MiniMe
Back to MiniMe Overview
GDPR • HIPAA • CCPA Compliant

Privacy Policy & OAuth Disclosure

Effective Date: November 5, 2026 • Last Updated: November 5, 2026

Mandatory Third-Party Cloud OAuth Disclosure

Google Drive (drive.appdata) & Microsoft Graph (Files.ReadWrite.AppFolder)

MiniMe allows users to optionally synchronize encrypted backup checkpoints and workstream deltas across their own personal devices using their own existing cloud storage accounts: Google Drive or Microsoft OneDrive.

Exact Scopes Requested and Their Purpose:
  • https://www.googleapis.com/auth/drive.appdata: Strictly used to read and write application configuration and client-side encrypted .mmz delta files within Google Drive's hidden, app-sandboxed appDataFolder.
  • Files.ReadWrite.AppFolder: Strictly used to read and write encrypted delta bundles within Microsoft OneDrive's isolated application folder (Apps/MiniMe).
Our Absolute Zero-Access Guarantee:

Neither MiniMe Inc., nor our employees, nor any third party ever inspects, reads, accesses, transfers, stores, or sells your files or data. All data written to your cloud drive is encrypted on your local computer using client-side ChaCha20-Poly1305 symmetric AEAD before transmission. MiniMe does not maintain servers that hold your encryption keys. Therefore, your cloud backups are completely unreadable to anyone other than you on your authenticated hardware.

You can revoke MiniMe's access at any time directly through your Google Account Permissions or Microsoft Account Privacy Dashboard.

1. Core Architectural Privacy Principles

MiniMe was created in explicit opposition to invasive surveillance tools like Microsoft Recall. Our architecture adheres to the following non-negotiable principles:

  • Zero Screenshots & Zero Video: We do not take periodic desktop snapshots, record pixel buffers, or capture webcam streams.
  • Zero Keyloggers: We never capture raw keyboard keystrokes or input buffers.
  • Local-First Persistence: All documents, code AST diffs, session intervals, and Int8 ONNX vector embeddings are stored locally in an SQLite Write-Ahead-Log (WAL) database on your local machine.
  • Zero Centralized Corporate Database: We operate no database of user work activities. There is nothing to breach or compromise on our end.

2. Data We Process on Your Local Device

To provide semantic search and conversational memory, the MiniMe desktop daemon processes the following categories of information strictly on your local computer:

  • Foreground Window Metadata: Active application process name (e.g. `code.exe`, `WINWORD.EXE`), window title, and active duration.
  • Document & File Contents: When an active local file is focused for >= 5 seconds, MiniMe extracts text from PDFs (`.pdf`), Word (`.docx`), PowerPoint (`.pptx`), Excel (`.xlsx`), and code files.
  • Semantic Edit Diffs: Line count deltas (`+lines / -lines`) and active Git repository branch names.
  • Dwell-Gated Accessibility Text: Bounded visible accessibility text (`<= 16 KB`) from browser tabs when dwell exceeds 8 seconds. Password fields, private browsing windows, and known electronic health record (EHR) portals are strictly excluded.

3. HIPAA Safe Harbor De-Identification (45 CFR § 164.514(b))

MiniMe includes a built-in automated 18-identifier HIPAA Safe Harbor scrubber. Before any window metadata, URL, or document chunk is committed to local SQLite storage or provided to an AI model, the following identifiers are sanitized:

Names • Geographic subdivisions • All dates related to an individual • Telephone numbers • Fax numbers • Email addresses • Social Security Numbers • Medical Record Numbers (MRNs) • Health plan beneficiary numbers • Account numbers • Certificate/license numbers • Vehicle identifiers • Device serial numbers • Web URLs • IP addresses • Biometric identifiers • Full-face photos.

4. GDPR Rights & Cryptographic Shredding (Articles 15, 17, 20)

We believe in true technological data sovereignty. MiniMe provides the following tools:

  • Article 17 (Right to Erasure / Crypto-Shredding): You can trigger instantaneous cryptographic deletion of any vault. Destroying the Data Encryption Key renders all encrypted cloud chunks and local databases mathematically irreversible within 50ms.
  • Article 20 (Right to Data Portability): Export your entire workstream memory, document chunks, and standups in standard open JSON, Markdown, or CSV.

5. Contact & Data Protection Officer (DPO)

If you have questions regarding this Privacy Policy or wish to exercise any legal rights, contact our security team at:

MiniMe Inc. — Privacy & Cryptographic Security Team
Email: privacy@tryminime.com
Address: 548 Market St, Suite 89201, San Francisco, CA 94104