Privacy Policy

Last updated: 2026-10-12

This policy describes how Minima collects, uses, shares, and retains personal information when you use our website, our applications, and our developer API. It is written to be specific enough to be useful and short enough to be read.

For details about how Minima uses your content with AI, including our position on training, see theData Use page. For our security controls, see Security. For our contractual commitments, see the Terms of Service.

"Minima" refers to Minima Technologies, Inc., a corporation incorporated in the State of Delaware, United States, and the entity operating the Minima platform. For the purposes of the EU and UK GDPR, Minima Technologies, Inc. is the controller of personal data described in this policy, except where we act as a processor on your behalf (for example, when an organization administrator manages member accounts).

You can reach our privacy lead atprivacy@minima.dev. If you are in the EEA or the UK and need a representative under Article 27 of the GDPR, contact us at the same address and we will direct you to our appointed representative.

Depending on how you use Minima, we collect some or all of the following:

• Account identifiers. User ID, email, OAuth subject from Google or Apple, and display name.
• Authentication artifacts. Sessions, OAuth tokens, hashed API keys, and the one-time codes we email you to sign in, which we hold until they expire. We also hold passkey credentials and two-factor secrets for anyone who has enrolled one, although the app offers no way to enrol either yet.
• Profile and organization data. Profiles, organizations, memberships, roles, permissions, and groups.
• User content. Files, folders, projects, code, node graphs, knob states, custom agent logic, and collaborative document state (Yjs). We also record who created a file, a folder, a chat and each message in it, so that a permission can be asked of the person whose work it is rather than of the workspace holding it. The edit history inside a document carries no such record, and neither does anything written before we began keeping one, so both are left out of any sharing rather than attributed to the workspace.
• Uploaded media. Audio, font, image, and video assets you import into Minima from your local filesystem or cloud storage providers.
• AI prompts and outputs. Messages you send to the AI, the transcripts of voice messages you record, model responses, intermediate "thinking" traces, and conclusions. We send the recording behind a transcript for transcription and never store it; the transcript is kept only if you send the message it lands in.
• Vector embeddings. Numerical representations of the memories, modules, and skills we index for search and retrieval.
• Settings and UI state. Theme, layout, sidebar widths, open files, recent items, and keyboard shortcut overrides.
• Access history. Which files you have opened and when, including files shared with you that belong to someone else. We use it to mark a file read since an assistant last changed it, and to list the files shared with you that no workspace of yours owns. A row is kept for as long as both the file and your profile exist, and is deleted with either.
• Usage and billing. Credit transactions, subscriptions, rate-limit counters, and Stripe customer IDs.
• Telemetry and analytics. Product analytics events and error or crash reports, where analytics is enabled. Analytics events record which actions you took — counts, durations, file types, and similar measures. They never include text you wrote: not your messages, prompts, agent memories, voice transcriptions, file names or paths, share links, or the feedback you send us.
• Onboarding survey answers. The answers you give to the optional onboarding questions. The multiple-choice answers are held by our product analytics provider rather than in the app database, and those questions are only shown if you allowed analytics. Anything you type into the free-text question is stored as feedback in the app database instead, described below.
• Feedback you send us. Text you write and submit deliberately, such as the free-text onboarding answer or a feedback form. It is stored in the app database, not sent to our analytics provider, and we keep it whether or not you allowed analytics — you chose to send it to us.
• Device and connection metadata. IP address, user agent, approximate location derived from IP, and device identifiers on mobile. When the desktop app checks for an update, or you download it, the request goes to our download host, served by Tigris, which receives your IP address, the operating system the update is for and, when an update is downloaded, its version. The check sends no account details.
• Communications. Transactional email about your account, and support correspondence you send us. Mail tosupport@minima.dev that passes the checks keeping automated and list mail out is read by a language model, which sorts it and either answers it or drafts an answer for a person to send. We reach that model through OpenRouter, without the routing limit theData Use page describes for chat. The address on your account is added to our email provider on sign-up so that account email can reach you. It is addedunsubscribed: we ask separately, once you have signed in rather than on the sign-in form, with "No thanks" and "Email me" offered equally and nothing chosen for you, and not as part of accepting the terms. Your answer is a setting you can change at any time under Notifications in Settings. Addresses added before we started asking are still subscribed; we have not reset them, and we ask each of them at their next sign-in. Every product email carries a one-click unsubscribe link, and using it — or the switch in Settings — stops product email for good. Transactional email such as sign-in codes, receipts, security notices and export links continues either way and is not covered by that choice. You can also write toprivacy@minima.dev and we will unsubscribe you. That contact record is held by our email provider rather than in the app database, and deleting your account deletes it there too; we keep a one-way hash of the address afterwards, used for nothing but keeping it off the list, so a deleted account cannot be added back by accident.
• MIDI performances. In a browser that supports Web MIDI, and only once you turn MIDI input on in Settings, the notes and controls you play into a patch are kept on your device as a take. A cloud export of a patch that reads MIDI sends that take with the export, and it is stored with the export job so the render can play it. The names of your MIDI devices are never sent.
• Sync state. Pending operations, content hashes, document versions, and last-modified information used by the sync engine.

We do not collect the following from you in the ordinary course of using Minima:

• Camera, webcam, or screen-capture streams.
• Biometric identifiers such as faceprints, fingerprints, or voiceprints.
• Precise GPS or device-level geolocation.
• Information from people we know to be under the applicable age of digital consent (see "Age limits" below).
• Raw payment card numbers. Card data is collected directly by Stripe; we receive a token, not the card itself.
• Special-category personal data under Article 9 of the GDPR (health, race, political opinion, religion, sexual orientation, and similar).
• Government-issued identification documents.

The microphone is the exception. We open it only while you are recording a voice message, which you start and which you or a five-minute limit end. Minima's audio engine synthesizes its output rather than recording it, so nothing else listens. What happens to that recording is described on theData Use page.

Motion sensor readings stay on your device. While a patch you are viewing reacts to tilt or movement, Minima reads your device's motion sensors and passes the readings to that patch, after you allow it where your browser asks. The readings are never sent to us, saved, or included in analytics: with your consent, we record only whether motion started, or why it could not.

The desktop app reaches your local network only for the features you turn on in Settings: OSC, Ableton Link, NDI and network MIDI. Each is off until you turn it on, and turning it off closes its connections. What these features send and receive goes directly between your devices on your network. It never passes through Minima's servers and is never included in analytics.

If we ever introduce a feature that needs any of the categories above, we will update this policy and ask for fresh consent.

For users in the EEA and the UK, we rely on the following lawful bases under Article 6 of the GDPR:

• Contract. To provide the service you signed up for: account management, sync, rendering, AI features, and billing.
• Legitimate interests. To keep the platform secure, prevent abuse, debug defects, improve reliability, and to hold the address of an existing account holder so we can send them product email. We also count, in aggregate, how many accounts used the service each day — for example how many sent a message or ran an export — from the records we already keep to run it. We keep only the daily totals, never a record of what any one person did, and this is separate from product analytics, which stays off until you allow it. These interests are balanced against your rights and freedoms, and you can object to the product email at any time.
• Consent. For product analytics, as described under "What we set in your browser", and for using your content to train our AI models — the Share product usage setting described on the Data Use page, which is off until you turn it on. Either can be withdrawn at any time.
• Legal obligation. To meet tax, accounting, and anti-fraud obligations.

We aim to keep personal data only as long as we need it. Default retention periods:

• Account record: while the account is active, and for 30 days after you ask us to delete it, so that an accidental request can be withdrawn.
• User content (files, folders, projects): until you delete it or your account is deleted.
• Uploaded media and rendered exports: until you delete them or your account is deleted, with one exception that runs automatically: if a paid subscription lapses — including a payment that fails — we email you when it lapses and up to twice more over the following month, and 30 days after the lapse we begin deleting them down to the storage a free account allows, largest first, a few objects a day until the account is under it. Projects, documents, and chats are never swept.
• Feedback you send us: until your account is deleted, or sooner on request. It lives in the app database, so we can erase it on demand rather than asking a vendor to.
• AI chat history, including the intermediate "thinking" traces inside it: until you delete the chat or your account is deleted. Nothing expires it on a schedule, and there is no retention setting. You can delete a chat at any time.
• Logs used for incident investigation: held under our infrastructure providers' default retention, which we do not extend. For the application logs in Google Cloud, that default is 30 days.
• Payment and invoice records: for as long as the tax and accounting law governing the sale requires. One number does not fit every market, so the period we hold ourselves to is set per market:
  • United States: seven years. The IRS's limitation periods run three years from filing in the ordinary case, six where income was substantially under-reported, and seven for a bad-debt deduction; we keep the longest.
  • Germany: eight years, the period for accounting documents, invoices included, since the Fourth Bureaucracy Relief Act took effect on 2025-01-01. It was ten before.
  • France: ten years. French law runs two clocks on the same record, six years for tax and ten for accounting, and we keep the longer.
  • Ireland: six years.
  • United Kingdom: six years.
  • Anywhere else: ten years, the longest of the periods above, until we have set a shorter one for your country.
  Each period is counted the way that country's law counts it, from the end of the year of the sale or from the tax return that reported it, so a record can outlive the round number by some months. The record that meets the obligation is the invoice and the charge, and Stripe holds both. Deleting your account deletes the Stripe customer your own subscription and card sit on, which cancels anything open and removes the card, and leaves the invoices standing. A team you own has a Stripe customer of its own, and deleting your account does not reach it today, so a card saved for that team stays at Stripe until you ask us to remove it. Removing invoices once the period for your market has run is not built yet: Stripe deletes nothing on its own, and we have still to set up the job that redacts them, so a record outlives its period rather than the other way round. Stripe keeps records of its own for as long as its obligations as a payment institution require, under its own privacy policy rather than ours. This obligation survives an erasure request.
• Telemetry events: 7 years. This is the retention period our analytics provider applies on our plan; PostHog does not currently offer a configurable retention window, so we cannot shorten it. Turning product analytics off in Settings stops further collection. Deleting your account erases what was already collected: we delete the person record and the events behind it, and PostHog removes the person immediately and processes the events on its own schedule. To have them erased without deleting your account, ask us atprivacy@minima.dev.
• Backups: rotate on a schedule aligned with the primary retention. After an erasure request, deleted records are removed from backups on the next rotation cycle. Until then, they may persist in encrypted backup snapshots.

We share personal data only with vendors who help us operate Minima. Each is bound by a data processing agreement. Where a vendor engages another company to serve part of a request, as OpenRouter does with model providers, that company is a sub-processor and handles the request under our vendor's terms. Categories of recipient include:

• Infrastructure: Convex (on AWS) for the primary database, Google Cloud for the worker fleet that runs agents and renders media, and for the service that stores memories and transcribes voice, Tigris for object storage, Chroma for the vector index and the text held beside it, Vercel for the web client and this site, and Cloudflare for DNS.
• AI model routing: OpenRouter. Every prompt we send to a language model, and every piece of text we index for search, goes to OpenRouter, which forwards it to the model provider running the model that answers it — either the company that built the model or another host running the same one. Which providers we reach changes as the model catalog does. TheData Use page describes what we send, when each kind of host is reached, and the limits we place on where a request can be routed.
• Speech to text: Deepgram, for voice messages you record. The recording is sent for transcription and the text comes back into your message box, for you to send or edit.
• Payments: Stripe.
• Email delivery: Loops for transactional and product email.
• Product analytics: PostHog, where analytics is enabled. We have IP anonymisation turned on, so PostHog discards your IP address on receipt rather than storing it or deriving a location from it.
• OAuth providers: Google and Apple. They receive only the minimum scopes needed to identify you.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. If that ever changes, we will update this page before it takes effect, provide a "Do Not Sell or Share" link, and honor browser opt-out signals such as Global Privacy Control, which the web client already reads.

Minima is operated from the United States, and many of our vendors are US-based. When personal data is transferred from the EEA, the UK, or other jurisdictions with restricted-transfer regimes, we rely on appropriate safeguards.

EEA to US: we rely on the EU Standard Contractual Clauses, plus the EU–US Data Privacy Framework where the recipient is self-certified, and we maintain transfer impact assessments for each recipient.

UK to anywhere: we use the UK International Data Transfer Agreement or the UK Addendum to the EU SCCs, applying the "data protection test" introduced by the Data (Use and Access) Act 2025.

Brazil: we rely on the EU–Brazil mutual adequacy decision (effective 2026-01-27) for EU-to-Brazil flows, and on Brazilian Standard Contractual Clauses for transfers from Brazil to the United States.

Subject to local law, you have the following rights over your personal data. We honor them globally, regardless of where you live.

• Access the personal data we hold about you, including your account, files, settings, AI chats, and billing history. Settings has it under Data: we email you a code, because we have to know it is you before we hand your account over, and entering it builds a ZIP with a written explanation of what is in it, why we hold each part, for how long, and who else has received it.
• Rectify inaccurate information directly in your profile, or with our help.
• Erase your account and the personal data associated with it. Settings has it under Data, and you have 30 days to call it back before it runs. It is issued to the primary database, the vector index and the text held beside it, object storage, your contact at our email provider, your person record at our analytics provider, and your customer record at Stripe; where one of them cannot be reached we record the failure and finish it by hand rather than leaving the account standing. What survives is listed under "How long we keep it" — tax and invoice records, which deleting the Stripe customer keeps, backups until they rotate, and analytics events for as long as our provider takes to process their deletion. What it cannot reach is the copies already sent to a model provider, which the Data Use page describes. The case the button refuses most often: if you are the sole owner of a team other people are in, transfer or delete that team first, because erasing it would erase their work too. Where it refuses for any other reason, write to us and we will do it by hand.
• Port the data you gave us, in a structured, machine-readable form: JSON, and Yjs binary for collaborative documents. It is the portable/ half of the same archive.
• Restrict certain processing. Settings has it under Privacy: turning AI off stops every further model call for your own work — chat, search indexing, and voice transcription — as soon as you set it, though a reply already being generated finishes. The embeddings computed from that work are deleted shortly afterwards, once a short window has passed in which you might turn it back on. For anything a switch does not cover, write to us and we will tell you what we can stop and stop it.
• Object to processing based on legitimate interests, including profiling.
• Withdraw consent for product analytics, or for sharing your work to train our models — both in Settings, under Privacy — or ask us to take you off our product email.
• Non-discrimination. Exercising a privacy right will never gate your access to the core service.
• Send a browser opt-out signal. Where your browser sends Global Privacy Control and you have not answered in Minima, we read it as a refusal of product analytics, as described under "What we set in your browser". It is a browser signal, so it has no effect in the mobile or desktop apps.

How to exercise them, and what happens then.Most of these you can act on yourself, in Settings: correcting your profile; turning product analytics off, turning AI off, and withdrawing the sharing consent, under Privacy; exporting your data and deleting your account, under Data. For the rest — objection, and any restriction a switch does not cover — emailprivacy@minima.dev from the address on your account and we will honor it by hand. The export is free however often you ask, and the button limits it to a couple of archives a day; ask us if you need more.

Security and abuse records are the one part of the archive that depends on where you are. We keep a few records to protect your account and the service: how many wrong two-factor codes have been counted against your account and whether that locked it, whether each of your API keys is held to a request limit, and the error logs our servers write, a few lines of which name an account when something failed for it. If you are in the European Union, the European Economic Area or the United Kingdom when you ask, your archive includes the first two, because the GDPR and the UK GDPR make no exception for them. It leaves out only the fields whose disclosure would itself weaken security — a credential, or the size of a limit, which would tell anyone how far they could push before being stopped — and it names each one it leaves out and why. The error logs are covered by your request too, but they are held by our infrastructure providers rather than in the database the archive is built from, so we search those by hand when you write to us. Anywhere else, California included, whose law excludes data kept to secure a service from an access response, these records are not in the archive, and the archive says so. We tell where you are from your device's time zone when you ask, and we keep only the answer — one of those places or elsewhere — on the request, never the time zone itself. If you ask again from a device in one of them before you have entered the code we send, the request moves to the European answer; nothing moves it the other way, and an archive that is already being built or is ready keeps the answer it was made with until it expires. If you are in one of them and your device says otherwise, write toprivacy@minima.dev from the address on your account and we will answer under the GDPR or the UK GDPR. Wherever you are, the archive lists the sessions currently open on your account, with when each was opened and the address and device it came from.

We will confirm your request when it arrives and complete it within the periods the law sets: one month under the GDPR, extensible by two further months where the request is complex, and 45 days under the CCPA, extensible once by 45. Access and portability requests are free.

Minima sets only strictly-necessary cookies and similar storage by default: those required for sign-in, session continuity, and basic security. These cannot be disabled without breaking the service.

The desktop app keeps the same things outside a browser: your sign-in, your preferences, such as your answer about product analytics and your MIDI devices, and patch edits you have not saved yet are kept in a file on your device that only your user account can read, and offline copies of what you open are kept in its web engine's storage, as a browser keeps them. Signing out removes the sign-in, and deleting the app's folders, which the installation guide lists, removes the rest.

Optional product analytics (PostHog) is off until you allow it. If you have an account, we ask you once during onboarding, wherever you are, and the switch we ask with starts off — we never tick it for you, so allowing analytics is something you do rather than something you leave alone. We record your answer so you are not asked again on another device. If you are signed out, we ask with a consent dialog in the EEA, the UK, Switzerland, and Brazil, and capture nothing until you accept; elsewhere it is enabled by default. We determine your region from your device's time zone, and we err towards asking. You can turn product analytics on or off at any time in Settings, and turning it off stops collection immediately.

Global Privacy Control decides it until you do.Where your browser sends the signal and you have not answered in Minima, we take it as a refusal and capture nothing, in every region — a signed-out visitor sees no consent dialog, and a visitor outside the consent regions is not enabled by default. If you have an account, the onboarding question is still put to you, because the signal is your browser's and the answer we record is yours; it arrives set to refuse, as it does for everybody, and nothing is collected unless you change it. An answer you have given in Minima is the more specific one and stands over the signal in either direction, on this device and on your others, so you can turn analytics on in Settings whenever you want it.

Minima is intended for adults: typically professional and hobbyist musicians, 3D artists, and game designers. The service is offered to users aged 16 or older in the EEA and the UK, and 13 or older elsewhere. We do not knowingly collect personal data from anyone below those ages and do not run targeted advertising to anyone under 18.

If you believe a child has created an account, contactprivacy@minima.dev and we will investigate and delete it where appropriate.

Minima uses AI to help you make creative work. The model's outputs are creative artifacts that you accept, edit, or discard. We do not use AI to make decisions that have legal or similarly significant effects on you. For example, we do not use AI to decide whether to grant you credit, suspend your account, or hire you. If we ever introduce such a use, we will disclose it here and offer a meaningful human review path.

We will update this policy as the product evolves and as the law changes. Material changes will be announced in the product and by email at least 30 days before they take effect, and the "Last updated" date at the top will reflect the most recent revision.

Privacy questions: privacy@minima.dev