MindDesk Privacy Policy
1. Who We Are
MindDesk is a browser extension and accompanying cloud service independently developed and operated under the Humbyte brand. It helps users organize, save, and reuse prompts (Prompt) and responses (Context) from AI websites.
In this Privacy Policy, "we," "us," and "our" refer to the operator of MindDesk.
Operating brand: Humbyte
Contact email: minddesk-support@hum-byte.com
2. Information We Collect and Process
Account Information
When you register an account, we collect your email address and display name. Your password is stored using one-way hashing, and we cannot view your original password.
We also record your email verification status, the version of this Privacy Policy you agreed to, and the time of your agreement.
Device Information
When the MindDesk extension is first installed, it generates a random device identifier. This identifier is used to:
• Identify devices and manage simultaneous sign-in limits.
• Limit each device to one free trial.
• Issue and verify device-specific licenses for local features.
We record the device identifier, browser type (Chrome or Edge), device name, device registration time, and most recent activity time.
The default device name is generated from the browser and operating system, such as "Chrome · Windows." You may change the device name yourself.
We do not collect device hardware information or use browser fingerprinting to identify users.
Login Sessions and Rate Limiting
We process login tokens and their expiration times to maintain and verify login sessions.
To prevent malicious login attempts and request abuse, endpoints such as login, registration, and password reset record request IP addresses, request paths, and related rate-limiting information.
This information is used solely to enforce request rate limits. Rate-limit records are regularly cleaned up. Records older than 24 hours are deleted once per day, so the actual retention period is up to approximately 48 hours.
Cloudflare may also process IP addresses and browser request information when providing network and security services. See Section 4 for details.
Data Stored Locally in Your Browser
MindDesk does not automatically save or upload your complete conversations on AI websites.
To provide its saving functionality, the extension may temporarily read webpage content relevant to that functionality on supported AI websites.
Only when you actively click the save button are the selected prompts and responses saved to your browser's local storage, together with their title, source AI website, and webpage URL at the time of saving.
If you have not enabled cloud synchronization or manually initiated an upload, this content remains in your browser and is not uploaded to MindDesk servers.
The operator cannot retrieve local content that has not been uploaded through the cloud service.
Cloud Data (Only When Using Cloud Service)
After you activate cloud service, relevant content is uploaded to MindDesk servers only under the following circumstances:
• You enable automatic synchronization, and the extension uploads content according to your synchronization settings.
• You manually click "Sync Now."
• You manually click "Upload to Personal Storage."
When you first use cloud service, the extension asks whether you want to enable automatic synchronization. You can disable this feature at any time.
Uploaded data includes titles, content, associated folders, and source information (the source AI website and webpage URL).
This data is encrypted and stored on the server to provide cloud storage and synchronization functionality.
Server-side encryption is not the same as end-to-end encryption. The server must process relevant data to perform storage and synchronization operations, but this does not mean that the operator uses your content for human review or content analysis.
Transaction Information (Only When You Make a Payment)
When you purchase local features or subscribe to cloud service, we record:
• The product purchased or subscribed to.
• Transaction amount, currency, time, and status.
• Creem order ID and customer ID.
• The time of your confirmation regarding immediate delivery of digital content or services and the related right of withdrawal.
• The version of the terms associated with that payment confirmation.
This information is used to manage paid access rights, verify transactions, and resolve related disputes.
Payments are handled by Creem as the seller. Payment information, such as card numbers, is processed directly by the payment platform. We do not handle or store complete payment card numbers.
Service Logs
To maintain service security and troubleshoot technical issues, we may record account identifiers, request results, error information, and other necessary technical information.
We do not intentionally log passwords, login tokens, or the full text of prompts and responses saved by users in our application logs.
Depending on its actual service configuration, Cloudflare may process IP addresses, request URLs, browser request information, and network security logs.
MindDesk does not maintain a complete record of your browsing history. When you actively save content, its source webpage URL is stored along with that content.
We do not display advertisements or sell users' personal information.
3. How We Use Information
We process relevant information only to the extent necessary to provide and maintain MindDesk. Specifically, we use it to:
• Register, verify, and manage user accounts.
• Process logins, maintain login sessions, and reset passwords.
• Identify devices and enforce simultaneous sign-in limits and free trial eligibility restrictions.
• Issue and verify licenses for local features.
• Store and synchronize cloud data that users choose to upload.
• Manage purchases, subscriptions, and corresponding access rights.
• Maintain necessary transaction confirmation records.
• Send email verification messages, password reset messages, and essential service notifications.
• Prevent malicious logins, account abuse, and circumvention of service restrictions.
• Troubleshoot technical issues and maintain service security and normal operations.
• Comply with applicable legal obligations.
The legal grounds for processing relevant information include providing services requested by users, user consent, and other lawful grounds permitted or required by applicable law.
We do not use prompts or responses saved by users for advertising, sale to third parties, AI model training, or purposes unrelated to MindDesk.
The operator does not actively read users' saved prompts or responses for routine operations or content analysis.
Human access to such data may occur only in limited circumstances, including when a user explicitly authorizes support involving specific data, when necessary for security investigations, when required to comply with legal obligations, or in other circumstances permitted by Chrome Web Store policies.
4. Third-Party Services and International Data Transfers
MindDesk uses the following third-party service providers to deliver necessary services.
Cloudflare
Cloudflare is used for service hosting, database and file storage, and network security protection.
Depending on the features you use, Cloudflare may process account information, device information, uploaded cloud data, network request information, IP addresses, and necessary technical logs.
Resend
Resend is used to send email verification and password reset messages.
Resend processes recipient email addresses, email content, and related information necessary for email delivery.
Creem
Creem acts as the seller (Merchant of Record) and handles payments, taxes, invoices, and related transaction matters.
Creem processes payment information and transaction records in accordance with its own privacy policy and applicable laws.
Creem is responsible for the data it independently processes in its capacity as the seller.
International Data Transfers
The service providers listed above may process or store data outside the country or region where you reside.
Actual data processing locations depend on each provider's infrastructure and the service configurations used by MindDesk.
Where applicable law requires disclosure of information concerning international data transfers, we will provide the relevant information as required by law, including recipients and their contact details, processing countries or regions, categories of data involved, processing purposes, transfer timing and methods, retention periods, and applicable methods for refusing transfers and the consequences of refusal.
Except as necessary to provide the Service, maintain security, comply with legal obligations, or in other circumstances permitted by applicable law, we do not disclose users' personal information to unrelated third parties.
5. Data Retention Periods
Account and Device Information
Account and device information is generally retained until you delete your account, except where continued retention is required by applicable law.
Device-related records include basic device information, free trial claim records, and local feature license records.
The normal retention period for local feature license issuance records is 90 days.
Free trial claim records are used to determine whether a device has already received a free trial and are retained for that purpose while the account remains active.
When you delete your account, all of the above device-related records are deleted from the active database. They are not separately retained for the purpose of preventing another free trial.
Data Stored Locally in Your Browser
You are responsible for managing prompts and responses stored locally in your browser.
You can delete this data using the features provided by the extension.
Local data and cloud account data are managed separately. Deleting your account may not also delete data already stored locally in your browser.
Cloud Data
When your cloud service subscription expires, your cloud data is not immediately deleted.
For 90 days after expiration, you may access your cloud data and import it into your local environment using the features provided by the Service.
Cloud data may continue to be retained after the 90-day period. If the data needs to be deleted, we will notify you by email in advance.
If you manually delete cloud data or your account, the rules in Section 6 apply.
Login and Verification Information
Login sessions remain valid for a maximum of 30 days.
Password reset links are valid for 1 hour, and email verification links are valid for 24 hours.
Once expired, the relevant credentials can no longer be used for authentication and are handled according to the system's cleanup procedures.
Rate-Limiting Records
IP addresses, request paths, and related rate-limiting information recorded to prevent malicious logins and request abuse are used solely to enforce request rate limits.
The system deletes rate-limit records older than 24 hours once per day. The actual retention period is up to approximately 48 hours.
Service Logs
We retain application logs only for as long as necessary to maintain service security and troubleshoot technical issues.
Cloudflare's network and security logs are processed according to the actual enabled service configuration and applicable retention periods.
Data Backups
To prevent data loss, we back up our database daily. Backup copies are retained in a locked state for 90 days and then automatically deleted.
As a result, data already deleted from the active database may remain in backup copies for up to approximately 91 days.
Backup data is used solely for disaster recovery and service continuity, and not for any other purpose.
If a historical backup must be restored, we will take measures to prevent previously deleted data from being restored to active use.
Transaction Records
Transaction records that must be retained by law are retained for the periods required under applicable law.
These records include necessary information about products, amounts, currencies, transaction times, order IDs, customer IDs, and purchase confirmations.
The information is used solely to comply with legal obligations, verify transactions, and resolve related disputes.
When the applicable retention period expires, the records will be deleted or anonymized as required by applicable law.
Transaction records independently retained by Creem as the seller are handled according to Creem's own privacy policy and applicable laws.
6. Account and Data Deletion
You may delete your account at any time by entering your password in the MindDesk extension.
After account deletion, we delete personal information and data associated with that account from our active service systems, including:
• Email address, display name, and password hash.
• All device-related records, including device information, free trial claim records, and local feature license records.
• Login sessions.
• Prompts, responses, and related information stored in the cloud.
• Other account-related information that no longer needs to be retained.
This deletion does not include transaction records that must be retained by law or backup copies whose retention periods have not yet expired.
Relevant data contained in backups is automatically deleted according to the periods specified in Section 5.
Transaction Records
When you delete your account, we remove unnecessary direct associations between transaction records and your MindDesk account.
For records that must continue to be retained by law, we may retain product information, amounts, currencies, transaction times, order IDs, Creem customer IDs, and related transaction confirmation information.
These records are retained solely to comply with legal obligations, verify transactions, or resolve related disputes. They are no longer used for the routine provision of services to the deleted account.
Removing the account association does not mean that the transaction records have been fully anonymized.
Retention and deletion of these records are governed by Section 5.
Transaction records independently retained by Creem under its own privacy policy and applicable laws are not automatically deleted when you delete your MindDesk account.
Data Stored Locally in Your Browser
Deleting your account does not necessarily remove all data already stored locally in your browser.
You may delete this data using the relevant features provided by the extension or your browser.
7. Data Security and Your Rights
Data Security
We take reasonable technical measures to protect user data, including:
• Transmitting data over encrypted connections.
• Storing passwords using one-way hashing.
• Encrypting cloud data on the server.
• Restricting data access through authentication and access controls.
• Reducing the risk of data loss and unauthorized access through necessary backup and network security measures.
Although we take security measures, we cannot guarantee that any internet-based service is completely free from security risks.
Your Rights
You can use the features provided by MindDesk to:
• View your account information.
• Change your account password and device names.
• Access, export, or delete your cloud data.
• Disable automatic synchronization.
• Delete your account.
The extension currently does not provide a feature to directly change your account email address or display name.
If you need to correct this information or exercise other personal data protection rights available under applicable law, you may contact us at minddesk-support@hum-byte.com.
Subject to applicable law, you may also request access to, correction of, deletion of, or cessation of processing of relevant personal information, or withdraw consent where withdrawal is legally permitted.
If the laws of your country or region provide additional data protection rights, including data portability, restriction of processing, objection to processing, or the right to lodge a complaint with a supervisory authority, we will handle such requests in accordance with applicable law.
We may require appropriate identity verification. The exercise of certain rights may be restricted by applicable law in relation to information that must legally be retained.
8. Adults Only
MindDesk is intended exclusively for adults aged 18 or older.
When registering, you must confirm that you are at least 18 years old.
Minors may not register for or use the Service.
If we discover that an account has been registered or used by a minor, we will take measures to discontinue service and handle the related personal information in accordance with applicable law.
9. Changes to This Privacy Policy
When this Privacy Policy changes, we will update its version number.
We will notify users of material changes affecting the collection, use, or processing of personal information through appropriate methods, such as notifications within the extension.
If applicable law requires us to obtain renewed consent, we will request your consent before beginning the relevant processing.
We record the version of the Privacy Policy to which each user agreed and the time of agreement.
10. Chrome Web Store User Data Policy
MindDesk's use and transfer of user information obtained through the browser extension comply with the Chrome Web Store User Data Policy, including its Limited Use requirements.
Specifically:
• We process relevant data only to provide or improve the disclosed features of MindDesk and for necessary operational purposes related to those features.
• We do not sell users' personal information or saved content.
• We do not use user data for personalized advertising, retargeting, or interest-based advertising.
• We do not sell or provide user data to advertising platforms, data brokers, or other third parties for advertising purposes.
• We do not use user data for credit evaluation, lending, or purposes unrelated to the Service.
• We transfer relevant data only when necessary to provide or improve the Service, comply with legal obligations, prevent malicious attacks or abuse, or in other circumstances permitted by platform policies.
• We do not allow humans to read user data except where the user explicitly consents to human access to specific data, where necessary for security purposes, where required by law, or in other limited circumstances permitted by platform policies.
11. Contact
Privacy-related inquiries concerning MindDesk are received and handled by Humbyte.
Privacy contact: Humbyte
Contact email: minddesk-support@hum-byte.com
If you have any questions about this Privacy Policy, our handling of personal information, or data deletion, please contact us using the email address above.