A feature-by-feature list of where your data actually goes. No summaries, no trust-us — this is the whole map.
| Feature | Where | Detail |
|---|---|---|
| Account / login | Local | No account server — your session is stored in browser localStorage. The user list is bundled into the app's public source file, not fetched from a database: each entry's credential is a PBKDF2-SHA256 hash of name+DOB+access code (150,000 iterations), and non-admin users' names are AES-GCM encrypted with a key derived from the admin's own login secret — so reading the raw file gets you neither a working credential nor a readable name without already knowing someone's login. This is a light access gate for personal/family use, not enterprise-grade authentication. |
| Saved articles, angle drafts, quiz progress | Local | localStorage, mirrored to your own vault's _reports/*.json backup files. |
| AI provider API key | Local | Stored in browser localStorage only. Never transmitted anywhere except directly to that provider's API when you generate content. |
| Feature | Where | Detail |
|---|---|---|
| Angle generation (Publish, Study Guide, Frameworks, etc.) | Third-party | Article text + your prompt sent directly from your browser to whichever provider you picked (Anthropic, OpenAI, Gemini, Groq, Ollama, OpenRouter, Cohere, MiniMax…). Never touches a TheVaultMind server — there isn't one. |
| Feature | Where | Detail |
|---|---|---|
| RSS feed refresh | Server | Routed through a small Node relay to bypass CORS. Optional: you can point it at your own self-hosted instance instead of the default one. |
| Full-article fetch | Server | Same relay — fetches the article URL server-side and returns clean text, since browsers can't fetch arbitrary cross-origin pages directly. |
| Hacker News angle sourcing | Third-party | Direct browser calls to the public Hacker News API (Firebase). |
| Feature | Where | Detail |
|---|---|---|
| Obsidian export | Local | Written directly to your local filesystem via the browser's file system access — never leaves your device. |
| Google Drive backup/export | Third-party | Direct browser calls to Google's Drive API using your own OAuth session. TheVaultMind never sees the file contents or your Google credentials. |
| Notion / OneNote export | Third-party | Direct browser calls to Notion's or Microsoft Graph's API with your own integration token. |
| Feature | Where | Detail |
|---|---|---|
| Login verification | Local | Name + date of birth + code are hashed (PBKDF2-SHA256) in your browser and checked against a list shipped in auth.js — the raw values never leave your device. |
| Users backend (optional) | Server | If the admin has connected one (Settings → admin panel → "Users backend"), a login not found in the shipped list is checked against a small self-hosted server instead — only the one-way hash is sent, never your name/DOB/code. Lets an admin add or remove a login without redeploying the app. Off by default; when off, login works exactly as the row above describes. |
| Cross-app session (Lens) | Server | A signed, expiring cookie shared between TheVaultMind and Lens so logging into one unlocks the other — carries only your name and role, never anything you've written. Verified by the same users backend above; issued fresh on login, cleared on logout from either app. |
| Feature | Where | Detail |
|---|---|---|
| Local detection models | Local | The heuristic model and the trained logistic-regression model both run entirely in your browser — your draft is never sent anywhere to be scored this way. |
| ONNX transformer models | Local | Downloaded once from a public model CDN and run in-browser via WebAssembly (a dedicated worker, so the tab stays responsive) — same as the models above, your text stays local, only the one-time model download touches the network. |
| External API providers (GPTZero, Winston AI, Sapling, Originality.ai, Copyleaks) | Third-party | Off by default, and the toggle to enable them stays disabled until you've saved at least one provider key yourself (Settings, AES-256 encrypted). When used, your text and your own key go directly to that provider for a single scan — Lens's server relays the request but never stores the key or the text. |
| Personal model training | Local | Retraining the local model on your own writing reads a local folder you pick (e.g. an Obsidian vault) via the browser's file system access, and trains entirely in-browser — nothing is uploaded. |
TheVaultMind is not affiliated with, endorsed by, or sponsored by Obsidian.md / Dynalist Inc., Google, Notion Labs, or Microsoft. Their product names and trademarks are referenced on this site only to describe file/export compatibility with those products.
Concrete, checkable claims only — this isn't a marketing list, everything here can be verified by reading the source or the headers yourself.
Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers set on every response (.htaccess)npm audit reports 0 known vulnerabilities as of the date above, and all three now ship a committed package-lock.json so a redeploy installs the exact versions last checked, not whatever a version-range resolves to that day!==This is a self-audit, not an independent third-party penetration test — treat it as a starting point, not a certification.
There is no TheVaultMind account server, no analytics beacon, no ad network call, and no proxy sitting between you and your AI provider. The RSS relay is the only server TheVaultMind operates, and it holds no secrets and no user data.
TheVaultMind is an integration layer, not a party to how your AI provider (Anthropic, OpenAI, Gemini, Grok, Mistral, Groq, Together AI, Cohere, Perplexity, DeepSeek, OpenRouter, MiniMax, Zhipu AI, Moonshot, Ollama, or LM Studio — whichever you connect), Obsidian, Google, Notion, or Microsoft handle your data — every call to those services in the table above uses your own API key or OAuth session, made directly from your browser. Using each integration means you've agreed to that provider's own terms, not TheVaultMind's:
Anthropic · OpenAI · Google Gemini · xAI (Grok) · Mistral AI · Groq · Together AI · Cohere · Perplexity · DeepSeek · OpenRouter · MiniMax · Zhipu AI (GLM) · Moonshot · Google Drive · Notion · Microsoft · Obsidian
Ollama and LM Studio run entirely on your own machine — no third-party terms apply since no data leaves your device for that path.
TheVaultMind's own usage policy: Acceptable Use Policy.