Trust & Data Audit

A feature-by-feature list of where your data actually goes. No summaries, no trust-us — this is the whole map.

Local — stays in your browser Server — passes through your self-hosted RSS relay Third-party — sent to the provider you chose
Storage
FeatureWhereDetail
Account / loginLocalNo account server — your session is stored in browser localStorage. The user list is bundled into the app's public source file, not fetched from a database: each entry's credential is a PBKDF2-SHA256 hash of name+DOB+access code (150,000 iterations), and non-admin users' names are AES-GCM encrypted with a key derived from the admin's own login secret — so reading the raw file gets you neither a working credential nor a readable name without already knowing someone's login. This is a light access gate for personal/family use, not enterprise-grade authentication.
Saved articles, angle drafts, quiz progressLocallocalStorage, mirrored to your own vault's _reports/*.json backup files.
AI provider API keyLocalStored in browser localStorage only. Never transmitted anywhere except directly to that provider's API when you generate content.
Content generation
FeatureWhereDetail
Angle generation (Publish, Study Guide, Frameworks, etc.)Third-partyArticle text + your prompt sent directly from your browser to whichever provider you picked (Anthropic, OpenAI, Gemini, Groq, Ollama, OpenRouter, Cohere, MiniMax…). Never touches a TheVaultMind server — there isn't one.
RSS & article fetching
FeatureWhereDetail
RSS feed refreshServerRouted through a small Node relay to bypass CORS. Optional: you can point it at your own self-hosted instance instead of the default one.
Full-article fetchServerSame relay — fetches the article URL server-side and returns clean text, since browsers can't fetch arbitrary cross-origin pages directly.
Hacker News angle sourcingThird-partyDirect browser calls to the public Hacker News API (Firebase).
Vault / knowledge base
FeatureWhereDetail
Obsidian exportLocalWritten directly to your local filesystem via the browser's file system access — never leaves your device.
Google Drive backup/exportThird-partyDirect browser calls to Google's Drive API using your own OAuth session. TheVaultMind never sees the file contents or your Google credentials.
Notion / OneNote exportThird-partyDirect browser calls to Notion's or Microsoft Graph's API with your own integration token.
What's not on this list

There is no TheVaultMind account server, no analytics beacon, no ad network call, and no proxy sitting between you and your AI provider. The RSS relay is the only server TheVaultMind operates, and it holds no secrets and no user data.

Third-party terms

TheVaultMind is an integration layer, not a party to how your AI provider (Anthropic, OpenAI, Gemini, Grok, Mistral, Groq, Together AI, Cohere, Perplexity, DeepSeek, OpenRouter, MiniMax, Zhipu AI, Moonshot, Ollama, or LM Studio — whichever you connect), Obsidian, Google, Notion, or Microsoft handle your data — every call to those services in the table above uses your own API key or OAuth session, made directly from your browser. Using each integration means you've agreed to that provider's own terms, not TheVaultMind's:

Anthropic · OpenAI · Google Gemini · xAI (Grok) · Mistral AI · Groq · Together AI · Cohere · Perplexity · DeepSeek · OpenRouter · MiniMax · Zhipu AI (GLM) · Moonshot · Google Drive · Notion · Microsoft · Obsidian

Ollama and LM Studio run entirely on your own machine — no third-party terms apply since no data leaves your device for that path.

TheVaultMind's own usage policy: Acceptable Use Policy.