Privacy Policy

This policy explains what personal data PacedMind keeps, why, where and for how long, and the rights the GDPR gives you. PacedMind’s code is open (GitHub), so you can check what it does.

Who is responsible

The controller of your data is:

NMD Mikołaj Bednarczyk, ul. Warszawska 62 lok. 4, 96-500 Sochaczew, Poland. NIP (tax ID) 8371874588, REGON 523093293. Email mbednarczyk@preseed.tech.

Without an account

The desktop app without an account (the One device plan) keeps everything on your computer. We receive none of your plans, tasks or sessions. When you download the app, our server sees the request like any web server does (below).

What we keep with an account

• Your account: your email address, your password (only as a hash, which can’t be turned back into it), your authenticators, and your sign-ins (times, devices, IP addresses).
• What you put in PacedMind: areas, projects, tasks, events, settings, and the agent sessions PacedMind starts with their reports. This can include anything you write in them.
• Your computers: each computer’s name and system, when it was last online, PacedMind’s version, and which agent tools it has (names and versions only, never paths, keys or accounts), and short summaries of the Claude Code and Codex sessions on it: a title, the folder’s name and times, never the conversation.
• Notifications: for browsers where you turn them on, the push service’s address and keys.
• Your subscription: your trial’s end, and from the payment provider your customer and subscription ids, status, country, price and period. Your card never reaches us.

Images agents attach to their reports stay on the computer that saved them.

Why, and on what legal basis

• To provide PacedMind Cloud to you: the contract with you (GDPR art. 6(1)(b)).
• To keep accounts and the service secure, prevent abuse and handle complaints: our legitimate interest (art. 6(1)(f)).
• To keep invoices and payment records: the law (art. 6(1)(c)), under Polish tax and accounting rules.
• To email you about your account, your subscription and changes to these policies. We send no marketing without asking.

Who processes it for us

• Supabase hosts the Cloud database and sign-in, in the EU (Ireland), and sends sign-in emails.
• OVHcloud hosts the web app, this website and the downloads, in the EU (France).
• Stripe sells the subscription as the merchant of record, takes payments and keeps your payment details and billing address, as a controller of its own for them (Stripe’s privacy policy). Stripe may process data in the United States under the EU’s standard contractual clauses and the EU–US Data Privacy Framework.
• Browser push services (Google, Mozilla, Apple, Microsoft) carry the notifications you turn on.

We don’t sell your data. We share it with the providers above, services you connect as described below, and when the law requires it.

Agents and connectors you authorize

When you connect ChatGPT, Claude or another MCP client and select Allow, that service can read and change your planner on your behalf. Tool responses can include your tasks, projects, areas, events, preferences, computer summaries and session reports. Those responses reach the service you connected and are subject to its privacy policy. Your password, authenticator secrets and local files are not returned by planner tools.

PacedMind keeps the agent’s OAuth approval and sign-in so it can enforce access. Disconnect it in Settings → Connected agents to end its access. Disconnecting does not erase information already saved in that service’s conversations; use that service’s controls to manage it.

This website

pacedmind.com and its docs use no cookies. We count visits with Umami, running on our own server, which keeps no personal data and no identifier that follows you. Our web server doesn’t log visits; the system’s own logs, which can hold an IP address when something fails, are kept for up to 30 days. The web app uses only the cookies it needs to keep you signed in.

How long we keep it

• Your account and everything in it: until you delete the account, which deletes it at once.
• Invoices and payment records: 5 years from the end of the year they're from, as Polish tax law requires.
• System logs: up to 30 days. Backups of the database, which our host keeps: up to 7 days after a deletion.

Security

You can start planning before setting up two-factor sign-in. Once enabled, it is required when you sign in; controlling computers requires it too. The database limits each account to its own data and checks the permissions of each session. Connections are encrypted, and the desktop app encrypts its sign-in on your computer.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict it, to receive it in a portable form, or object to processing based on our legitimate interest. Much of this you can do yourself: the desktop app moves your data to your computer, and deleting the account deletes it. Otherwise write to mbednarczyk@preseed.tech; we answer within a month. You can also complain to the Polish data protection authority, the Prezes Urzędu Ochrony Danych Osobowych (uodo.gov.pl), or the one where you live.

Changes

We’ll post any change here, and email you before a change that matters takes effect.