Privacy Policy

Who we are

OwnMind is the operator of OwnMind, reachable at hello@sriprayagclasses.in and located in Remote, India.

For the purposes of data protection law, OwnMind is the data controller for the personal data described in this policy.

What we collect

There are only two categories of data here, and both are needed to run the service.

Account data

• Your email address, used to sign you in and to send service messages.
• An optional display name. If you leave it blank we use your email address.
• A hash of your password. The password itself is never stored or logged, and the hash is built with a slow one way function (scrypt) using a unique random salt per account.
• A session token in a cookie, so you stay signed in. It is an opaque random value, marked HttpOnly so scripts cannot read it.
• The date your account was created and your theme preference.

Content you save

• Notes you write, exactly as you typed them.
• Links you save, with the page title, site name, domain, author and body text.
• Images you upload, stored as files on our own disk under a random filename.
• Generated titles, tags, colour values, text recognised in images and summaries.
• Links you make between items, and the rules of any spaces you create.
• The dates on which the above were created and changed.

What we do not collect

The following are not merely unused. They are not present in the product at all, which means there is nothing to opt out of.

• No advertising identifiers, ad pixels or sponsored results.
• No third party analytics scripts, session recorders or tag managers.
• No cross site tracking pixels in the application or in email.
• No contacts, calendar, location or browsing history from your device.
• No biometric data, no government identifiers and no special category data as defined by law.

We do not build a profile of you for advertising, and there is no mechanism in this codebase to export your library to anyone but you.

Cookies and local storage

The service sets exactly one cookie, and it is required to keep you signed in.

• ownmind_session holds an opaque random session token. It is HttpOnly, SameSite=Lax, Secure in production, and expires after 30 days of inactivity or is replaced on sign in. It contains no personal data.

We also read one value from your browser’s local storage, which records whether you chose light or dark mode. That preference stays on your device and is never sent to us. There are no advertising or tracking cookies, because there is nothing to track.

How saved content is processed

To label a save, OwnMind sends the content of that save to a third party language model provider. This is the one place where your data leaves our infrastructure, so it is described precisely.

What is sent

Either the text of the page or note, or the image itself. Alongside it we send generic instructions asking for a title, some tags and a short summary.

What is not sent

• Your email address, display name or account identifier.
• Your IP address is visible to the provider as an ordinary HTTPS request, and is not included in the request body.
• Anything about other saves, other users, or anything else you have stored.
• Your IP address is not attached to the content we send.

Provider retention

The provider processes the request on our instructions and does not use your content to train its own models. Where a provider offers a zero retention mode, we use it. You can read the current provider and their terms in Settings, which states plainly whether labelling is switched on.

If labelling is switched off

If no model provider is configured, content is never sent anywhere. Labelling then uses local text analysis on our server, and the product remains usable.

Fetching a page you save

When you paste a link, our server requests that page directly from its owner in order to extract the text. That request is made by us, not by a third party analytics service, and the destination necessarily learns that an address requested it.

Who can see your data

• You, through your account, and through the export in Settings.
• Nobody else using the service. There is no public profile, no shared link and no social graph.
• Our infrastructure providers, strictly to host the service: the hosting provider, the database host, the object or file storage used for images, and the payment processor for card details on paid plans. Each is bound by contract to process data only on our instructions.
• A public authority, if we are legally compelled to disclose it. If that ever happens we will tell you, unless the law forbids us from doing so.

Access for the operator is limited to what is needed to run and secure the service. Your saved content is not opened for curiosity.

How long we keep it

Your account and its content are kept for as long as your account exists. There is no scheduled deletion, no expiry and no archival copy kept after you delete.

Server request logs, which exist to keep the service secure and to diagnose faults, are retained for a short rolling period of 30 days and then deleted. They are not used to profile you.

Security

Reasonable measures we have taken, stated plainly:

• All traffic is served over HTTPS with HSTS.
• Passwords are hashed with scrypt and a per account random salt, and compared in constant time.
• Session tokens are 256 bit random values, stored server side, and can be invalidated by signing out.
• Every read and write is scoped to the signed in user, so one account cannot reach another.
• Uploads are written under random filenames and served only after their name is validated, which blocks path traversal.
• Deleting an account removes every record attached to it.

No system is perfectly secure. If a breach affecting your data occurs, we will notify you and the relevant authority without undue delay.

Your rights

Wherever you live, we will honour the following, and most of them you can exercise yourself without contacting anyone.

• Access and portability. Settings, Download my data produces a JSON file of everything, at any time, with no request needed.
• Correction. Edit any card directly, or write to us.
• Erasure. Settings, Delete my account removes the account and all attached data. It is immediate and irreversible.
• Objection and restriction. Write to us and we will stop the processing you object to.
• Withdraw consent. Close the account. Processing that is necessary to deliver the service stops with it.
• Complain. You may complain to your local data protection authority. We would rather you told us first.

Children

OwnMind is not directed at children under 13, and we do not knowingly collect data from anyone under 13. If you believe a child has created an account, write to us and we will remove it.

Changes to this policy

If this policy changes materially, we will update the effective date at the top and notify signed in users by email before the change takes effect. Continuing to use the service after that date means accepting the revised policy.

Contact

For anything in this document, write to hello@sriprayagclasses.in. If your question is about a privacy complaint specifically, put that in the subject line and it will reach the right person.