Data Processing Information

This page is an overview of how Mini Me OS handles data, written so individual users and small business customers can understand what happens behind the scenes. A formal Data Processing Addendum suitable for business contracts will be made available on request once a legal entity is registered behind the service; until then, treat this page as the public summary.

Roles

For an individual user signing up for personal use, Mini Me OS acts as the controllerof the personal data it collects (your email, your account, your workspace).

For a business that asks employees to use Mini Me OS, the business may be the controller of the employees' workspace data and Mini Me OS may act as a processor on the business's behalf. A signed agreement is required for that arrangement — write to us via the contact form to discuss.

Categories of data we process

• Identity data: email address, password hash (held by Supabase Auth), display name if you set one.
• Workspace data: tasks, projects, goals, milestones, routines, capture items, reviews, decisions and their options, life-area settings, automation rules, focus-session records, rule settings, onboarding answers (primary needs, guidance level, available-time bucket, default energy).
• Shared-workspace data: for users on Pro and Max who share their workspace, the workspace stores an owner-user-id, a list of member-user-ids with role (owner / member), and single-use invite tokens.
• Push-notification data: if you opt in, the browser-provided push endpoint and its public keys, stored per device against your account.
• Calendar data (opt-in): on Pro and Max, the private iCal URL you paste and a cached list of upcoming events for the next 7 days.
• Email integration data (opt-in, Max-tier): connected Gmail account email address, encrypted OAuth refresh token (pgcrypto), and the subject + snippet + sender of the latest 30 INBOX messages you pull on demand. No full bodies, no outbound sends.
• Operational data: request logs, IP address, user-agent, error traces — kept by our infrastructure providers for security and reliability.
• AI-feature data: the specific text or task you submit to Smart Add, "Break into steps", "Explain today's plan", "Break a project into tasks" or the Voice → text fallback. See the AI Disclosure for what is and is not sent.
• Support correspondence: what you send through the contact form and our reply.

Purposes

• To create and operate your account.
• To store the workspace data you create, and to show the same data on every device you sign in from.
• To compute the recommendations on Today, the answers on the Assistant page, and the daily plan, using only your own data.
• To detect abuse and keep the service available.
• To answer your support questions.

We do not use your data for any other purpose. We do not sell it. We do not allow our AI provider to use it for training shared models; what the provider does with API requests is governed by their own terms, which by default exclude training on customer API content.

Sub-processors

The third parties below are the sub-processors Mini Me OS relies on today.

• Vercel — application hosting and edge delivery for the website and the API.
• Supabase — Postgres database for your workspace, authentication (sign-up, sign-in, password reset, session cookies), and transactional auth emails.
• Google (Gemini API) — AI provider used by Smart Add, "Break into steps", "Explain today's plan", "Break a project into tasks" and the Voice → text fallback. Only the text you submit to those features is sent.
• Google (Gmail API) — only if you opt into the Email module (Max-tier). Reads subject + snippet + sender for the latest 30 INBOX messages on demand using an OAuth refresh token you can revoke at any time.
• Web Push services — your browser's push provider (Apple, Mozilla, Microsoft, Google) delivers the morning recap and any automations you build to your devices through endpoints your browser issued.

If we add or change a sub-processor, we will update this list. The Gmail integration is opt-in and scoped to read-only — Mini Me OS never sends, replies, archives or modifies mail.

Calendar integration (iCal)

Mini Me OS can fetch a calendar via its private iCal URL when you connect one in Settings. In this flow, the calendar provider — typically Google, Apple iCloud, or Microsoft Outlook — acts as a data source, not a sub-processor: we only read events, we never write back. The cached events for the next 7 days live in our own database (Supabase). You can disconnect at any time and both the iCal URL and the cached events are deleted.

International transfers

Vercel and Supabase both offer EU-region hosting. The operator picks a region when each project is created; the production Supabase project for Mini Me OS is provisioned in an EU region. Google processes Gemini API requests in their own infrastructure, which may include the United States. Each provider relies on Standard Contractual Clauses and additional safeguards documented in their own data-processing terms.

Security

• TLS for all browser-to-server traffic.
• Row-level security policies in Postgres that scope every read and write to the signed-in user.
• Service-role keys live only on the server and never reach the browser.
• Operational responsibilities (patching, backups, encryption-at-rest) are handled by the infrastructure providers under their own security programmes.

We do not currently hold an external security certification (e.g. SOC 2 Type II, ISO 27001). We will say so honestly until that changes.

Breach notification

If we become aware of a personal data breach affecting your account, we will notify you without undue delay and, where required by law, within 72 hours of becoming aware of it.

Retention and deletion

Your workspace data persists for as long as your account is active. When you click Delete account in Settings, every row in our workspace tables tied to your user is deleted, and the authentication user is removed via Supabase admin API. Operational logs held by infrastructure providers persist per their own retention windows. See the Privacy Policy for user rights, and the Terms of Service for the deletion mechanics.