SecondMindOS Privacy Policy

SecondMindOS is operated from Ontario, Canada. Questions and privacy requests can be sent to support@secondmindos.app. The complete current policy is available at https://secondmindos.app/privacy.

SecondMindOS stores saved conversations, webpages, PDFs, files, notes, source links, search indexes, and generated findings in the browser profile by default. It does not save content from private browsing windows. Free-plan workspace data remains in browser storage unless the user deliberately exports it or sends it to a configured service.

Data leaves the device only when the user chooses an account-linked feature, hosted synchronization or backup, a connected integration, cloud AI, billing, email, support, or configured analytics. The transmitted information is limited to what the selected action requires. Technical analytics exclude conversation text, email addresses, page query strings, and integration credentials.

The hosted service uses Vercel for application hosting, Supabase for accounts and hosted storage, Stripe for billing, and Resend for email. Google and GitHub can provide optional sign-in. Selected context can be sent to a configured AI or integration provider only when the user directs that action. Cloud connections use TLS, and hosted records are encrypted at rest by their providers. Hosted synchronization is not end-to-end encrypted with the backup passphrase because authorized services process synchronized records for account features. Cloud backup contents receive separate on-device encryption before upload and require the original passphrase for restoration on another device.

SecondMindOS processes account and selected workspace information to provide requested features, secure the service, prevent abuse, diagnose failures, meet legal obligations, and perform the service agreement. SecondMindOS does not sell personal information, use it for personalized advertising, or use saved workspace content to train AI models. A third-party provider processes deliberately submitted content under its own terms and privacy controls.

Users can delete local records, disconnect integrations, export portable copies, and contact support to request access, correction, portability, or deletion of account-linked information. Local records remain until the user deletes them, clears the browser profile, or removes the extension. Deactivated account data enters a 90-day recovery period before permanent deletion unless legal, accounting, security, fraud-prevention, or unsubscribe records must be retained. Connected providers apply their own retention terms.

SecondMindOS's use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.