Privacy Policy

This Privacy Policy explains how CryptoBees LLC (“CryptoBees”, “we”, “us”, “our”) collects, uses, discloses and protects information in connection with the miMind mind-mapping application (the “App”) on all platforms it runs on (Windows, macOS, Linux, iOS, Android and the web), our related websites, our cloud sync and account backend, and the miMind AI features (together, the “Services”). By using the Services you agree to the practices described here and in our Terms & Conditions.

1. Who we are

The Services are provided by CryptoBees LLC. For all privacy questions, requests and notices, contact us at cryptobees@gmail.com. For the purposes of the EU/UK GDPR, CryptoBees LLC is the “controller” of the personal data described in this policy, except where we act as a processor of the content you create (your maps).

2. Information we collect

What we collect depends on how you use the Services. If you never create an account, we do not collect account or content data in the cloud; your maps stay on your device.

a. Account & identity information

If you create an account or sign in, our authentication provider (Google Firebase Authentication) records the identifiers associated with your sign-in method. We support email/password sign-in and federated sign-in with Google, Apple, Microsoft and Facebook. Depending on the method, this includes: your email address, display name, profile photo URL (if your provider supplies one), the provider’s user identifier, a unique miMind user ID, and whether your email is verified. We do not receive your password when you use a federated provider.

b. Purchase & subscription information

When you buy a Premium, miMind AI or Agentic subscription or upgrade, the purchase is processed by the relevant app store or reseller (see §8). We store the entitlement result linked to your account — which products/features you are entitled to, the product (SKU) purchased, a purchase/transaction token used to verify and re-validate the purchase, verification timestamps, and, for web/desktop purchases, a Paddle customer identifier. We do not store your full card number or bank details; those are handled by the payment processor.

c. Content you create

Your mind maps, notes, node text, images and files you attach, and other content you author are “Content”. Content lives on your device by default. If you enable cloud sync, your map files are stored in our cloud (see §7); if you use AI features, relevant Content is transmitted to our AI provider to fulfill your request (see §4). You retain ownership of your Content.

d. AI usage data

If you use AI features, we record per-account usage metering: counts of AI generations and chat requests, input/output token totals (monthly and daily), agentic-run counters, and the month/day the counters apply to, together with your email for account support and abuse prevention. We do not store the text of your prompts, your map content, your attachments, or the AI’s responses on our AI-gateway servers — those are streamed to the provider and only counted. (Agentic AI results you receive in your in-app inbox are an exception; see §6.)

e. Device, diagnostic & usage data

To operate the App and understand aggregate usage, we collect a limited set of technical data:

• Run information stored with your account: platform, device model, operating-system version, app version and the time of your most recent run.
• Analytics: the App includes Google Analytics for Firebase (GA4), which collects standard app-usage and device information (e.g. app opens, platform, approximate region, and a Google-assigned instance identifier). This is used in aggregate to measure active users and does not require you to sign in.
• IP address for AI region checks: when you make an AI request, your IP address is used transiently to determine your country for the availability check described in §4. We do not store your IP address for this purpose; only the resulting country verdict (allowed/blocked) may be cached to your account.
• Storage usage: if you use cloud storage, we record how much storage you are using and your quota.

f. Communications

If you email us for support or opt in to product news, we keep your email address and the content of your message so we can respond and, if applicable, send updates you asked for.

3. How we use information

• To provide, operate and maintain the App, your account and cloud sync.
• To authenticate you and keep your account secure, including revoking sessions across devices when you ask.
• To process purchases, validate and re-validate subscriptions and entitlements, and manage renewals and refunds.
• To provide AI features — sending your request to the AI provider and returning its response — and to meter usage against your plan’s limits.
• To enforce fair-use limits, detect and prevent abuse or fraud, and apply legal availability restrictions (see §4).
• To measure aggregate usage and improve the Services.
• To communicate with you about support requests, important service or security notices, and (where you opted in) product news.
• To comply with legal obligations and enforce our Terms.

Where required by law, our legal bases for processing are: performance of our contract with you (providing the Services), your consent (e.g. optional analytics, product emails, and using AI features), our legitimate interests (security, abuse prevention, aggregate product analytics), and compliance with legal obligations (including trade-sanctions compliance).

4. AI features & Anthropic

miMind’s AI features (map generation, chat with your map, expansion suggestions, and agentic AI) are optional and are powered by Anthropic’s Claude models. AI requests are routed through our secure cloud gateway to Anthropic; the App does not call Anthropic directly.

What is sent to Anthropic

Only when you invoke an AI feature, and only what your request needs:

• Map generation: the topic, pasted text, or URL you provide, plus any attachments you add.
• Chat with your map: your typed message, the outline of the currently open map (node titles and structure) so the assistant has context, an indication of the node you have selected, and recent turns of that conversation.
• Attachments: images you attach (analyzed with vision), text extracted from files you attach, and links you provide. When you supply a URL or link, Anthropic’s models may fetch that page and may perform web searches to fulfill your request.

What we retain

Our gateway does not persist the content of your prompts, map data, attachments, or the AI’s responses. We retain only the usage counts described in §2(d), and operational logs that contain metadata (such as request type, node counts and token totals) but not the content itself.

How Anthropic handles your data

Anthropic processes the content you send to generate a response. We access Anthropic’s API under commercial terms under which inputs and outputs are not used to train Anthropic’s models. Anthropic may retain data for a limited period for safety and abuse-prevention purposes in accordance with its own policies. Please review Anthropic’s Privacy Policy. You are responsible for the content you choose to submit; avoid sending sensitive personal information you would not want processed by a third-party AI service.

Bring your own key

miMind AI subscribers may supply their own Anthropic API key. That key is stored only on your device, is never uploaded to or stored in our cloud, is used only to authorize your own requests, and is cleared automatically when you sign out or your AI subscription ends. In this mode your requests are billed to your own Anthropic account and are not metered by us, but they still pass through our gateway and are still subject to the availability check below.

Regional availability

Because our AI provider does not serve certain sanctioned jurisdictions, AI features are unavailable in a small number of countries. To enforce this we determine the country of an AI request from network/geo signals or, as a fallback, your device’s locale (and, transiently, your IP address as described in §2(e)). If your location is restricted, the AI request is declined; core (non-AI) miMind features remain available.

5. MCP server & connected agents

The optional miMind MCP server lets you connect external AI agents (such as Claude Code, Claude Desktop, claude.ai or ChatGPT) to your maps, with a personal access token or by signing in with your miMind account. If you enable it:

• Sync is opt-in. Nothing is published until you turn it on. While MCP sync is on, map outlines (node titles and notes, each cut to 160 characters) are published for agents to read.
• The fuller copy. From miMind 26.11.6, the App also publishes a fuller copy of each map it publishes, so agents can read it in more detail: node titles up to 1,000 characters and notes up to 4,000; each node’s colours, shape, bold and italic, whether it is collapsed, and its date; check boxes with their labels and whether they are ticked, the text of other content items, and the size of tables; cross-links with their labels; the map’s theme, layout, scene and background colour; and the web addresses of links, images, video and audio in your nodes, only when they start with http:// or https://. Neither copy ever holds a file path on your device, or your attachments, images or files themselves (the small picture of a map described below shows them at low resolution). The update also gives each node a hidden identifier, saved in the map file, so agents can find the same node again. From that update, encrypted maps and maps you keep away from agents publish neither copy, and whatever removes a map’s outline (see the next point) removes its fuller copy with it.
• Encrypted maps and removal. From miMind 26.11.6, encrypted maps (maps locked with a password or PIN) are never published, and the updated App on desktop and mobile removes an outline already published for one when you encrypt that map there, when you open or save it there while MCP sync is on, and once, while MCP sync is on, for the encrypted maps in its own maps folder (up to 2,000 map files). From that update, turning MCP sync off and choosing Remove when the App asks removes your published outlines (Keep leaves them in place); MCP sync is set on each device, so turn it off on every device where it is on, or the others publish their maps again as you open or save them. Deleting a map in the updated App on desktop or mobile removes its outline when you delete it from a cloud-storage list, or when that device has published it since the update and it was not renamed or moved since. Otherwise an outline may remain until you choose Remove: for example, that of a map deleted or encrypted in the web app or deleted outside the App, of a map an earlier version published and the updated App has not opened since, or of an encrypted map an earlier version published from a Google Drive, Dropbox or OneDrive folder. The update also lets you keep a single map away from agents by turning off Visible to MCP Agents in the open map’s Settings menu (shown while MCP sync is on). The App makes these removals only while you are signed in on a plan that includes MCP. Earlier versions of miMind may still publish encrypted maps and do not remove outlines this way, so update the App on every device where you use MCP sync.
• Access tokens are hashed. When you generate a personal access token it is shown to you once; we never store the token itself, only a SHA-256 hash of it and its first 12 characters (so you can tell your tokens apart), along with your user ID, email, a label, whether it may only read your maps, and when it was created and last used. You can keep up to five tokens, make one that can only read, and revoke any of them instantly; a revoked token is deleted from our servers at once.
• Connecting by signing in. Once we switch it on, some agents (such as claude.ai, Claude Desktop’s connectors, ChatGPT and Claude Code) connect by sending you to miMind’s own sign-in page on mimind.app, where you sign in and choose whether to allow them. If you allow one, we keep a record of that connection: your user ID and email, the app’s name and web address (for example claude.ai, or “an app on this computer”), the access you gave it (read only, or read and change), and when it was connected, last used and last renewed. The tokens the app receives, and the one-time code it exchanges for them, are stored only as SHA-256 hashes. The app never sees your password. A connection ends by itself after 30 days without use, or 180 days after you allowed it.
• Activity record. Once signing in is switched on, for each request a token or a connected app makes to one of the server’s tools, we record the time, which tool, which token or connected app (its label or name, and the first characters of its identifier), and whether it was done, failed or refused; and when an app was connected or disconnected, and why (for example because you disconnected it or changed your password). We never record what was asked or answered, your map content or map identifiers. Each entry is deleted after 90 days. Only you can see your record, on Manage Account.
• Disconnecting. You can see every connected app and token, and disconnect or revoke them, on Manage Account at any time, with or without a subscription, and, from miMind 26.11.6, in the App’s MCP Server dialog. Disconnecting an app deletes its connection and tokens from our servers at once and stops it; changing your password or signing out of all devices disconnects every app within an hour. What an app already received is handled by its provider under its own terms (see the last point).
• Requests that wait for your approval, and messages. From miMind 26.11.6, once we switch it on, an agent can ask to delete or replace something in a map (for example a branch, a link, a note’s text or the text of a check box), or to take back what one of its earlier requests added, and it can leave you a short message. No node, cross-link, content item, label or line animation is deleted, and no note or item text is replaced, until you approve the request in the App. Such a request waits on our servers until you approve or reject it, or for 14 days if you do neither: it holds the map’s title, what the agent proposes to delete or replace (with the titles of those nodes and of their parent nodes), any replacement text, the agent’s stated reason and the name of the token or connected app that sent it. A message holds its text and title and, if it names them, the map and node it is about; it waits until you read it, or for 30 days. Your answer, the reason you give when you reject a request (if any; the agent can read it) and, when you undo or redo an agent’s change in the App, a mark that it was undone (so the agent knows) are kept with the request. Every request and message is deleted at the first sync of your miMind app 30 or more days after it ends (approved, rejected, read, withdrawn or lapsed), and always when your account is deleted.
• Where your files are, and which maps are open. From miMind 26.11.6, once we switch it on, while Sync my maps to the MCP server is on, the copy of each map our server keeps for AI agents also says where its file is: the drive (This Device, miMind Cloud, iCloud, Google Drive, Dropbox or OneDrive), the folder path inside that drive and the file name — never the full path on your device; for maps on This Device, also a code that identifies the device (not its name). Agents you connect use it to find, rename, move, copy and organise your maps, and the results of those requests say where the file went. A map’s place is deleted with its copy: when you delete, hide or encrypt the map, turn MCP sync off and remove the copies, or when your account is deleted; the place a finished request reports is deleted with that request (see below), or sooner when you hide the map or remove the copies. While a map is open in the App, the App tells our server so (the map’s id, that device code and a time), so that agents’ file requests wait until you close it: this is deleted when you close the map, or when the App starts again after it was stopped; otherwise it lapses after 2 hours (8 days while the map has unsaved changes) and is deleted within about a day after that. Requests to create, rename, move, copy or recover files and folders, and text an agent asks to turn into a map, wait on our server until your App does them (at most 7 days, 30 for new maps) and are deleted 30 days after they end (it can take up to a day longer), and always when your account is deleted. None of this is sent to or stored on our server before we switch it on.
• Moving maps to the trash. From miMind 26.11.6, once we switch it on, an agent can ask you to move a map to the trash. Nothing happens until you approve it in the App; then the App moves the map’s file to the trash of the device you approved it on, where it can be recovered for 90 days, only on that device. When you approve, we keep the map’s title, that device code and, while file places are shared, where the map was, so that the agent can ask to recover it; that record is deleted 90 days after the map was trashed (it can take up to a day longer), when the map is recovered, when you hide it or remove your copies, or when your account is deleted. No agent request deletes a file or a folder for good, and none writes over a file that is there.
• Maps shared with you and version history. From miMind 26.11.6, once we switch it on, if a member of a shared map connects an AI agent to miMind, the agent can read, on that member’s behalf, what that member can see of the map, once that member’s app has published the map for agents (Sync my maps to the MCP server on) — with less about people: the display names and roles of the people in it (never their email addresses; a name that looks like an email address is not shown); whether each has it open now and the days they were last there and last edited it (not where in the map they are, nor their device); the conversation’s messages, without the words of people who are no longer in the map; which parts changed recently and who changed each last, as their apps recorded it, with approximate times; and the map’s saved versions — when each was saved and who saved it, as their apps recorded it — with their summaries and, for versions saved while sync was on, their content, including content people later deleted; and who saved the map last and when. Members cannot keep themselves out of what co-members’ agents see; the map’s owner can keep the whole map away from every member’s agent: turning off Visible to MCP Agents for a map you share (in the map’s menu or its Share panel of the desktop and mobile apps — not yet the web app — whether or not your own maps sync to the MCP server) deletes the copies members’ apps published for agents and stops new ones — it does not reach copies members saved as their own files. A map you hid from your own agents before this change is from then on hidden from your members’ agents too. When someone leaves a map or their account is deleted, agents no longer name them: they show as a former member, without the words of their messages, or as another person. What an agent reads goes to the AI service its user chose, under that service’s terms; we keep no copy of it beyond the activity record above (which tools ran and when, never what they read). An agent can also ask you to restore an earlier version of a map; nothing changes until you approve it in the App, and the App first keeps the map as it was as a version.
• Rich content, pictures and exports. From miMind 26.11.6, once we switch it on, the copy of each map our server keeps for AI agents (see the points above) can also hold, for the maps you sync, the contents of tables (titles, headers and cells), lists (titles and items), the type and title of charts, the titles and times of calendar cards, which of your maps a map links to, and the pixel size and type of pictures and videos, and the type of sounds and attachments (never their names or the files, and nothing about places on a map: no address, place name or coordinates). Once we switch it on too, it can also hold a small picture of each map, at most 256 pixels on its longer side and 48 KiB, kept without the image file’s metadata, as the map looked when you last closed it or saved it from its menu: it shows the map’s pictures, place cards and link cards at low resolution, including a card that opens a map you hid from agents; when you change the map, the picture is left out and the one we keep is deleted, until you close the map again. An agent you connect reads these through the MCP tools, and the picture goes to the AI service its user chose. These live inside that copy and are deleted with it: when you turn off Visible to MCP Agents for the map, when the App removes the copy (as described above, with the same exceptions), when you turn off Sync my maps to the MCP server and choose Remove (Keep leaves them; turn it off on every device where it is on), when the owner of a shared map hides it from members’ agents, or when your account is deleted. If we switch either of them off again, new copies are kept without them, and we delete what was already stored by a clean-up we run over the stored copies; until it has run, earlier copies keep them. A version of a map saved in Version History while this was on keeps the rich content (never the picture) with that version, so that agents can read the version, and it is deleted with the version. An agent can also ask the App to save an export of a map (Word, SVG or text) as a new file in the App’s exports folder on your Windows or Linux computer, iPhone or iPad (Documents/miMind Exports; on iPhone and iPad, miMind/Exports in the Files app) — never over a file you have, and never on a cloud drive or on our servers; it stays there until you delete it (on iPhone and iPad also when you delete the App) — and to publish, one at a time, the copies agents read of maps you have not opened since you turned sync on; maps you hid from agents on that device, encrypted maps and maps that already have a copy are skipped (the App first asks our server which of them already have a copy, sending only their ids, which we do not keep), and the MCP Server dialog shows when it last did so. A map you hid on another device while MCP was not available there (signed out, without the plan, or in the web app) is not known to that device, just as when you open the map there. An export is made by the App on your device and saved there: its content never passes through our server, and neither do your pictures, sounds, attachments or map files. What waits on our server is the request — the format and options, and the drive, folder and file name the agent asked for; then its size, or for copies how many maps were published and skipped (and, while file places are shared, where the export went) — at most 7 days, and is deleted 30 days after it ends (it can take up to a day longer), and always when your account is deleted. We also keep two counters of how many exports and copy requests agents asked for today, which keep the daily limits; they are overwritten each day and deleted when your account is deleted.
• Maps shown inside a chat app. Once we switch it on, when you ask a connected chat app that can show interactive views (such as Claude) to show one of your maps, our server sends that map’s synced copy to the app: its title, id and when it was last published, how many topics it has and how they nest, its topic titles (up to 120 characters each) and the start of each topic’s note (up to 200 characters), whether a topic is folded or holds other content, for up to 2,000 topics, and, once map links are switched on, the map’s link — nothing else of it: no pictures, files, places or styles, and none of the links in it. The app draws it in a sandboxed frame inside the chat. The page in that frame comes from our server and holds none of your data; it loads nothing from anywhere else, calls no tool, stores nothing and cannot change your map, and no AI model is used on our side. Like any answer an agent receives, what it shows stays in that chat under the chat app’s own terms. The ready-made prompts the server offers (such as “Summarize a mind map”) are fixed text: we read and store nothing for them, and call no model.
• Compatibility counts. To keep the MCP server working with each chat app, once we switch it on, each of our server’s instances counts, per hour, which protocol versions are used, which well-known apps connect (by fixed names, for example “claude-code”; any other name is counted only as “other”), which capabilities they announce, which kinds of request they make and which tools are called, whether a token or a signed-in app sent each request, and how many requests our limits refused or could not check. These are counts only — never who, from where, or what: no account, email address, token, network address, map, title or anything you or an agent wrote. Counts below 3 are merged into “other”, and each instance writes at most one line of counts for each hour to our server logs (or one more for every 100,000 requests, should an instance ever serve that many in an hour), which keep them for 30 days. Nothing of it is stored with your account.
• Call limits. To keep the service fair, once we switch it on, our server counts how many requests each account’s agents make, in the memory of each server instance (until the instance stops). Where a plan has a daily limit, that day’s count is also stored on our server, as one record holding only the day, the number of requests and when it expires; it is deleted automatically about two days after that day (it can take up to a day longer), and when your account is deleted. If our server cannot check that count, the request is refused, never run.
• Word search for agents. To let a connected agent find your maps by their words, once we switch it on, miMind keeps, with each map’s synced copy, a list of the words in it — in a simplified form that ignores capitals, accents and word endings, with pairs of characters for Chinese and Japanese text, made from the map’s title, its topics’ titles and notes, text items, check boxes, link cards’ labels and the captions of pictures and media, list titles and items, and table titles, headers and cells (never web addresses or file names), together with the at most two languages it is written in. It is made from the copy itself, is not shown to anyone as such, and is deleted with the copy: when you hide the map from agents, when the copies are removed, when the owner of a shared map hides it, or when your account is deleted. No AI model reads or processes it, and what an agent searches for is not stored. If we switch word search off again, new copies are kept without a word list, and a clean-up we run deletes the lists already stored.
• What is inside notes. Once we switch it on, a synced copy also lists what sits inside a topic’s notes and text items — their text, check boxes, links and the web addresses of pictures and media with their captions, tables, lists, charts, calendar cards’ titles and times, which of your maps a note links to, and the kind and size of pictures and files (never their file names or where a place is) — for your agents to read; it is deleted with the copy. A version of a map saved in Version History while this is on keeps them with that version, so agents can read the version, and they are deleted with the version. If we switch it off again, new copies are kept without them, and a clean-up we run deletes what was already stored in the copies (a version keeps its own until it is deleted).
• Your saved scenes. Once we switch it on, when an agent asks, miMind tells it the names of the canvas scenes you saved, when each was saved and how it was made (with AI, from a map or imported), so it can use one; they are read from your account when the agent asks and are not stored by the MCP server (the agent’s own provider receives them, as with anything an agent reads).
• Review mode and agent activity. From the next miMind update, once we switch them on: if you turn on review, changes agents ask for to maps you already have wait in Agent Requests until you approve them in the app (new maps and file requests are not held); the switch is kept with your account until you change it or your account is deleted. The Agent Activity list in the app reads the requests our server already keeps and stores nothing new. The records the app keeps to undo file changes (at most 7 days), to tell you that changes may be waiting for a closed map (at most 30 days) and to count its tries to draw an agent’s drawing (at most 30 days), and, for each account, whether this device saw review on (cleared after 30 days of answers that review is off) and which requests you undid from Agent Activity (at most 50, for 7 days), stay on your device and never leave it.
• Drawings and scenes agents write. Once we switch them on, a drawing (SVG text, checked and cleaned by our server) or a scene an agent writes waits in its request until your app applies it, as any request does; it then becomes part of your map — a drawing as a picture with its checked SVG beside it, a scene as miMind’s checked version. A third daily counter, of how many drawings agents asked for today, keeps the daily limit of drawings; it is overwritten each day and deleted when your account is deleted.
• Scoped to you. A token only ever reaches the maps of the account that created it, and a connected app those of the account that allowed it; one that may only read cannot queue changes. Changes an agent requests are queued and applied by your own copy of miMind, with normal undo.
• Any external agent or client you connect operates under its own provider’s privacy terms, which apply to what you send through it.
• Content agents add. What an agent adds through the MCP server (text, web addresses, places, table and chart data) waits in your request queue on our server until your miMind app applies it, and is deleted at your app’s first sync 30 or more days after it finishes. Once applied it is part of your map. When your map shows it, your device fetches it from where it lives: pictures are downloaded, link previews load, videos play from YouTube or Vimeo, and addresses are looked up with OpenStreetMap Nominatim. Those sites see your device’s network address. Our MCP server never fetches them.
• Live delivery. From miMind 26.11.6, while MCP sync is on and you are signed in, the App keeps a connection to our server (Google Firebase) to learn that an agent queued a request, so it can apply it to a map you have open or build a new map without a restart; the notice holds only which map has new requests and when, never their content, and is deleted when your account is deleted.

6. Agentic AI & webhooks

If you use Agentic AI, you can mark nodes as directives that run on a schedule, on demand, or when triggered by an inbound webhook. For these you configure and we store: the directive’s title and prompt text, the associated map/node identifiers, schedule, an inbound webhook secret, and any outbound webhook URLs you set up (for example to Zapier, IFTTT or a home-automation service). Results, questions and errors produced by a directive are written to your in-app inbox (truncated), so unlike ordinary AI chat, agentic outputs are stored in your account until you delete them. When a directive calls an outbound webhook you configured, the data in that call is sent to the third-party endpoint you chose; that transfer and the receiving service are your responsibility.

7. Cloud storage & encryption

Cloud sync is optional. When you store maps in the miMind cloud, your map files and images are held in Google Firebase Storage under your account, readable and writable only by you. Your map files are encrypted on your device before upload; the per-file encryption keys are stored in your account so you can access your files from your other devices. You may also connect third-party drives (Google Drive, Dropbox, OneDrive) as alternative storage; content you place there is governed by that provider’s terms.

Sharing and collaboration

When you share a map, you and the people you share it with (members) can see each member’s email address, the name on their account and their role; the map’s content as every member’s app writes it, including who changed each part last as their apps record it; who saved the latest revision and when; who has the map open now, when each member was last there and last edited it, and where in the map they are; the map’s conversation, with each message’s author and time; and, on plans with Version History, its saved versions with who saved each one and a summary of the changes — versions can show content that people later deleted. Except saved versions (they are the owner’s Version History), this is stored with the share in Google Firebase, is readable only by the map’s members, and is deleted when the owner stops sharing the map. Pointer positions are deleted about a day after they stop moving; a member’s presence record is deleted when they are removed; a conversation stays until the owner clears it or stops sharing — including the messages of people who left the map or whose account was deleted; saved versions follow Version History’s limits (at most 25 recent and 25 major versions; a version kept before a restore is a significant one, which up-to-date apps normally keep for 30 days for the last five restores, within Version History’s storage budget; older app versions may thin it like any other significant version), and count against the owner’s storage, whoever’s app saves them. When you are removed from a map, you keep a copy of it as your own file.

Versions saved while Sync my maps to the MCP server is on also hold the copy of the map our server keeps for agents, so that agents can read that version; they are deleted with the version.

8. Third-party services we use

We use the following processors and service providers to run the Services. Each receives only the data needed for its function. YouTube (Google) is the exception: it is not our processor, and it collects and uses data under its own policies, as described in “YouTube videos” below.

YouTube videos

miMind uses YouTube API Services: a YouTube video in a map or a presentation plays in YouTube’s own embedded player. By using the Services you agree to be bound by the YouTube Terms of Service. The Google Privacy Policy describes how Google handles information about you; it governs what YouTube collects.

• What miMind keeps. The video’s web address, saved in your map like the rest of its content and deleted with the map or your account. While a video plays, the App reads its play state from the player; that stays on your device. The App never signs in to YouTube, does not read your YouTube account or watch history, and adds no tracking of its own to the player.
• What YouTube receives. When a map shows a YouTube video, the App loads the video’s preview picture from YouTube. The player itself loads only when you press Play. From then on your device connects directly to YouTube, so YouTube receives the details of a normal web request (your device’s network address and browser or web-view information), the video being played, and an identifier for the app or website it is played from. YouTube may collect more during playback, for example to show the video, check whether it may be played, and prevent fraud and abuse.
• Cookies and advertising. YouTube’s player may place or read cookies and similar technologies on your device, in the web view or browser that plays the video, and YouTube may show its own content there, including advertisements. We do not control this.

9. How we share information

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We disclose information only:

• to the processors listed in §8, to provide the Services (YouTube, listed there too, is not one of them: it receives data directly from your device, as §8 describes);
• to the payment processors and app stores needed to complete and verify your purchases;
• where you direct it — e.g. content you share, drives you connect, or agents/webhooks you enable;
• to comply with law, enforce our Terms, or protect the rights, safety and security of our users, the public or CryptoBees; and
• in connection with a merger, acquisition or sale of assets, subject to this policy.

10. Cookies & analytics

Our websites use a minimal set of cookies and similar technologies necessary to run the site and remember your choices. Our store and account pages may use additional cookies described in the applicable cookie notice. In-app analytics are provided by GA4 as described in §2(e). Apart from the YouTube player described in §8, we do not currently serve third-party advertising in the App. If that ever changes, we will update this policy first. YouTube’s embedded player may place cookies in the web view or browser that plays a YouTube video (see §8).

11. Data retention

• Account data is kept while your account is active and for a reasonable period afterward for legal, accounting and anti-fraud purposes.
• Purchase/entitlement records are retained after a subscription ends so we can honor prior purchases and meet tax/audit obligations.
• AI usage counters reset each month; the usage document (with your email) persists for support and abuse prevention.
• Cloud files remain until you delete them or your account is deleted.
• MCP tokens, and the tokens of apps connected by signing in, are stored only as hashes and are deleted as soon as you revoke or disconnect them; transient sign-in tokens are single-use and short-lived. The MCP activity record is kept for 90 days (see §5).
• Requests that wait for your approval, and messages agents leave, are kept until you answer them (at most 14 days) or read them (at most 30 days), and deleted at your app’s first sync 30 or more days after they end, and always when your account is deleted (see §5).
• Where your map files are is deleted with the map’s copy, and which maps are open when you close them, or within about a day after the mark lapses (2 hours, or 8 days with unsaved changes); file requests are deleted 30 days after they end, and the record of a map moved to the trash 90 days after it was trashed or when it is recovered — each can take up to a day longer, and all of them go when your account is deleted (see §5).
• What agents read of shared maps and version history is not kept by us: it is read when an agent asks, and the activity record keeps only which tool ran and when. A request to restore a version is kept like the other requests that wait for your approval (at most 14 days, deleted at your app’s first sync 30 or more days after it ends, and when your account is deleted), and the copy agents read inside a saved version is deleted with that version (see §5 and §7).
• Rich content, map pictures and export requests: the contents of tables and lists, the other rich content and the small picture of a map are deleted with the map’s copy for agents (when you hide the map, remove the copies, or the owner of a shared map hides it; a version saved meanwhile keeps the rich content, never the picture, until the version is deleted), and, after we switch them off, when our clean-up runs; a request to export a map or publish copies is kept at most 7 days and deleted 30 days after it ends; the two daily counters are overwritten each day; all of them go when your account is deleted (see §5).
• Compatibility counts and call limits: the hourly counts hold no personal data and stay in our server logs for 30 days; the request counts in a server instance’s memory go when it stops; a day’s stored request count is deleted about two days after that day, and when your account is deleted (see §5).
• Word lists, items inside notes, drawings and review: a map’s word list and the items listed from inside its notes are deleted with its copy for agents (a version saved in Version History while they were on keeps them until that version is deleted); a drawing or scene an agent wrote is kept with its request (at most 30 days unapplied; the request is deleted at your app’s first sync 30 or more days after it ends) and then only in your map; the drawings counter is overwritten each day; the review switch stays until you change it; the names of your saved scenes are not kept by the MCP server; all of them go when your account is deleted (see §5).
• AI prompt/response content is not retained by us (see §4).
• When your account is deleted, we erase the data associated with it as described in §12, except records we are required to keep by law.

12. Your rights & choices

Depending on where you live (including under the EU/UK GDPR and the California Consumer Privacy Act, as amended), you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, to withdraw consent, and not to be discriminated against for exercising these rights. Because we do not sell or “share” personal information as those terms are defined, there is no sale to opt out of.

You can exercise many choices directly in the App:

• Sign out of all devices to revoke active sessions.
• Turn cloud sync and MCP sync on or off, and delete individual cloud files.
• Revoke MCP access tokens and disconnect apps connected by signing in (on Manage Account, and from miMind 26.11.6 in the App), and, from miMind 26.11.6, remove published map outlines.
• Remove agentic directives and clear inbox items.
• Update your display name and manage email verification and password reset.

Deleting your account. You can have your account and its associated data deleted permanently: email cryptobees@gmail.com from your account email and ask us to delete it. If you signed in with Apple and chose to hide your email, write from any address and tell us your account’s address as Manage Account shows it (it ends in @privaterelay.appleid.com): we check through that address that the request is yours. To protect you against accidental or unauthorized deletion, we first make sure the request comes from you, and then turn on account deletion for your account. You then delete it yourself on Manage Account or, from the next miMind update, in the App (Account, then Manage Account, then Delete Account), where you confirm it is you by signing in again; your account’s email address must be verified. When your account is deleted, we delete it and the personal data associated with it — including your profile, entitlement and usage records, cloud-stored map files and images, encryption keys, MCP tokens, connected apps, the MCP activity record and published outlines, requests and messages from MCP agents, where your map files are and which maps you have open, file requests from MCP agents and the records of maps moved to the trash, and agentic directives and inbox — and sign you out. Some records may be retained where we are required to keep them by law or to resolve disputes or prevent fraud; and while we cancel a subscription billed through our web checkout, we cannot cancel one billed by Apple or Google Play — only they can, so cancel that separately in the App Store or Google Play before you ask, or you will keep being charged. To exercise any other right, contact us at the same address; we will respond within the timeframe required by applicable law. You may also lodge a complaint with your local data-protection authority.

13. International data transfers

We and our processors operate in the United States and other countries. Where we transfer personal data across borders, including from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or equivalent mechanisms offered by our processors.

14. Security

We take reasonable and appropriate technical and organizational measures to protect your information, including encryption of map files on-device before upload, hashing of MCP access tokens and of the tokens of apps connected by signing in, per-user access rules on cloud storage and data, HMAC verification of billing webhooks, and transport encryption. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials and any API or access tokens confidential.

15. Children’s privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. Some features (such as AI and purchases) may have a higher minimum age under the applicable app store’s or provider’s terms. If you believe a child has provided us personal information, contact us and we will delete it. This is consistent with the U.S. Children’s Online Privacy Protection Act (COPPA).

16. Do Not Track

Some browsers offer a “Do Not Track” signal. There is no common industry standard for how to respond to it, and our websites do not currently respond to DNT signals. We limit tracking as described in this policy regardless.

17. Data-breach notification

If a data breach affecting your personal information occurs, we will notify affected users and any relevant authorities without undue delay and as required by applicable law, describing the nature of the incident and the steps we are taking.

18. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to the Services, our practices, or legal requirements. When we make material changes we will update the “Last updated” date above and, where appropriate, provide additional notice. Please review this page periodically.

19. Contacting us

If you have questions, requests or concerns about this Privacy Policy or your data, contact us at:
cryptobees@gmail.com
CryptoBees LLC