Privacy Policy

This policy explains what data the Cremind app, the Cremind Connect service, and this website do and do not handle. Cremind is an open-source, self-hosted assistant that runs on your own machine; Cremind Connect is its token-less OAuth broker and event relay. Both are open source and can be audited at any time. Learn more about Cremind.

1. Scope

This policy covers three distinct things, described separately below: (a) the Google account data the Cremind app requests through OAuth, (b) the Cremind Connect relay service at connect.cremind.io, and (c) this marketing website.

2. The Cremind app — Google account data it requests

Cremind runs on your own machine. When you connect a Google account, the app requests these OAuth scopes:

• openid, userinfo.email — your email and sign-in identity. Used to identify the account you linked and to derive the one-way routing key that delivers content-free real-time event nudges to your session.

To provide the features you enable, the app also requests scopes for the Google Workspace services you use — each accessed only on your own device, at your request or through automations you configure:

• Gmail (gmail.send) — send only. The app can send the emails and replies you compose or approve; it cannot read your mailbox, and this scope grants it no access to your messages, drafts, labels, or search. If you enable email reading in Cremind, it connects to your mail provider over IMAP with credentials you supply yourself — outside this Google authorization.
• Calendar (calendar.events) — create, view, update, and delete your own calendar events.
• Drive (drive.file) — per file. The app can only open, edit, and organize individual files you hand it: the ones you select in Google’s own file picker, plus files Cremind creates for you. It cannot browse or search the rest of your Drive.
• Docs & Sheets (documents, spreadsheets) — create and read/edit the documents and spreadsheets you name.

Sign-in uses a loopback + PKCE flow directly between your device and Google. Your access and refresh tokens are stored only on your own machine; for Google, Cremind Connect is never in the token path.

Limited Use.Cremind’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, this data is used only to provide the features you enable; it is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition; it is not used for advertising; and no humans read it except with your consent, for security purposes, or to comply with applicable law.

3. AI models — what processes your data

Cremind is an AI assistant, so it is worth being explicit about which AI model sees your data. Cremind is self-hosted and runs on your own machine, and you choose the model it uses:

• A model running locally on your own hardware (for example via Ollama or vLLM). In this configuration your data never leaves your machine at all.
• A third-party AI provider that you configure with your own API key (for example OpenAI, Anthropic, Google Gemini, Groq, Mistral, DeepSeek, xAI or OpenRouter). In this configuration, content you ask the assistant to process is sent to the provider you selected, under your own account, and is subject to that provider’s terms. You control this choice and can change or remove it at any time.

Cremind operates no AI service of its own. We do not host, proxy, or route your prompts or your Google data through any Cremind server for AI processing — the connection is made directly from your own installation to whichever model you configured.

Google user data is never used to develop, improve, or train generalized AI and/or machine-learning models — neither ours nor any third party’s. Cremind uses Google user data only to perform the action you asked for, in that moment.

4. How we protect your data

Because Cremind is self-hosted and the relay is token-less, the most important protection is architectural: your Google data stays on your own machine and is never stored on Cremind’s servers. In addition, we apply the following data-protection measures:

• Encryption in transit.All communication with Google’s APIs and with the Cremind Connect relay is encrypted using TLS (HTTPS and secure WebSockets); your data and tokens are never sent over plaintext connections.
• On-device storage & access control. Your OAuth tokens and any Google content the app fetches are stored only on your own device, under your operating-system user account and its file permissions. They are not uploaded to, or accessible by, Cremind.
• Data minimization. The Cremind Connect relay stores no OAuth tokens and none of the contents of your email, calendar, Drive files, or documents — only transient, content-free resync nudges routed by a one-way hash (see the relay sections below). This sharply limits what could ever be exposed.
• Encrypted backups. If you export a Cremind backup, you can protect it with a passphrase; encrypted archives use AES-256-GCM with a key derived via scrypt, so the tokens and other secrets inside are unreadable without your passphrase.
• Secret management & scrubbed logs.Server-side secrets (such as the relay’s signing keys) are held as managed platform secrets and are never committed to source control. Operational logs are scrubbed of email addresses and tokens (see “Logs” below).
• Revocation & deletion.You can disconnect a Google account in the app at any time, which deletes the stored tokens from your machine, and revoke Cremind’s access entirely at myaccount.google.com/permissions.

5. The relay service — what it does not do

• It does not store your OAuth access or refresh tokens.
• It does not read, receive, store, or process the contents of your email, calendar, Drive files, or Jira/Confluence items.
• It does not maintain user accounts, profiles, or a database of users.

6. The relay service — what it does handle

• Verifying provider push notifications. When Google or Atlassian sends a push, the relay cryptographically verifies that it genuinely came from the provider.
• Deriving a routing key. It computes a one-way hash of the account email to decide which live connections to notify. The email is used only transiently to compute this hash; it is never stored or logged. Only the resulting hash is used, and it may appear in operational logs.
• Broadcasting content-free nudges. It sends a { "type": "resync" } message over WebSocket. This message contains no provider data. Your own app then fetches the actual data directly from the provider using its own token.
• Atlassian token exchange (transient).Because Atlassian uses a confidential OAuth flow, the relay performs the authorization-code and refresh-token exchange on your behalf and verifies your account by calling Atlassian’s identity endpoint. During this exchange your tokens pass through the service in memory and are returned to your app; they are not stored, logged, or retained. For Google, the relay is never in the token path at all.

7. Data at rest

The service is stateless at rest. The only persisted data is in a temporary key-value cache holding (i) Google’s public signing certificates and (ii) single-use nonce markers used to prevent replay attacks. Both auto-expire and contain no personal data. WebSocket connections are ephemeral and hold no durable state.

8. Logs

Operational logs are deliberately scrubbed: email addresses, mailbox cursors, and all tokens are never logged. Only a non-reversible routing-key hash and coarse event metadata are recorded for reliability. The service runs on Cloudflare Workers, and Cloudflare may process standard network and request metadata (such as IP addresses) as our infrastructure provider, subject to Cloudflare’s own privacy terms.

9. This website

This site is a static informational site. It uses Cloudflare Web Analytics, which is cookieless, collects no personal data, and performs no cross-site tracking. The site sets no advertising or tracking cookies of its own. Standard server and CDN access logs may be retained by our hosting provider, Cloudflare.

10. Third parties

The relay interacts with Google and Atlassian solely to verify pushes and (for Atlassian) exchange tokens. It shares no data with any other third party and does not sell data.

11. Children

Cremind Connect is not directed to children under 13, and we do not knowingly collect personal information from them.

12. Your choices

The service holds no account or stored personal data to access, export, or delete. To stop using it, unlink the integration in your local Cremind app and revoke the OAuth grant in your Google or Atlassian account settings.

13. Changes

We may update this policy. Material changes will be reflected by a new effective date on this page and in the public repository.

14. Contact

Questions about this policy? Email admin@cremind.io or see our contact page.