Privacy

What leaves your Mac

An audited claim, not an aspiration — every byte Minne sends anywhere, per feature, and everything that never moves.

Minne has no backend. There is no Minne server to sign into, no telemetry endpoint, no analytics, no crash reporter, and no cloud copy of your memory. The Swift app links no networking API at all; the only code in the project that opens a socket is the brain's provider layer, talking to the one AI provider you configured.

That is a checkable claim rather than a promise — the app is MIT-licensed and readable.

#What travels, feature by feature

Everything below goes to your AI provider, under your own account or key, and nowhere else.

Feature	What is sent
The Minne key	The focused field's text, your selection, the visible text of the window around it, and the wiki pages Minne recalled for grounding — clipped, inside one model request.
Chat	Your messages, plus whatever memory excerpts the assistant reads through its search and read tools while answering.
Memory sync	Recent raw captures, in batches, so the agent can distil them into wiki pages. Masking happens before a capture touches disk, so what is sent is already masked.
Sign-in	One OAuth exchange with that provider's own auth endpoints, or nothing at all for an API key.

And the one that matters most:

Never sent
The `~/Minne` folder	There is no backup, no sync, and no code path that uploads your memory anywhere. Pages are read into model prompts as excerpts when a feature needs them. That is the only way any of it travels.

#The hosts Minne can contact

Model requests go to the provider's public API host:

Anthropic — api.anthropic.com
OpenAI — chatgpt.com/backend-api, api.openai.com
Local — the base URL you set, http://localhost:11434/v1 by default

Sign-in adds those providers' own auth endpoints: claude.ai and platform.claude.com for Anthropic, auth.openai.com for OpenAI.

#Text, never pictures

Minne reads through the macOS Accessibility APIs — the same mechanism a screen reader uses. It asks the focused window for its text. It does not take screenshots, does not record the screen, and does not request Screen Recording permission, so macOS will never show you the purple recording indicator because of Minne.

#Masked before it is written

Five kinds of number are replaced with ▮▮▮ at capture time, before anything is written to disk: card numbers, CVVs, IBANs, Swedish personal identity numbers and US social security numbers. The masked form is what lands in ~/Minne/sources/, and therefore what a sync batch later sends to your provider. The capture records only how many spans were replaced, never what they were.

The design rule is validate, don't just match. A regex alone would mask any sixteen-digit run — order numbers, build ids, phone lists — and a memory full of ▮▮▮ is worse than useless. So every pattern with a checksum is checked against it (Luhn for cards and personnummer, mod-97 for IBAN), and the two without one are anchored on a separator or a nearby keyword instead. The cost is accepted false negatives; the benefit is a memory that still reads like the screen it came from.

Password fields — anything macOS marks as a secure text field — are skipped whole, with their entire subtree, before a single attribute is read. They are never read-then-masked.

#Excluding things from capture

The blacklist in Settings → Privacy takes apps you never want read and domains you never want read in a browser. Those windows produce no snapshot at all — this is a harder rule than masking, which cleans a snapshot after the fact.

Minne ships with the list already populated: the password managers, the system keychain, the vault websites, and the credential pages of the identity providers most people pass through daily. Add your bank, your therapist's portal, whatever you would rather it did not see. Edits reach the running capture engine immediately.

Private and incognito browser windows are skipped on their titles, without being on any list.

Pausing is the blunt version: the menu bar and Settings both offer 15 minutes, an hour, or until you say otherwise.

#Erasing it

Almost everything Minne knows is ~/Minne. Delete the folder and that part is gone — there is no server-side copy to also delete, because there is no server.

Two things live outside it, in ~/Library/Application Support/Minne: the search index over your captures, and your stored sign-in. Delete All Memory… in Settings → Privacy removes all of it in one go — the folder, the index, the sync state and the credential, in and out of memory — and starts you over from an empty wiki. It asks you to type delete first.

Your provider and model choice survives, deliberately: which AI you picked is a preference, not a memory.

#What an MCP client changes

minne-brain --mcp serves your memory read-only to an MCP client you configure, over local stdio. Nothing listens on the network. But what that client then sends to its model is governed by the client, not by Minne — if you connect Claude Desktop, memory excerpts travel wherever Claude Desktop sends them. See Minne in Claude Desktop.

Using a Claude or ChatGPT subscription from a third-party app is a grey area under those providers' terms of service. You authenticate with your own account and the risk sits with that account. The API-key and local-model paths carry no such question.