How AI Works at KindMind

This page explains how AI features at KindMind actually work. That includes the Guide chat (an AI-guided self-reflection conversation), the memory it builds from your conversations over time, and the Journal memory setting that decides whether your journal entries feed that memory too.

The short version: your writing stays encrypted on our servers. When you talk to your guide, your messages travel through a small piece of infrastructure we run, then to Anthropic’s Claude API, then back to you. KindMind stores none of that and our worker keeps nothing. Anthropic doesn’t train on it, but under their standard commercial terms they can hold it for up to 30 days. An automated safety check runs on that trip too (more on that below). Your guide always remembers your conversations with it. Whether it also learns from your journal entries is up to you, and everything remembered is summarized and re-encrypted before being saved back.

Does This Apply to You?

It depends on your plan. On the free Journal plan, there are no AI features at all: no Guide chat, no Paths, no memory, and your journal entries are never sent to AI. Once you have an account, none of the infrastructure described below runs for you. One thing happens before that, though: if you answered the questions on our signup flow, those answers were sent through the AI proxy so the flow could respond to them. That happens before any account or plan exists, and our Privacy Policy describes it.

On Complete, AI features are available: the Guide chat and Paths. Everything below, the data flow, the safety check, memory summarization, describes how those features work. Journal memory, specifically whether your journal entries feed the AI’s memory, stays off until you turn it on. Your guide always remembers your conversations with it either way.

The Data Flow

When you send a message in the Guide chat, it takes this path:

• Your browser decrypts the conversation locally using your master key, then sends the message over HTTPS.
• It travels to a small KindMind worker (a Cloudflare edge proxy at ai-proxy.kindmind.com) that verifies a short-lived token bound to your session.
• Before forwarding your message, the worker runs a quick automated safety check: a second, separate call to the same Anthropic API, under the same no-training commercial terms, that looks for signs of crisis or risk. It runs on the messages you actually write (Guide chat, path chat, and the questions on signup), not on every AI call the app makes.
• The worker forwards the request to Anthropic’s Claude API.
• Claude’s reply streams back through the worker to your browser, which renders it. The reply arrives as ordinary text over an encrypted connection, so there’s nothing to decrypt; your browser encrypts it when it saves the reply to your account. If the safety check flags a serious concern, the worker skips the AI reply and sends a fixed supportive message with crisis resources instead, and when the concern is milder a second check reads the reply before it’s released to you.

On our side, plaintext exists only briefly, in transit through the worker, including during the safety check above. The worker doesn’t log message bodies, doesn’t store them, and has no database. The worker keeps no memory of past requests. What Anthropic holds on their side is covered in the retention section below. If the safety check flags a concern, KindMind keeps a category-level record of that (never the words themselves) so we can point you toward support, described more below.

One AI call skips this path entirely. Once a day, our servers ask Claude directly whether an email to you is worth sending. That request carries a behavioral digest (things like whether you’ve written recently, where you are in a path) and your account identifier. It carries none of your content, because our servers can’t read your content in the first place.

What “Summarization” Means

Once a day, KindMind takes your recent records (your conversations with the guide, and your journal entries if Journal memory is on; the first pass covers your 25 most recent records per feature), decrypts them in your browser, and sends them through the worker once. Claude returns a short summary. That summary is then re-encrypted with your master key and saved to your Memories.

From that point on, your guide sees the summary, not the original entries. As you keep writing, new records are folded into your memory periodically, the same way. The original 5,000-word journal entry never sits in an AI’s context window. Just the gist of it.

What Gets Stored, and Where

Memories live in a table called user_memories, encrypted with your master key. That key is only ever unlocked on your device. The copy we hold is wrapped by a second key that your browser derives from your password and never sends us. To us, a memory looks like a random string of bytes.

Your original records (journal entries, path responses, guide chat messages) stay encrypted in their own tables. Memory building doesn’t copy them anywhere new. It distills them into a separate memory blob that lives alongside.

You can read more about how master keys, password-derived keys, and the underlying encryption work on the encryption page.

Anthropic’s Posture

Claude is built by Anthropic. We use their commercial API with two Claude models: claude-sonnet-4-5 for your guide, and the smaller, faster claude-haiku-4-5 for the automated safety check.

Anthropic’s commercial API does not train on the messages that flow through it. Under the standard commercial terms that apply to our account, they may keep a request and its response for up to 30 days, subject to their own stated exceptions for safety, abuse prevention, and law. We don’t have a zero-retention arrangement with them, and we’d rather say so than let you assume otherwise. For speed, a short-lived cache on their side may also hold the repeated opening portion of a conversation for a few minutes so it doesn’t have to be re-sent with every message. They publish their data privacy practices at anthropic.com/legal/privacy.

Our half of the trip is simple: the worker stores nothing and logs no message bodies, and that holds for the main conversation and the automated safety check alike.

What KindMind Never Stores

Your writing reaches KindMind’s servers only as encrypted blobs and IVs (the random bits that make each encryption unique). Plenty of other things about your account are readable to us, though: your email, your subscription, your settings, product usage records, and the program and approach you picked for a path. The Privacy Policylists them. Alongside those, when the safety check above flags a concern, we store a category-level safety record (for example, “crisis resources shown”). If the check itself fails to run, we also store a content-free error record so we can keep an eye on it. We also keep operational records of each time the safety check runs, noting the category it saw and how long it took. Those carry no account identifier and never include your words. We stop short of calling them anonymous, because one is written at the same moment as the account-linked record above, so in principle the two could be lined up by their timestamps. We don’t do that, and we don’t keep them beyond 90 days. We never store:

• The plaintext of your journal entries, path responses, or guide chat messages
• The plaintext of your memory summaries
• Your unlocked master key, or your password in readable form
• The content of your conversations with Claude

The Guide chat and the memory summarization both go through the worker, which is a separate piece of infrastructure from the main KindMind app. The main app never receives your words from it, with two narrow exceptions. First, chat messages (not memory summarization) get an automated safety check, and when that check flags a concern (or fails to run), the worker sends KindMind a category-level record instead of the conversation itself. Second, the worker reports per-request token counts back to the main app so we can track what AI costs us. Those are numbers tied to your account, never text.

How to Turn It Off

Journal memory is fully optional and reversible. Open Account → AI features → Journal memory. From there you can:

• Turn Journal memory off. From then on, no journal entries are ever sent to AI. Your guide keeps remembering your conversations with it.
• Click Clear all AI memories to wipe the slate. Memory building starts fresh from there.

Turning Journal memory off stops journal entries from contributing new summaries going forward; memories created earlier stay until you clear or edit them. Clearing memories deletes what’s already there. Both are immediate.