Security & Disclosure

We build software on the assumption that the user - not us - owns their data. That shapes how every product is designed, and it's the reason security and privacy are defaults rather than add-ons.

Posture at a glance

• Local-first. Notes and working data stay on your device in open formats; we don't run a server that holds them.
• Encrypted transport. Sync and remote sessions use modern, end-to-end encryption (QUIC / TLS 1.3, ciphertext-only relays).
• Your own keys. Any cloud AI runs on an API key you provide; requests go directly to your chosen provider.
• No telemetry. No analytics, trackers, or ad networks in our products.

Reporting a vulnerability

If you believe you've found a security issue in any Corvux Mindware product, we'd rather hear about it from you than anyone else. Please send the details to us privately before any public disclosure.

What to include

• The product and version affected.
• A clear description of the issue and its impact.
• Steps to reproduce, or a proof of concept.

What to expect

• We aim to acknowledge reports within 3 business days.
• We'll work with you on a fix and credit you in the disclosure if you'd like.
• Acting in good faith - not exposing user data or disrupting live systems - keeps you within safe harbor.

Scope

This covers our shipped products and this website. Out of scope: issues in third-party services (AI providers, GitHub, Cloudflare) - report those to the relevant provider.