebase Analytics can still process other information such as application events, technical information, device/app identifiers, and analytics metadata according to the Firebase implementation and configuration.
Google provides its own privacy and security information for Firebase, including information about GDPR and CCPA/CPRA support.
OpenMindAI should configure Firebase in a manner consistent with applicable law, published privacy disclosures, store data-safety declarations, and user-consent requirements.
Where consent is legally required before non-essential analytics is activated, the released application should implement that consent requirement.
13. Camera, Microphone, Photos, Notifications, and Biometrics
OpenMindAI requests or declares certain device permissions because optional features need access to protected resources.
The current Android source declares internet, camera, microphone, notification, and biometric permissions.
The current iOS configuration includes usage descriptions for Camera, Microphone, Photo Library, and Face ID.
These permissions serve specific product functions.
Camera access supports OpenMindAI Lens and user-initiated image or document capture. Microphone access supports voice input. Photo Library access allows a user to select images. Notifications can inform the user that a long response, download, or task has completed. Biometric access can support an optional app-lock feature.
Sensitive permissions should not be interpreted as permission for unrelated background collection.
Where operating systems support it, you can revoke these permissions at any time through device settings.
14. Connected Apps and Third-Party Services
OpenMindAI can optionally connect to third-party services.
Current desktop connected-app families include Google Workspace, GitHub, Microsoft 365, Slack, Notion, Dropbox, and MCP servers.
When you connect an external service, the provider receives and processes information according to the request you make, the authorization scope you approve, and the provider's own privacy terms.
OpenMindAI's desktop design keeps connection secrets and OAuth tokens out of normal chat history and uses the operating-system credential path used by the application.
Remote mutating actions remain subject to backend approval and provider permission checks.
You can avoid connected-service processing by not enabling those integrations.
15. GitHub Integration
If you connect GitHub, OpenMindAI may access repository information, files, issues, pull requests, Actions, releases, or other authorized repository data depending on the permissions you grant and the action you request.
GitHub independently processes information under its own terms and privacy documentation.
Local Git usage and local Project files do not require remote GitHub access.
You should grant only the GitHub permissions necessary for the tasks you want OpenMindAI to perform.
Disconnect GitHub when you no longer want the integration to have authorized access.
16. Google Workspace and Microsoft 365
OpenMindAI can optionally connect to Google Workspace services such as Gmail, Drive, Calendar, and Contacts, and to Microsoft 365 services such as Outlook, OneDrive, Calendar, and Contacts.
These services require network access and account authorization.
When you ask OpenMindAI to read or perform an action using a connected account, information relevant to that request may be retrieved from or sent to the external provider.
OpenMindAI does not treat authorization to one service as authorization to access every unrelated service.
Provider permissions and OpenMindAI approvals should limit each integration to the scope necessary for the user-requested workflow.
17. Slack, Notion, Dropbox, and MCP
OpenMindAI may support optional workflows using Slack, Notion, Dropbox, and compatible MCP servers.
These are remote or externally connected services.
Data handling depends on the service you connect, the permissions you grant, the action you request, and any MCP server you configure.
An MCP server can be operated by a third party or by the user. You are responsible for reviewing the security and privacy of an MCP server before allowing it to receive sensitive data or access important systems.
18. Website Data and Cookies
When you visit an OpenMindAI website, normal internet infrastructure may process technical request information such as IP address, browser type, requested URL, timestamps, security events, and server logs.
The exact website analytics, cookies, CDN, hosting, and security services used by OpenMindAI must be disclosed according to the deployed website configuration.
OpenMindAI should not use non-essential cookies or tracking technologies in jurisdictions that require consent without providing the required choice.
If the website deploys analytics, advertising, embedded third-party media, or marketing technologies that are not described in this Policy, this Policy and any cookie controls should be updated accordingly.
Essential cookies or storage may be used where necessary for security, preferences, authentication, or core website functionality.
19. How We Use Information
Where OpenMindAI receives or processes information remotely, it may be used to provide the feature requested by the user, maintain application security, diagnose technical failures, deliver software or model downloads, provide support, operate connected services, understand app-level usage, maintain service reliability, comply with applicable law, prevent abuse, and improve OpenMindAI.
We should not use personal information collected for one purpose for a materially incompatible purpose without a lawful basis and appropriate notice.
Local data that has not been transmitted to OpenMindAI is not available to us for general profiling, advertising, or remote analysis.
20. Legal Bases Under the GDPR
Where the GDPR applies and OpenMindAI acts as a controller, processing must have an appropriate legal basis.
The exact basis depends on the activity.
| Processing Activity | Possible GDPR Basis | Important Qualification |
|---|---|---|
| Responding to a support request | Performance of a requested service or legitimate interests | Depends on the nature of the request |
| Delivering software/model downloads | Contract or steps requested by the user | Network providers also process technical data |
| Connected-app action requested by the user | Performance of the requested service | Provider terms and permissions also apply |
| Security logging | Legitimate interests | Must be necessary, proportionate, and retained appropriately |
| Legal compliance | Legal obligation | Only where a legal requirement applies |
| Optional analytics | Consent or another valid legal basis depending on jurisdiction/configuration | ePrivacy and local consent rules may also apply |
| Optional marketing | Consent or legitimate interests where legally permitted | Direct-marketing objection rights must be respected |
| Local-only inference | Usually not publisher-held controller processing if the data never leaves the user's device | Local device processing remains subject to the user's own context and applicable law |
This table is not a substitute for a formal legal-basis assessment.
OpenMindAI should maintain an internal record of which lawful basis applies to each actual production processing operation.
21. GDPR Principles
OpenMindAI is designed to support the GDPR's core data-protection principles.
| GDPR Principle | OpenMindAI Privacy Approach |
|---|---|
| Lawfulness, fairness, transparency | Explain local versus remote processing and disclose third-party services |
| Purpose limitation | Use data for the feature or purpose communicated to the user |
| Data minimisation | Prefer local processing and request only the permissions/data needed for a selected feature |
| Accuracy | Provide mechanisms to correct publisher-held personal information where applicable |
| Storage limitation | Do not retain publisher-held personal information longer than necessary |
| Integrity and confidentiality | Use appropriate security controls, protected credential storage, and transport security |
| Accountability | Maintain documentation, release reviews, processor/service records, and privacy disclosures |
| Data protection by design/default | Keep ordinary inference local where practical and make connected capabilities optional |
OpenMindAI's local-first design can reduce the amount of user content that needs to be transmitted to a remote controller, but architecture alone does not create legal compliance.
Operational controls, legal bases, contracts, retention practices, security, user rights, and truthful disclosures remain necessary.
22. Your Rights Under the GDPR
If you are located in the European Economic Area or another jurisdiction where the GDPR applies, you may have rights relating to personal data controlled by OpenMindAI.
These can include the right to be informed, access, rectification, erasure, restriction, portability, objection, withdrawal of consent where consent is the legal basis, and rights related to certain automated decision-making.
| Right | What It Means |
|---|---|
| Access | Ask whether we process your personal data and obtain a copy where applicable |
| Rectification | Ask us to correct inaccurate personal data we hold |
| Erasure | Request deletion where the legal conditions are satisfied |
| Restriction | Request restricted processing in certain circumstances |
| Portability | Receive eligible personal data in a structured, machine-readable form |
| Objection | Object to certain processing, including direct marketing |
| Withdraw consent | Withdraw consent for future processing where consent is the basis |
| Complaint | Lodge a complaint with a competent supervisory authority |
These rights apply to personal data controlled by us.
If your conversation history or project files exist only on your own device and have never been sent to us, we cannot remotely provide or erase information that we do not possess.
In that situation, local application controls such as delete conversation, clear history, remove attachments, delete models, revoke a permission, disconnect a service, or uninstall the application may be the appropriate way to exercise control over that local data.
23. California Privacy Rights
California residents may have rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act, subject to the law's applicability and exceptions.
These rights can include the right to know about personal information collected and how it is used or disclosed, the right to delete certain personal information, the right to correct inaccurate personal information, the right to opt out of certain sale or sharing, the right to limit certain uses of sensitive personal information where applicable, and the right not to receive discriminatory treatment for exercising applicable privacy rights.
OpenMindAI does not use local AI conversation content that never leaves your device as a remote advertising profile.
If OpenMindAI engages in activity that legally constitutes a "sale" or "sharing" under California law, the appropriate notice and opt-out mechanisms must be provided.
24. Sale, Sharing, and Advertising
OpenMindAI is not designed as an advertising-data business.
We do not intentionally sell local prompts, responses, local model files, local chat history, or local Project files for money.
The current mobile application uses Firebase Analytics for app-level usage analytics. Analytics providers and connected services can receive information as described in this Policy and their own terms.
Whether a particular analytics or advertising technology constitutes a legally defined "sale" or "sharing" can depend on how that technology is configured and used.
If OpenMindAI later introduces advertising, cross-context behavioral advertising, advertising identifiers, or a practice that triggers a statutory opt-out requirement, this Policy and the product controls must be updated before or when that practice begins.
25. Data Retention
Local data is generally retained on the user's device until the user deletes it, removes the application data, changes storage, or uninstalls the application, subject to platform behavior and any backups the user controls.
Publisher-held or third-party-held data must follow separate retention rules.
| Data Category | General Retention Approach |
|---|---|
| Local conversation history | Until the user deletes or clears it locally |
| Local model files | Until the user removes them |
| Local attachments | Until relevant local cleanup/deletion removes them |
| Local project files | Controlled by the user in the underlying filesystem |
| Support messages | Retained as long as reasonably necessary to resolve/support the request and meet legal/security obligations |
| Security logs | Retained for a limited period appropriate to security and operational needs |
| Analytics data | Retained according to the configured analytics settings and provider terms |
| Connected-app data | Subject to OpenMindAI's local cache behavior and the connected provider's retention policies |
| Website logs | Retained according to hosting/security needs and applicable policy |
Before publication, OpenMindAI should replace any general retention language with concrete retention periods where a law, store policy, or production implementation requires them.
26. Data Deletion
OpenMindAI provides or is designed to provide local controls for deleting user-controlled local information such as conversations, models, and application data.
OpenMindAI Mobile includes chat deletion and full-history cleanup functionality.
Removing a local model deletes that model file but does not necessarily delete conversation history.
Deleting conversation history does not necessarily delete exported copies or backups stored elsewhere by the user.
If you send information to an external provider through a connected service, deleting it from OpenMindAI may not automatically delete the provider's copy.
You may need to use that provider's deletion controls or privacy request process.
If OpenMindAI later offers online user accounts, account deletion must also remove associated publisher-held data as required by applicable law and store policy, subject to lawful retention exceptions.
27. Data Export and Portability
OpenMindAI Mobile currently includes conversation export functionality.
Desktop-generated artifacts and local files can also be user-controlled outside the conversation interface depending on the feature.
Where GDPR data portability applies to personal data held by OpenMindAI as controller, eligible information should be provided in a structured, commonly used, machine-readable format.
Data portability requirements do not require OpenMindAI to remotely export local-only information that the publisher never received.
Users should maintain their own backups of important local work.
28. Security
OpenMindAI uses a local-first design to reduce unnecessary remote exposure of prompts, local files, and model data.
Desktop connected credentials and OAuth tokens are designed to stay out of chat history and to use protected operating-system credential storage.
Project file and terminal permissions are deliberately separated from ordinary Chat.
Broader Full PC + Terminal access requires an explicit permission path in the desktop architecture.
Agent execution is designed with bounded execution, output limits, command limits, timeouts, duplicate-action protections, failure budgets, and validation requirements.
OpenMindAI also uses model verification and application release validation mechanisms.
No system can guarantee absolute security.
Users remain responsible for securing their operating system, login credentials, device encryption, backups, local project permissions, connected accounts, and physical devices.
If you believe you have found a security issue, use the official OpenMindAI security or contact channel rather than publicly disclosing exploitable details before maintainers have a reasonable opportunity to respond.
29. International Data Transfers
OpenMindAI's local-only data does not need to cross an international border simply to be processed by a local model.
Remote features are different.
Firebase, hosting providers, connected services, search/retrieval providers, GitHub, Google, Microsoft, Slack, Notion, Dropbox, model hosts, and other providers may process information in countries other than the user's country.
Where OpenMindAI is responsible for an international transfer of personal data subject to the GDPR or another transfer regime, an appropriate transfer mechanism must be used where required.
Depending on the provider and circumstances, this may include an adequacy decision, Standard Contractual Clauses, another recognized safeguard, or another lawful transfer mechanism.
Third-party providers may also describe their own transfer mechanisms in their privacy documentation.
30. Children's Privacy
OpenMindAI is not designed as a child-directed service.
The application is intended for general productivity, local AI, research, development, learning, and professional use.
We do not knowingly design the service to solicit personal information from children in violation of applicable child-privacy law.
If a parent or guardian believes that a child has provided personal information to an OpenMindAI-operated online service in a way that violates applicable law, they may contact us through the Privacy Contact listed in this Policy.
Where local law requires parental authorization for online processing involving a child, that authorization must be obtained before the relevant remote service is used.
A local AI model running entirely on a family's own device is technically different from publisher-held online personal data, but parents and guardians remain responsible for supervising a child's device use and AI interactions.
31. AI-Generated Content and Automated Decisions
OpenMindAI generates content using artificial intelligence.
AI-generated responses can be inaccurate, incomplete, misleading, biased, or unsuitable for a particular context.
OpenMindAI should not be treated as a final decision maker for medical, legal, financial, employment, credit, insurance, education, law-enforcement, or other high-impact decisions without appropriate human review.
OpenMindAI does not intend to use publisher-held personal data to make solely automated decisions about users that produce legal or similarly significant effects unless such processing is separately disclosed and legally permitted.
If a future OpenMindAI service introduces such automated decision-making, this Policy must be updated with the required explanation, safeguards, and user rights.
32. Third-Party Model and Download Sources
OpenMindAI can download models, runtimes, updates, and other components from external hosting or distribution services.
Those providers can receive normal network information such as IP address, requested file, timestamp, and transport metadata.
A model source may have its own terms, privacy policy, license, acceptable-use rules, and geographic restrictions.
OpenMindAI attempts to keep model provenance and verification under application control, but users should review applicable model licenses before using models for regulated, commercial, or redistribution purposes.
Model files are not treated as personal information merely because they are installed on a user's device, but logs about model downloads can contain technical metadata associated with a device or connection.
33. Open Source and Diagnostic Information
OpenMindAI desktop is developed as an open-source project.
If you voluntarily create a public GitHub issue, pull request, discussion, commit, or other public contribution, the information you publish there may be publicly visible and processed by GitHub.
Do not include passwords, access tokens, private user data, confidential documents, proprietary source code, or sensitive logs in a public issue.
If OpenMindAI offers diagnostic export functionality, review the diagnostic package before sharing it.
Diagnostics should be designed to exclude secrets and unnecessary personal content, but users should still verify what they are sending.
34. Business Transfers and Legal Requirements
If the OpenMindAI project, business, or assets are reorganized, transferred, merged, acquired, or otherwise changed, publisher-held personal data may be transferred where legally permitted and subject to appropriate notice and protections.
We may also preserve, access, or disclose publisher-held information where reasonably necessary to comply with applicable law, legal process, court orders, or enforceable governmental requests; protect users or the public; investigate security incidents; prevent fraud or abuse; or establish, exercise, or defend legal claims.
This section does not give us access to local-only data that we do not possess.
35. Changes to This Privacy Policy
OpenMindAI will evolve.
New models, runtimes, integrations, analytics tools, synchronization features, stores, connected services, or AI capabilities can change data flows.
When this Policy changes materially, the Last Updated date should be revised and an appropriate notice should be provided where required.
A material privacy change should not be hidden inside a routine software update.
Where applicable law requires consent for a new processing purpose, OpenMindAI should request that consent rather than relying only on a revised policy.
36. How to Exercise Privacy Rights
To submit a privacy request relating to personal data held by OpenMindAI, use:
https://www.openmindai.org/contact
Your request should identify the privacy right you want to exercise and provide enough information for us to locate the relevant publisher-held data.
We may need to verify your identity before fulfilling certain requests in order to prevent unauthorized access or deletion.
We will not ask you to provide passwords or private authentication secrets to verify a privacy request.
For local-only data stored exclusively on your device, use the OpenMindAI in-product controls or operating-system storage controls because we may not possess that data remotely.
For data held by a connected third-party provider, you may also need to submit a request directly to that provider.
37. Supervisory Authority and Complaints
If the GDPR applies to you, you may have the right to lodge a complaint with a competent data-protection supervisory authority.
You may generally contact the authority in the EU/EEA country where you live, work, or where you believe an infringement occurred, subject to the GDPR's jurisdictional rules.
We encourage users to contact OpenMindAI first when practical so we have an opportunity to address a privacy concern, but exercising your right to contact a supervisory authority does not depend on first resolving the issue with us.
38. Contact Us
For privacy questions, deletion requests relating to publisher-held data, privacy complaints, or questions about this Policy, contact OpenMindAI through:
Website: https://www.openmindai.org
Contact: https://www.openmindai.org/contact
For app-store releases, the developer or legal entity name shown in the applicable store listing should match the identity disclosed in the published Privacy Policy.
If OpenMindAI later appoints a Data Protection Officer, EU representative, UK representative, or other legally required privacy representative, the relevant contact details should be added to this section.
39. Data-Flow Reference Table
| Feature | Local Data Used | Data Leaving Device | Recipient | User Can Avoid Remote Processing? |
|---|---|---|---|---|
| Normal local Chat | Prompt, history, model context | None required for inference | None required | Yes |
| Think / local reasoning | Prompt and local context | None required if using local model | None required | Yes |
| Local document analysis | Selected document | None required for local processing | None required | Yes |
| Local vision | Selected image + local vision model | None required for local processing | None required | Yes |
| OpenMindAI Hear | Microphone audio | Designed for local speech workflow | None required for local processing | Yes |
| OpenMindAI Speak | Response text | Depends on local/device TTS path | Platform speech service where applicable | Usually |
| Mobile Canvas | Prompt/context | Current design uses local SVG synthesis | None required | Yes |
| Search | Query/context | Yes | Search/retrieval infrastructure | Yes, by not using Search |
| Deep Research | Research query/context | Yes | Public-web retrieval infrastructure | Yes, by not using Research |
| Model download | Requested model identifier + network metadata | Yes | Model hosting provider | No, if downloading a new model |
| Software update | Version/update request metadata | Yes | Release/update infrastructure | No, if checking/downloading updates |
| Firebase Analytics | App-level event/technical analytics data | Yes | Google/Firebase | Depends on released consent/settings configuration |
| GitHub | Requested repo/action data | Yes | GitHub | Yes |
| Google Workspace | Requested account/action data | Yes | Yes | |
| Microsoft 365 | Requested account/action data | Yes | Microsoft | Yes |
| Slack | Requested workspace/action data | Yes | Slack | Yes |
| Notion | Requested workspace/action data | Yes | Notion | Yes |
| Dropbox | Requested file/action data | Yes | Dropbox | Yes |
| MCP | Depends on configured server | Potentially | MCP server operator | Yes |
| Support contact | Message and contact details provided by user | Yes | OpenMindAI support infrastructure | Yes, unless support is needed |
40. Mobile Permission Reference Table
| Permission / Protected Resource | Platform | Current Purpose | Required for Core Text Chat? | User Control |
|---|---|---|---|---|
| Internet | Android / iOS | Downloads, Search, Research, Analytics, updates, connected services | Not after local setup for normal local Chat | Disable network; online features stop working |
| Camera | Android / iOS | Lens and image/document capture | No | Grant/deny/revoke in OS settings |
| Microphone | Android / iOS | Voice input | No | Grant/deny/revoke |
| Photo Library | iOS/iPadOS | Select images to attach | No | Grant limited/full/deny according to OS |
| Notifications | Android / iOS | Completion notifications | No | Grant/deny/revoke |
| Biometrics / Face ID | Android / iOS | Optional app lock | No | Enable/disable biometric lock and OS permission |
| Broad storage access | Android | Current design does not request MANAGE_EXTERNAL_STORAGE |
No | Files use pickers/app-private storage |
Sensitive permissions should be requested when the relevant feature is used rather than simply because the application declares that capability.
41. GDPR Compliance Mapping
This table is intended for product governance and policy maintenance.
It does not state that OpenMindAI has received a GDPR certification.
| GDPR Area | Current OpenMindAI Design | Required Operational Control |
|---|---|---|
| Transparency | Local vs online behavior documented | Keep Privacy Policy and UI disclosures accurate |
| Data minimisation | Local-first inference; scoped permissions | Review every SDK, event, log, and permission |
| Purpose limitation | Permissions tied to features | Do not repurpose data without lawful basis/notice |
| Storage limitation | Local user deletion; remote retention should be limited | Publish/configure real retention periods |
| Security | Protected credentials, scoped agents, local isolation | Patch management, encryption, incident response |
| Rights | Local deletion/export plus privacy contact | Formal workflow for controller-held access/deletion requests |
| Consent | OS permission prompts and feature controls | Implement analytics/cookie consent where legally required |
| Processor governance | External providers used only for selected features | Maintain processor/subprocessor inventory and agreements |
| International transfers | Local processing reduces transfers | Use appropriate safeguards for remote transfers |
| Privacy by design | Local-first architecture | Include privacy review in release process |
| Accountability | Documentation and release checks | Maintain records and evidence of actual compliance |
42. Publication and Store-Review Checklist
Before publishing this Privacy Policy, the OpenMindAI release owner should verify the exact released application rather than relying only on documentation from an earlier build.
| Review Item | Must Match Production |
|---|---|
| Product/developer name | Store listing and website |
| Privacy contact | Active and monitored |
| Privacy URL | Public HTTPS page, not login-gated |
| Android permissions | Released AndroidManifest.xml |
| iOS usage descriptions | Released Info.plist |
| Firebase events | Actual Firebase configuration |
| Analytics consent | Actual EEA/UK and other jurisdiction behavior |
| Google Play Data safety | Policy and released SDK behavior |
| Apple App Privacy | Policy and released SDK behavior |
| Microsoft Store privacy declaration | Policy and released desktop behavior |
| Model download hosts | Current catalog |
| Search/Research providers | Current production implementation |
| Connected apps | Current production integrations |
| Data retention | Real configured periods |
| Account deletion | Required if online account creation exists |
| Local deletion/export | Tested in current build |
| Security contact | Current and accessible |
| Children/target audience | Matches store classification |
| Advertising | Policy must change before any ad/tracking rollout |
| Cloud AI | Policy must change before remote inference is introduced |
| Crash reporting | Must be disclosed if added |
| Cloud sync | Must be disclosed if added |
Privacy Summary
OpenMindAI is designed to keep ordinary AI inference and local working data on the user's own device whenever possible.
Local Chat, local models, local conversation history, local documents, local Projects, and supported local AI features do not need to become cloud services simply because the application can also access the internet.
Online processing is used when a selected feature genuinely requires it, including Search, Deep Research, model downloads, updates, mobile analytics, connected applications, and support.
The privacy principle behind OpenMindAI is:
Keep local work local where possible. Make connected processing intentional. Give users control over permissions, models, storage, history, integrations, and deletion.
Windows · macOS · Linux · Android · iOS
Website: https://www.openmindai.org
Privacy Contact: https://www.openmindai.org/contact