What we keep, and what we cannot read.

What you write

Your lines, pages, lists, pictures, drawings, daily to-dos and reminders, and team jobs and replies are end-to-end encrypted. They are locked on your device with a key made from your password, and only the locked copy reaches our server. We do not have the key, so we cannot read them and cannot hand them to anyone in readable form.

To run the service, the server does see some facts about your content, never the content itself: how many lines, lists and jobs you have, how much space you use, the size of each picture, when things last changed, and the bar's speed and loop settings.

If your account was made before 9 September 2026 and you have not signed in since, your notes are still stored unlocked. They are locked the next time you sign in.

Your account

• Email address. To sign you in, and to send sign-up and password-reset codes.
• Password. Never sent to us. Your device turns it into two keys: one proves who you are, and we store only a hash of that; the other locks your notes and never leaves your device.
• Your locked key. The key that opens your notes, stored locked twice: once under your password and once under your recovery key. We can open neither.
• Account dates. When you signed up, last signed in and verified your address, and your trial and subscription dates.

Codes are emailed through Resend, which sees your address and the message. We store codes only as hashes. They work once and expire after 15 minutes. If an email to you bounces, we note that the address cannot be reached so we stop sending to it.

Teams

If you make or join a team, the server keeps the team's name, the email addresses of its members, who has accepted, and whether each job is done and when. The text of each job and each reply is encrypted between the two accounts involved, and the server cannot read it. A public key is published for your account so that a manager can lock jobs for you. It is created only when you make or join a team.

Payments

You pay with bKash, in the bKash app, and then give us the transaction ID. We store that ID, the amount, the period it pays for, whether it was approved and when. We never see your bKash PIN. As with any bKash payment, our bKash statement shows the number the money came from.

Installs, logs and the website

• Install ID. Each install of the app makes a random ID. It does not come from your phone or PC and a reinstall makes a new one. The apps send it with the platform and app version, so we can count how many installs are in use and which versions.
• Downloads. Counted per day as totals, with no address and no IP.
• Server logs. Our server records the IP address, time and address of each request. We use them to fix problems and stop abuse, and for nothing else.
• Cloudflare. Every connection to mindbar.xyz and to our server passes through Cloudflare, which sees your IP address as any network provider does. What you write is already locked when it passes through. Cloudflare's privacy policy applies to that part.
• This website counts visits with Cloudflare Web Analytics, which uses no cookies and does not identify you. There are no ads and no other trackers on it.

On your phone and PC

Everything below stays on your device. Only what you choose to save is sent, and it is locked first like everything else.

• Display over other apps (Android): draws the floating island and the + button.
• Notifications and exact alarms (Android): show your lines in the notification area and on the lock screen, and ring your reminders on time.
• Accessibility service (Android, off unless you turn it on): lets you save text from WhatsApp, WhatsApp Business and WeChat. It watches those apps only, reads the message you long-press or offers what you just copied, and saves nothing unless you tap the offer.
• Share and the text menu (Android): Mindbar receives only the text you send to it from another app.
• Install updates (Android): installs a new version of Mindbar when you tap Update.
• Clipboard (Windows): when you copy text, a small button offers to save it. Nothing is saved unless you click it.

The apps ask for no location, no contacts, no microphone and no access to your files. Pictures you add come through the system picker or camera, one at a time, and are locked before they are sent.

Who else gets anything

Nobody, except the two services that help run Mindbar: Cloudflare, which carries the traffic, and Resend, which delivers our emails. We do not sell data, show ads or share anything with advertisers. If the law makes us hand something over, we can only give what we hold, and for your notes that is the locked copy.

Export and delete

• Export: on the phone, Settings → Account → Export my data. On Windows, the Profile tab → Export my notes. You get everything in one file.
• Delete your account: on the phone, Settings → Account → Delete account. Or email [email protected] from the address on the account and we will delete it for you.

Deleting your account is immediate. It removes your account, everything you wrote, your pictures, your keys, your teams and team jobs, and your sign-in codes and bounce notes, and it detaches your installs from you. We keep the record of any payments you made (transaction ID, amount and dates), because payments have to be accountable. Things you delete inside the app wait in Trash for one day first, so you can change your mind.

Children

Mindbar is not made for children under 13, and we do not knowingly keep data about them. If you think a child has made an account, email us and we will delete it.

Changes

If what we keep changes, this page changes with it, and the date at the top moves.

Contact

Questions or requests: [email protected]. A person answers.