How KindMind Protects Your Data

When you write in KindMind, your words are scrambled into unreadable code on your device before they ever leave your browser. The scrambled data is what gets stored on our servers. Only you, with your password or recovery key, can unscramble it. Not us, and not our engineers.

This is called zero-knowledge encryption. We store what you write, but we have zero knowledge of what it says.

That covers the content. It does not cover everything: your email address, your settings and subscription status, and which guided program you chose are stored in a form we can read, because the app cannot run otherwise. Section 4.2 of our Privacy Policy lists those categories, and the section below on why this matters shows exactly where the line falls.

Why This Matters

KindMind holds some of the most personal things you’ll ever write: journal entries about your struggles and honest conversations with your guide. That data deserves the strongest possible protection.

With zero-knowledge encryption:

• A database breach exposes what you wrote as ciphertext only. Your journal entries, your guide and path conversations, and the memories built from them stay locked
• KindMind engineers cannot read your stored writing, even if they wanted to
• Law enforcement requests get encrypted blobs we cannot decrypt, aside from category-level safety records (flags from the automated safety check, or content-free error records when the check itself fails) that never include your words
• What you write stays yours alone

Where the line sits. A breach would still expose the account and operational information we hold in readable form, listed by category in Section 4.2 of our Privacy Policy: your email address, your settings and subscription status, and which guided program you chose. A program on grief or sobriety would be visible by name, even though everything you wrote inside it stays encrypted.

Our servers also hold the locked copy of your Master Key. Anyone who took that copy could sit offline and guess at your password for as long as they liked, with no login screen or rate limit in the way. The 600,000-round key derivation described below makes each guess expensive, which is exactly why it is there, but it cannot save a password that was easy to guess. Use a strong, unique one here.

How It Works

Think of it like a safe deposit box at a bank:

• The bank (KindMind) provides the box and the vault
• You hold the only key (your password)
• The bank can store your box, move it, back it up, but they can never open it
• If you lose your key, the bank cannot open the box for you (that’s what the recovery key is for)

The Two-Key System

KindMind uses a two-key system, the same approach used by Proton Mail, 1Password, and Standard Notes.

Master Key: A randomly generated secret that actually encrypts what you write. It never leaves your device in readable form.

Password-Derived Key: Created from your password using a slow, deliberate process (600,000 rounds of a key-stretching algorithm). Its only job is to lock and unlock your Master Key.

Worth being precise about: your account password itself does travel to our authentication provider when you sign in, the same as on any account anywhere. What never leaves your device is the Password Key derived from it, and the Master Key that key unlocks. Those two are what stand between your writing and everyone else, and neither has ever been on our servers.

Why two keys? Because when you change your password, we only need to re-lock the Master Key with your new password. We don’t have to re-encrypt every piece of data you’ve ever written.

What Happens When You...

Sign Up

1. Your browser generates a random Master Key
2. Your password derives a Password Key
3. The Password Key locks (wraps) the Master Key
4. The locked Master Key is sent to our server (we can store it, but we can’t open it)
5. A Recovery Key is shown to you. Save it somewhere safe!
6. The unlocked Master Key stays on your device, ready to work

Where the unlocked key sits depends on the device. In a browser it lives in the tab’s session and clears when you close it. In the mobile app it is kept in your phone’s biometric-protected keychain, so it deliberately survives closing and reopening the app and clears when you sign out.

Log In

1. You authenticate with your email and password
2. Your browser fetches the locked Master Key from the server
3. Your password derives the Password Key
4. The Password Key unlocks the Master Key
5. You can now read and write your data

Write a Journal Entry

Read a Journal Entry

When you log in, your browser uses your password to derive a Password Key locally. It then fetches your Master Key from our server (which is stored in encrypted form we can’t read) and decrypts it using that Password Key. From that point on, the Master Key stays on your device and handles all encryption and decryption: in the browser session on the web, in your phone’s biometric-protected keychain in the mobile app. The unlocked Master Key is never shared with us or anyone else.

Talk with Your Guide (AI Chat)

Your guide conversations are never stored on KindMind’s servers in readable form. Your browser talks to a standalone Cloudflare Worker edge proxy we run, a tiny function that injects our API key, runs an automated safety check, and forwards your messages to Anthropic. It keeps no database, no logs, and no storage. Only the encrypted result is stored on our servers.

Anthropic is the one link in that chain we do not control. It does not train on what we send it, but under the commercial API terms that apply to our account it may hold a request and its reply for up to 30 days. We do not have a zero-retention arrangement with them, so that window is real and you should know about it.

Change Your Password

Your old password unlocks the Master Key. Your new password creates a new lock around it. Your actual data is never re-encrypted.The Master Key itself didn’t change, just the lock around it.

Recover Your Account

If you forget your password, it takes two things, and you need both. First, we email you an account recovery link, and signing in through it proves the inbox is yours. Then your Recovery Key restores your Master Key, which is the part we genuinely cannot do for you. You set a new password, a new lock is created, and you’re back in with all your data.

What Gets Encrypted (and What Doesn’t)

The rule: What you write inside the app is encrypted. Structural metadata the app needs to function stays readable, and so does anything you write straight to us, like a support message or a piece of feedback, since we have to read those to answer them.

One exception, stated plainly:your journal entries and your messages to the guide never reach our application servers in readable form. The plans behind a guide or path, and the title of a guide thread, are different. They live encrypted like everything else, but your browser sends them back to us for the moment it takes to build the AI’s instructions. We do not store them, log them, or keep them after the response goes out.

The Technical Details

What AES-256-GCM Means

• AES (Advanced Encryption Standard): the global standard for symmetric encryption
• 256: 256-bit key length (2²⁵⁶ possible keys, more than atoms in the observable universe)
• GCM (Galois/Counter Mode), which provides both encryption and tamper detection

If someone modified your encrypted data, GCM would detect it and refuse to decrypt. Your data can’t be silently altered.

What 600,000 Iterations Means

Turning your password into an encryption key is deliberately slow. Each login takes a fraction of a second for you, but an attacker trying to brute-force passwords would need to perform 600,000 cryptographic operations per guess. At millions of guesses per second, this slows them to a crawl.

What We Cannot Do

With zero-knowledge encryption in place:

• We cannot read your stored journal entries or guide conversations. Those rows only ever hold ciphertext we cannot open
• We cannot reset your encryption if you lose both your password and recovery key
• We cannot comply with data requests for the content you write (we don’t have it in readable form). What we could hand over is the readable account and operational information in Section 4.2 of our Privacy Policy
• We cannot recover your data if you lose access (this is the trade-off of true privacy)

Where plaintext does travel: when you use an AI feature, your device decrypts what that request needs and sends it through our AI proxy to Anthropic. Nothing is stored or logged on our side of that trip, and the reply is encrypted on your device before it is saved. Anthropic does not train on it, but it may hold the request and the reply for up to 30 days under its commercial API terms.

One thing we do see: an automated safety check on your guide conversations can flag a safety concern and send us a category-level record (never the words themselves), so we can point you toward crisis resources when it matters. If the check itself fails, we receive a content-free error record so we know it is working.

The Trade-Offs

Zero-knowledge encryption is the strongest form of data protection, but it comes with real trade-offs:

How This Compares

This column is about what you write. In every row above, a breach of our database would still expose the readable account and operational information in Section 4.2 of our Privacy Policy, including which guided program you chose.