What Mini keeps, and what it never touches.

Mini is local-first. Your tasks live in a file on your device. If you never make an account, nothing you type leaves that device — except the text you deliberately hand to an AI feature.

Last updated 25 July 2026

The short version

Your tasks are stored on your device. With an account, a copy syncs through our servers so your devices stay in step. Mini sends small usage counts that never contain task text, notes, email addresses or account IDs. We don't sell data, we don't run ads, and we don't train AI models on your tasks.

What we store, and where

• Without an account: your tasks and settings stay on your device, in a local database file. The usage counts described below still apply.
• With an account: your email address, a password hash (handled by Supabase Auth), and your synced task data — titles, notes, sections, cases, flags and timestamps — in our Supabase project hosted in the EU. Row-level security means only your own authenticated session can read your rows.
• Billing: the paid tier is not live yet, so no payment data exists. When it launches, card details will be handled entirely by our payment provider and never reach us. This page will name that provider before the first charge is taken.

AI features

When you use an AI action — structuring a brain-dump, or autofill — the text you submit goes through our server-side proxy to a model provider (currently OpenRouter) and the result comes back to you. We count how many runs you make each day so quotas can be enforced. We do not train models on your content; OpenRouter's own policy governs the text while they process it.

If you are signed out and haven't supplied your own model API key, AI features are off and nothing is sent anywhere.

Usage analytics

Mini sends minimal usage counts automatically. Each installation gets a random identifier, and an event carries the event name, the platform and app version, the hour on your clock, a signed-in flag, and one small value such as a screen name or a count. Events never include your task titles, your notes, your email address or your account ID.

Our Cloudflare endpoint turns the connecting IP address into a two-letter country code. The IP is used for that and for rate limiting only — it is never written to our database or our logs. Raw events are deleted after 90 days; daily totals are kept. There is no in-app opt-out in this version.

What we don't do

No advertising. No selling personal data. No cross-site tracking. No reading your tasks, except as needed to run the service or where the law requires it.

Your controls

• Use the app with no account at all, indefinitely, entirely on your own device.
• Delete your account in Settings and your synced rows are removed from our servers. The local file stays yours to keep or delete.
• Email info@heorhiishekunov.org to exercise your GDPR rights — access, rectification, erasure and portability — or to ask anything about this page.