Privacy policy

1. Who we are and what this policy covers

This Privacy Policy explains how Aniel Reyes, a sole proprietor doing business as MinDrop (“MinDrop”, “we”, “us”), collects, uses, shares and protects personal information when you use the MinDrop website at mindrop.app, the MinDrop apps for iPhone, iPad, Android and Mac (including MeetDrop), the browser extension, the Kindle tools, the text-message and email features, Mia and other AI features (together, the “Service”). MinDrop is the “controller” (or “business”) responsible for your personal information, except where we process content on your instructions, as described below. Capitalized terms not defined here have the meaning in our Terms of Service.

This policy doesn't cover third-party websites or services you reach through MinDrop (for example a link you save, your carrier or your email provider), which have their own privacy policies.

2. What we collect

Information you give us:

• Account: email address, password (stored only as a salted hash by our authentication provider), optional display name and profile photo, time zone, two-step sign-in settings, and the version and date of the Terms and Privacy Policy you accepted.
• Your content: drops, notes, to-dos, reminders, notebooks, handwriting and drawings, tags, comments, links, photos, files and anything else you save, plus meeting transcripts, summaries, action items and speaker names you add.
• Texts and emails you send in: if you turn on MinDrop Text or email capture, the phone numbers and email addresses you allow, and the messages, headers and attachments you send to MinDrop.
• AI requests: what you type or say to Mia and the replies she gives.
• Things you connect: if you choose to, events from calendars you pick, Apple Reminders lists, and Kindle Scribe notebooks and documents.
• Permissions you give: the date you allowed AI features and MeetDrop transcription, and your SMS opt-in and opt-out status.
• Support and feedback: messages, bug reports, ideas, questions and any screenshot you choose to attach. Each report also includes technical details about your device and app so we can reproduce problems: device model, operating system and app version, language, time zone, display and accessibility settings, battery, storage and network state, sync and permission status, recent error messages, and a random ID for this install of the app. It never includes the content of your board, your password or sign-in tokens.

Information collected automatically:

• Device and security data: IP address, sign-in times and methods, device, operating system and browser type, and app version, used for your sign-in history, to keep accounts secure and to stop abuse.
• Notification tokens: push-notification and Live Activity tokens so we can deliver reminders.
• Usage counts: counts of page views and feature use (for example how many texts or Mia requests an account used this month) kept without advertising identifiers or cross-site tracking.
• Diagnostics: error and service logs needed to keep MinDrop working.

Information that stays on your device: the apps use your approximate location to show the weather on Today. It is rounded to about 1 km, sent directly from your device to our weather provider, turned into a town name by your device's own location service, and never stored in your account. On iPhone, what you say to Mia is turned into text by Apple's speech recognition (on your device where supported); on Android, by the speech-recognition service you have chosen on your device. MinDrop receives only the resulting text, never the audio of what you say to Mia. Calendar and Reminders access on iPhone and Android uses your device's own calendar permissions.

Information from others: other people's personal information may appear in content you save, forward or record (for example in an email you forward or a meeting you record). You are responsible for having the right to share it with us (see Terms, section 4).

Sensitive information: we don't ask for sensitive personal information such as health, financial account, government ID, racial or ethnic origin, religious beliefs or sexual orientation, and we ask you not to store it in MinDrop or send it to AI features. If you do, we process it only to provide the Service to you. MinDrop doesn't create or keep voiceprints or other biometric identifiers, and doesn't intentionally collect consumer health data.

3. How we use it, and our legal bases

We do not sell or rent your personal information; share it for cross-context behavioral advertising or targeted advertising; track you across other companies' apps or websites; show ads; use your content or AI output to train or improve AI models; or make decisions based solely on automated processing that produce legal or similarly significant effects on you. We don't send marketing emails or texts.

4. AI features

Mia and other AI features are optional and off until you allow them. When you use them, the content needed for the request is sent to our AI service provider, MiniMax, which processes it on our behalf to generate a response. Depending on the feature, that includes: what you type or say to Mia and the parts of your board needed to answer (for example matching drops, to-dos or calendar events); the text of Mia's reply when you ask her to speak it aloud; pictures of the handwritten Kindle or notebook pages you ask Mia to review; MeetDrop transcripts (to write a summary and action items); and the text of texts and emails you send to MinDrop (to title and tag them).

• Consent on your account. The app asks for your permission before any of these features first sends your content. We store the date you gave it on your account, so every MinDrop app and our servers honor it. Withdraw it anytime in Settings (for example Settings → Mia). Withdrawing stops future sending; it does not undo processing that already happened.
• Where it goes. MiniMax is headquartered in China. We use its international API platform (api.minimax.io), and your content may be processed or stored outside the United States, including in China and other countries where MiniMax or its providers operate (see International transfers).
• What providers may do with it. We send content to AI providers only to generate the response you asked for. We don't permit them to sell it or use it for advertising, and we don't provide it to them for training their general-purpose models. Each provider's handling of API data, including how long it keeps request logs and whether it may use API data to improve its services, is also governed by that provider's own API terms and privacy policy.
• Output can be wrong. Review what Mia and other AI features produce before relying on it. It isn't professional advice (see Terms, section 6).
• Please don't send sensitive information (such as health, financial account or government ID numbers, or passwords) to AI features.

Mia's replies, the drops she creates and any summaries are saved to your board like your other content. We don't keep a separate copy of your AI conversations beyond what is saved to your board and short-lived service logs.

5. MeetDrop meeting recordings

If MeetDrop is on for your account, you can record a meeting on your phone or Mac to get a transcript, summary and action items.

• The audio is never kept. The recording is streamed through MinDrop's servers to our transcription provider, AssemblyAI (United States), without being saved on our servers. The copy on your device is deleted once it has uploaded. As soon as the transcript is returned, we instruct AssemblyAI to delete its copy of the audio and transcript; if a transcript is never collected, our servers delete the provider's copy automatically within 7 days.
• The transcript is then sent to our AI service provider to write the summary and action items (see AI features).
• Speaker labels separate the voices in a recording so the transcript can show who said what. MinDrop doesn't create or keep voiceprints.
• Calendar events. If your calendar is connected, the event a meeting was recorded in (its title, time, organizer, and the names and email addresses of the people invited) is saved with the meeting. The invitees' names, and names you type, help spell names in the transcript (sent to our transcription provider with the recording) and suggest who each speaker is in the notes (sent to our AI service provider with the transcript). Email addresses aren't sent to either. Suggested names are marked until you confirm them.
• Only the text (transcript, summary, action items, the calendar event and any speaker names) is saved to your account, encrypted with your board. Delete a meeting anytime to remove it.
• Consent. Many places, including Florida and California, require everyone's permission before a conversation is recorded. You're responsible for telling people and getting every consent the law requires before you record (see Terms, section 7). The app reminds you each time.

6. Text messages (SMS/MMS)

If you add a phone to MinDrop Text, we use that number to verify it, receive the texts and pictures you send to MinDrop's number, save them to your board, and reply when you ask (for example GET or FIND). Texts are sent and received through our messaging provider, Twilio (United States), and the mobile carriers involved. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. STOP removes the phone from every MinDrop account.

We do not sell, rent or share mobile phone numbers or SMS opt-in consent with third parties or affiliates for their marketing or promotional purposes. Phone numbers and message content are shared only with our messaging provider and carriers as needed to deliver messages, and with our AI provider if you have allowed AI sorting. See the SMS terms.

7. Email to MinDrop

If you turn on email capture, emails you send or forward to MinDrop from addresses you have allowed are received by our email provider, Resend (United States), and saved to your board, including headers, body and attachments. We check sender authentication (SPF, DKIM and DMARC) to stop spoofing. If you have allowed AI features, the text may be sent to our AI provider to title and tag it. Resend also sends our account emails, such as sign-in codes and password resets.

8. How we share it

We share personal information only as follows:

• Service providers that process it on our behalf, under our instructions and under contracts or terms that require them to protect it and use it only to provide their services to us. They are listed by name in Service providers.
• At your direction: for example when you save a link (our servers fetch that page to build a preview, so the website sees our server's request, not your identity), send a document to your Kindle, or connect a calendar or reminders account.
• Legal and safety: if we believe in good faith that disclosure is required by law, subpoena, court order or other legal process, or is necessary to protect the rights, property or safety of our users, the public or MinDrop, to investigate fraud or security issues, or to enforce our Terms. Where legally permitted, we will try to notify you before disclosing your content in response to a legal request.
• Business transfers: as part of a merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of our business, in which case this policy will continue to apply to your information, and we will notify you of any change in control.
• With your consent in any other case.

We don't sell personal information, and we don't “share” it for cross-context behavioral advertising, as those terms are defined in California law.

9. Service providers

These are the companies that process personal information for MinDrop, what each one receives, where it processes data and how long data is kept. We will update this list before adding a provider that processes your content.

Links to these providers' own privacy policies: MiniMax, AssemblyAI, Twilio, Resend, Supabase, Railway, Cloudflare, Apple, Google, Open-Meteo.

10. International transfers

MinDrop is based in the United States, and our main systems are in the United States. If you use MinDrop from outside the United States, your information will be transferred to, stored and processed in the United States. If you allow AI features, the content they need is also transferred to MiniMax, which is headquartered in China and may process it in China or other countries. Data-protection laws in these countries may differ from, and may be less protective than, those where you live; for example, authorities in the United States or China may be able to request access to data held there under their laws.

Where the law of the European Economic Area, the United Kingdom or Switzerland applies, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses (and the UK Addendum), the EU-U.S. Data Privacy Framework where a provider is certified, or, for optional AI features, your explicit consent after being informed of these risks. You can ask us for more information about these safeguards using the contact details below.

11. Storage and security

Data is encrypted in transit (HTTPS/TLS). Your board and Kindle notebooks are additionally encrypted at rest with an AES-256 key unique to your account, and integration secrets are encrypted and never shown again after saving. We offer two-step sign-in, check new passwords against known breaches, rate-limit sign-in attempts, keep administrative systems separate from customer content (administrators can see account-level facts such as sign-up date, usage counts, terms acceptance and feedback you send, but not your board), and log administrative actions. No service is perfectly secure, so use a strong, unique password and turn on two-step sign-in. More detail, in plain words, is on our Security page.

For offline use, the apps keep a copy of your board on your device (browsers use IndexedDB; the iPhone app uses protected app storage excluded from device backups; the Android app uses private app storage). Signing out or deleting your account clears it on that device; clear other devices separately.

Security incidents. If we learn of a breach of security that leads to unauthorized access to your personal information, we will notify you and the relevant authorities as required by applicable law (for example within 30 days under Florida Statutes § 501.171, and within 72 hours to the lead supervisory authority where the GDPR applies) and tell you what we are doing about it.

12. Retention and deletion

• Your content is kept while your account is active. Deleted drops go to Recently deleted and are removed permanently after 30 days or when you empty it.
• Meeting audio is never stored; the provider's copy is deleted as described in MeetDrop.
• Sign-in history is kept for 90 days and service and diagnostic logs for about 30 days, unless needed longer to investigate a security incident or comply with law.
• Terms acceptance and consent records are kept while your account is active and for as long as needed afterwards to demonstrate compliance.
• Deleting your account. You can permanently delete your account anytime: in the iPhone and Android apps under Settings → Delete account, or on the web under Settings → Account → Delete account. This immediately removes your account, board, attachments, phones, integrations, feedback and push tokens from our active systems. Copies in backups and logs expire on their normal schedule (generally within 30 days) unless we must keep them longer by law, and minimal records (for example that a phone number opted out of texts) may be kept to honor your choices.

13. Your privacy rights

Depending on where you live, you may have the right to: know what personal information we hold and how we use it; access it and get a portable copy; correct it; delete it; object to or restrict certain processing; withdraw consent at any time (without affecting processing before withdrawal); opt out of sale, targeted advertising and profiling (we don't do these); and appeal our decision on your request.

You can do most of this directly in the apps: edit your content and profile, export your board, withdraw AI or MeetDrop permission in Settings, remove phones and email addresses, and delete your account. For anything else, email [email protected] with the subject “Privacy request”. We will verify your identity (usually by confirming control of your account email) and respond within the time required by law (generally 30 days in the EEA/UK and 45 days in US states, which may be extended where the law allows). You may use an authorized agent where the law allows; we may ask for proof of the agent's authority and verify your identity directly. If we deny your request, you may appeal by replying to our decision; if you're not satisfied with the appeal, you may contact your state attorney general or data protection authority. We will not discriminate against you for exercising your rights.

14. California privacy notice

This section applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”). In the last 12 months we collected these categories of personal information, from you, your devices and the content you choose to send us, for the business purposes described in How we use it:

• Identifiers (email address, phone number, IP address, account ID);
• Customer records (name, email, phone);
• Internet or network activity (sign-in history, feature usage counts, device and browser type);
• Approximate geolocation (time zone; IP-based region; weather location is sent from your device and not collected by us);
• Audio, electronic or similar information (meeting recordings in transit to transcription, never stored; photos and files you save);
• Content of your drops, texts and emails you send to MinDrop, and meeting transcripts; and
• Sensitive personal information limited to account login credentials and the contents of messages you send to MinDrop, used only to provide the Service.

We disclose these categories for business purposes to the service providers listed in Service providers. We have not sold or shared personal information (including of consumers under 16), and we do not use or disclose sensitive personal information for purposes that give you a right to limit it. Retention periods are described in Retention and deletion. You have the rights to know, access, correct, delete and port your information, to opt out of sale or sharing (not applicable, but we honor Global Privacy Control signals as opt-out requests), to limit use of sensitive personal information (not applicable), and to non-discrimination. California's “Shine the Light” law: we don't disclose personal information to third parties for their direct marketing purposes.

15. Other US state privacy laws

Residents of states with comprehensive consumer privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island) may have rights to confirm whether we process their personal data, and to access, correct, delete and obtain a portable copy of it, to opt out of targeted advertising, sale and profiling in furtherance of decisions that produce legal or similarly significant effects, and to appeal a denial. We don't sell personal data, engage in targeted advertising or conduct such profiling. We process sensitive data only with consent where the law requires it. To exercise your rights or appeal, contact us as described in Your privacy rights. Nevada residents: we do not sell covered information as defined in Nevada law.

16. EEA, UK and Switzerland

If the GDPR, UK GDPR or Swiss data-protection law applies to you, the controller of your personal information is Aniel Reyes, doing business as MinDrop, reachable at [email protected]. Our legal bases for processing are listed in How we use it. Where we rely on legitimate interests, we have balanced them against your rights, and you may object at any time. Where we rely on consent, you may withdraw it at any time. You have the rights described in Your privacy rights, and the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office). Providing account information is necessary to use MinDrop; everything else is optional. We have not appointed an EU or UK representative; contact us directly. Data protection contact: Aniel Reyes, [email protected].

17. Cookies, local storage and Do Not Track

MinDrop uses only cookies that it needs to work. There are no advertising, social-media or analytics cookies, and nothing from other companies.

The MinDrop staff site (admin.mindrop.app) sets its own sign-in cookies for MinDrop staff only. Customers never get them.

The website and apps also keep some things in your browser's or device's storage, which stays on your device:

• a copy of your board and any unsent drafts, so MinDrop works offline;
• the app's own files, so pages load quickly and work offline;
• your settings, like light or dark theme, notices you've dismissed and whether you've seen the welcome tour;
• while a browser tab is open: how long a locked drop stays unlocked, and a note that a page was already counted, so it is counted once in our anonymous daily page-visit totals. That note holds only the page name, has no ID in it, and goes away when you close the tab.

Why there's no cookie banner. Everything above is needed for MinDrop to work or to do something you asked for, and none of it tracks you, so there is nothing to accept or turn off. If we ever add cookies that aren't needed, we'll ask you first.

Because we don't track you across websites, we treat Do Not Track and Global Privacy Control signals the same way we treat everyone: no cross-site tracking and no sale or sharing.

18. Children

MinDrop is not directed to children under 13, and you must be at least 13 (or the higher minimum age where you live) to create an account. Users under 18 need a parent or guardian's permission. We do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA). If we learn that we have collected personal information from a child under 13, we will delete it and close the account. If you believe a child has given us personal information, contact [email protected].

19. Changes to this policy

We may update this policy as MinDrop changes, including when we add or change service providers. Each version has a version number and a “Last updated” date at the top. For material changes, we will tell you in the app (with a “We updated our Terms” notice you can review and accept) or by email before they take effect. We will ask for your consent again before using personal information in a materially different way than described when we collected it, where the law requires it.

20. Contact

Questions, requests or complaints: [email protected] (subject “Privacy request”).
Aniel Reyes, a sole proprietor doing business as MinDrop
Florida, United States