Privacy Policy

Last updated: October 19, 2026

This page describes what MindLoom collects, how we use it, and how to disconnect Google or ask us to delete data. It is public. Nothing on this page is hidden behind a cookie notice.

• Who we are
• Google Sign-In
• Google Workspace
• Other data
• How we use data
• AI processing
• Limited Use
• Storage and security
• Sharing
• Subprocessors
• Retention
• Deletion
• Children
• International
• Changes
• Contact

Who we are

MindLoom is an organization knowledge product at https://mindloomai.org. People in a company sign in, connect approved work sources, and ask questions. Answers can cite ingested sources. Optional desktop or browser capture creates workflow “Skill Files.”

The product application is at https://app.mindloomai.org. This policy covers both this website and the product.

Google Sign-In

Google Sign-In is not the same as connecting Gmail, Drive, or Calendar.

When someone signs in with Google, we receive their email address, name, profile identifier, and, from the ID token, the email domain. We use that information to create or join an organization on the same domain, keep a session, and show the account in the product.

We do not read Gmail, Drive, or Calendar from Sign-In alone. Those sources are available only after the separate Google Workspace connection described below.

Google Workspace / Gmail / Drive / Calendar

After sign-in, a user can connect Google Workspace. That connection starts only when the user clicks Authorize Google and grants access on Google’s consent screen. We request the scopes in the table below, and we use them only for the purposes in that table.

What we read from Gmail

For Inbox messages the user has approved for import, we read and store the message id, thread id, From, To, Subject, and Date, the message body as plain text or HTML, a snippet if the body is empty, and the raw message JSON. We keep that JSON so ingestion and provenance stay traceable. We sync Inbox, and later we sync incremental Inbox changes.

We store imported Inbox content. We also store embeddings and text chunks derived from that content so search and answers can cite the messages.

Gmail access is for productivity: generative summaries and search over the user’s own work email, plus sending email the user has consented to send (expert-routing notices and mail the user explicitly asks MindLoom to send). We do not use Gmail as a general outbound marketing tool. We do not send bulk marketing, newsletters, or promotions through Gmail. One-off export of email is not the product.

What we read from Drive

For files in locations the user includes during setup, we read the file id, name, parents, MIME type, modified time, and sharing metadata as needed to honor access controls. We export text from selected Google Docs, Sheets, and Slides. For some other selected files, such as PDFs, we extract binary or text content. We do not read Drive locations the user did not include.

What we read from Calendar

For calendars the user selected, we read each event’s summary, start and end, location, attendees, and description.

Who can see imported Google content

By default, imported Google content is visible inside MindLoom only to the connected account. MindLoom respects source permissions (respect_source_permissions). The user, or an admin depending on how the organization is set up, can change that visibility to the whole organization or to selected people or departments. Other people in the same MindLoom organization see imported Google content only when that visibility has been set.

Other data we collect

This section is separate from Google API data. It does not describe Gmail, Drive, Calendar, or Google Sign-In. Those are covered only in the sections above.

• Account and organization. Email, role (admin or member), and a directory CSV if an admin uploads one.
• Manual uploads. Files the user uploads, such as PDF, Office, CSV, text, and WhatsApp .txt exports.
• Other connectors the user enables. Microsoft 365, Zoom, Slack, and GitHub. Tokens for those connectors are stored encrypted.
• MindLoom Capture (Mac). The Mac agent reads on-device Accessibility events from an explicit app allowlist. Only task summaries are uploaded. Raw events stay on the Mac at ~/.mindloom/events/. The Mac agent does not capture keystroke content and does not take screenshots. Password fields are redacted. An empty allowlist means nothing is captured.
• Browser extension. Screenshots stay on the device until the user approves an upload.
• Usage needed to run the service. Session tokens, job status, logs, and security events.

How we use data

We use data for these purposes:

• Provide search and questions and answers with citations (LoomBot).
• Build a company knowledge graph and status views.
• Draft Skill Files from approved captures.
• Route questions to experts and send those notifications.
• Keep the service secure and working.

For Google user data, use is limited to the purposes in Google Sign-In, Google Workspace / Gmail / Drive / Calendar, and Limited Use. We do not use Gmail, Drive, or Calendar data for advertising or marketing.

AI processing

Imported text, including Gmail, Drive, and Calendar content the user connected, is sent to a large language model provider to embed, summarize, and answer questions. The default provider is OpenAI via its API. An organization may configure a local or compatible model instead.

That provider is a processor for providing the feature. We do not allow that provider to use MindLoom customer Google data to train their general models. We do not train our own general models on customer Google data.

Limited Use

MindLoom’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell Google user data. We do not use it for advertising. We do not use it to train general models, and we do not allow our language-model provider to use MindLoom customer Google data to train their general models. We do not transfer it except to the subprocessors that run these features, to people in the same MindLoom organization when visibility was set to the organization or a selected audience, or when the law requires it.

MindLoom staff do not read customer Google content except where needed to keep the service secure or to comply with the law. People inside the customer’s organization can see that content when a user or an admin has set visibility to them.

Storage and security

MindLoom is hosted as a cloud application, currently on Railway, with PostgreSQL, Redis, and Neo4j. Files and blobs are stored local to the deployment or in S3-compatible object storage.

OAuth refresh and access tokens are encrypted at rest with Fernet when a token encryption key is configured. Transport is HTTPS in production. Access is scoped to the organization, and search respects visibility access controls.

Sharing

We do not sell personal data. We share personal data only with:

• Subprocessors that run the product (hosting, database, and OpenAI or the language model the organization chose).
• Other people in the same MindLoom organization, only if the user or an admin set visibility to the organization or to a selected audience.
• Law enforcement, if legally required.

Subprocessors

These parties process data to run MindLoom:

• Railway — cloud application hosting.
• PostgreSQL, Redis, and Neo4j — databases used by the deployment.
• Object storage — local to the deployment, or S3-compatible object storage when that deployment uses it.
• OpenAI — the default language-model provider, via API, unless the organization configures a different local or compatible model. In that case, the provider the organization chose is the subprocessor for those requests.

Google user data sent to a language-model provider is sent only to provide search, embeddings, summaries, and answers. It is not provided so that provider can train general models.

Retention

We keep connected Google data, and the embeddings and chunks derived from it, while the organization uses MindLoom and the connection remains useful for search. We keep sync cursors and watch state so we can update those sources. We keep server logs only as long as needed for operations and security.

Deletion

Disconnecting Google in the product and deleting already-ingested Google data are different.

Disconnect. Disconnecting Google in the product deletes stored Google OAuth tokens, the connection policy, and sync cursors. It does not automatically wipe mail, documents, calendar events, or embeddings that were already ingested. Disconnect does not empty the knowledge base.

Revoke access at Google. The user can also revoke MindLoom at Google Account → Security → Third-party access. That stops new Google API access. Data already copied into MindLoom is not removed by that revoke. Deleting copied data still requires the request below.

Delete an account or ingested Google data. Email privacy@mindloomai.org. We will delete or de-identify personal data we control within a reasonable period, except data we must keep for security or because the law requires us to keep it.

Children

MindLoom is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have, email privacy@mindloomai.org and we will delete it.

International

Data may be processed in the United States and in other countries where our hosting and language-model providers operate.

Changes

We will update this page when this policy changes, and we will change the “Last updated” date at the top. Material changes to how we handle Google user data will be described on this page.

Contact

Privacy questions and deletion requests: privacy@mindloomai.org

Website: https://mindloomai.org

Questions