A feature-by-feature list of where your data actually goes. No summaries, no trust-us — this is the whole map.
| Feature | Where | Detail |
|---|---|---|
| Account / login | Local | No account server — your session is stored in browser localStorage. The user list is bundled into the app's public source file, not fetched from a database: each entry's credential is a PBKDF2-SHA256 hash of name+DOB+access code (150,000 iterations), and non-admin users' names are AES-GCM encrypted with a key derived from the admin's own login secret — so reading the raw file gets you neither a working credential nor a readable name without already knowing someone's login. This is a light access gate for personal/family use, not enterprise-grade authentication. |
| Saved articles, angle drafts, quiz progress | Local | localStorage, mirrored to your own vault's _reports/*.json backup files. |
| AI provider API key | Local | Stored in browser localStorage only. Never transmitted anywhere except directly to that provider's API when you generate content. |
| Feature | Where | Detail |
|---|---|---|
| Angle generation (Publish, Study Guide, Frameworks, etc.) | Third-party | Article text + your prompt sent directly from your browser to whichever provider you picked (Anthropic, OpenAI, Gemini, Groq, Ollama, OpenRouter, Cohere, MiniMax…). Never touches a TheVaultMind server — there isn't one. |
| Feature | Where | Detail |
|---|---|---|
| RSS feed refresh | Server | Routed through a small Node relay to bypass CORS. Optional: you can point it at your own self-hosted instance instead of the default one. |
| Full-article fetch | Server | Same relay — fetches the article URL server-side and returns clean text, since browsers can't fetch arbitrary cross-origin pages directly. |
| Hacker News angle sourcing | Third-party | Direct browser calls to the public Hacker News API (Firebase). |
| Feature | Where | Detail |
|---|---|---|
| Obsidian export | Local | Written directly to your local filesystem via the browser's file system access — never leaves your device. |
| Google Drive backup/export | Third-party | Direct browser calls to Google's Drive API using your own OAuth session. TheVaultMind never sees the file contents or your Google credentials. |
| Notion / OneNote export | Third-party | Direct browser calls to Notion's or Microsoft Graph's API with your own integration token. |
There is no TheVaultMind account server, no analytics beacon, no ad network call, and no proxy sitting between you and your AI provider. The RSS relay is the only server TheVaultMind operates, and it holds no secrets and no user data.
TheVaultMind is an integration layer, not a party to how your AI provider (Anthropic, OpenAI, Gemini, Grok, Mistral, Groq, Together AI, Cohere, Perplexity, DeepSeek, OpenRouter, MiniMax, Zhipu AI, Moonshot, Ollama, or LM Studio — whichever you connect), Obsidian, Google, Notion, or Microsoft handle your data — every call to those services in the table above uses your own API key or OAuth session, made directly from your browser. Using each integration means you've agreed to that provider's own terms, not TheVaultMind's:
Anthropic · OpenAI · Google Gemini · xAI (Grok) · Mistral AI · Groq · Together AI · Cohere · Perplexity · DeepSeek · OpenRouter · MiniMax · Zhipu AI (GLM) · Moonshot · Google Drive · Notion · Microsoft · Obsidian
Ollama and LM Studio run entirely on your own machine — no third-party terms apply since no data leaves your device for that path.
TheVaultMind's own usage policy: Acceptable Use Policy.