Trust & Data Audit

A feature-by-feature list of where your data actually goes. No summaries, no trust-us — this is the whole map.

Local — stays in your browser Server — passes through your self-hosted RSS relay Third-party — sent to the provider you chose
Storage
FeatureWhereDetail
Account / loginLocalNo account server — your session is stored in browser localStorage. The user list is bundled into the app's public source file, not fetched from a database: each entry's credential is a PBKDF2-SHA256 hash of name+DOB+access code (150,000 iterations), and non-admin users' names are AES-GCM encrypted with a key derived from the admin's own login secret — so reading the raw file gets you neither a working credential nor a readable name without already knowing someone's login. This is a light access gate for personal/family use, not enterprise-grade authentication.
Saved articles, angle drafts, quiz progressLocallocalStorage, mirrored to your own vault's _reports/*.json backup files.
AI provider API keyLocalStored in browser localStorage only. Never transmitted anywhere except directly to that provider's API when you generate content.
Content generation
FeatureWhereDetail
Angle generation (Publish, Study Guide, Frameworks, etc.)Third-partyArticle text + your prompt sent directly from your browser to whichever provider you picked (Anthropic, OpenAI, Gemini, Groq, Ollama, OpenRouter, Cohere, MiniMax…). Never touches a TheVaultMind server — there isn't one.
RSS & article fetching
FeatureWhereDetail
RSS feed refreshServerRouted through a small Node relay to bypass CORS. Optional: you can point it at your own self-hosted instance instead of the default one.
Full-article fetchServerSame relay — fetches the article URL server-side and returns clean text, since browsers can't fetch arbitrary cross-origin pages directly.
Hacker News angle sourcingThird-partyDirect browser calls to the public Hacker News API (Firebase).
Vault / knowledge base
FeatureWhereDetail
Obsidian exportLocalWritten directly to your local filesystem via the browser's file system access — never leaves your device.
Google Drive backup/exportThird-partyDirect browser calls to Google's Drive API using your own OAuth session. TheVaultMind never sees the file contents or your Google credentials.
Notion / OneNote exportThird-partyDirect browser calls to Notion's or Microsoft Graph's API with your own integration token.
Login & admin
FeatureWhereDetail
Login verificationLocalName + date of birth + code are hashed (PBKDF2-SHA256) in your browser and checked against a list shipped in auth.js — the raw values never leave your device.
Users backend (optional)ServerIf the admin has connected one (Settings → admin panel → "Users backend"), a login not found in the shipped list is checked against a small self-hosted server instead — only the one-way hash is sent, never your name/DOB/code. Lets an admin add or remove a login without redeploying the app. Off by default; when off, login works exactly as the row above describes.
Cross-app session (Lens)ServerA signed, expiring cookie shared between TheVaultMind and Lens so logging into one unlocks the other — carries only your name and role, never anything you've written. Verified by the same users backend above; issued fresh on login, cleared on logout from either app.
Lens (AI writing detector)
FeatureWhereDetail
Local detection modelsLocalThe heuristic model and the trained logistic-regression model both run entirely in your browser — your draft is never sent anywhere to be scored this way.
ONNX transformer modelsLocalDownloaded once from a public model CDN and run in-browser via WebAssembly (a dedicated worker, so the tab stays responsive) — same as the models above, your text stays local, only the one-time model download touches the network.
External API providers (GPTZero, Winston AI, Sapling, Originality.ai, Copyleaks)Third-partyOff by default, and the toggle to enable them stays disabled until you've saved at least one provider key yourself (Settings, AES-256 encrypted). When used, your text and your own key go directly to that provider for a single scan — Lens's server relays the request but never stores the key or the text.
Personal model trainingLocalRetraining the local model on your own writing reads a local folder you pick (e.g. an Obsidian vault) via the browser's file system access, and trains entirely in-browser — nothing is uploaded.
Trademarks

TheVaultMind is not affiliated with, endorsed by, or sponsored by Obsidian.md / Dynalist Inc., Google, Notion Labs, or Microsoft. Their product names and trademarks are referenced on this site only to describe file/export compatibility with those products.

Security posture — last checked 2026-08-18

Concrete, checkable claims only — this isn't a marketing list, everything here can be verified by reading the source or the headers yourself.

This is a self-audit, not an independent third-party penetration test — treat it as a starting point, not a certification.

What's not on this list

There is no TheVaultMind account server, no analytics beacon, no ad network call, and no proxy sitting between you and your AI provider. The RSS relay is the only server TheVaultMind operates, and it holds no secrets and no user data.

Third-party terms

TheVaultMind is an integration layer, not a party to how your AI provider (Anthropic, OpenAI, Gemini, Grok, Mistral, Groq, Together AI, Cohere, Perplexity, DeepSeek, OpenRouter, MiniMax, Zhipu AI, Moonshot, Ollama, or LM Studio — whichever you connect), Obsidian, Google, Notion, or Microsoft handle your data — every call to those services in the table above uses your own API key or OAuth session, made directly from your browser. Using each integration means you've agreed to that provider's own terms, not TheVaultMind's:

Anthropic · OpenAI · Google Gemini · xAI (Grok) · Mistral AI · Groq · Together AI · Cohere · Perplexity · DeepSeek · OpenRouter · MiniMax · Zhipu AI (GLM) · Moonshot · Google Drive · Notion · Microsoft · Obsidian

Ollama and LM Studio run entirely on your own machine — no third-party terms apply since no data leaves your device for that path.

TheVaultMind's own usage policy: Acceptable Use Policy.