Privacy Policy

Who we are

Mitra is made by {{LEGAL_ENTITY}}, based in {{JURISDICTION}}. We are the controller of the personal data described here. You can reach us at [email protected].

This policy covers the Mitra apps for desktop and Android, our servers, and this website. It describes what the software does today, not what we hope it will do.

Summary in plain words

Mitra keeps your work on your device, in an encrypted database. You do not need an account. If you sign in and turn on sync, our server keeps a copy of that workspace that it can read, because that is what lets it run your integrations for you. We do not run analytics, show ads or sell data.

Local-first data

Each workspace is a separate SQLite database on your device, encrypted with SQLCipher. Tasks, projects, notes, journal pages, calendar events, timer sessions and settings all live there. Mitra works fully offline.

When you set up Mitra you choose how it locks:

• PIN or password. The database key is protected by your PIN or password. It never leaves your device, and we cannot reset it. If you forget it, the local data cannot be recovered.
• No lock.The database key is kept in your operating system's keychain. The file on disk is still encrypted, but anyone or any program that can use your computer account can open it.

The app also keeps a plain-text diagnostic log on your device. It is not encrypted and can contain details from your workspace. It stays on your device unless you choose to send it to us.

What we never see: the contents of a local workspace, and your PIN or password.

What the app sends without an account

On a fresh install, with no account and no connected services, Mitra contacts one place: our update server, to check for a new version. The check sends your platform, processor architecture and app version. Like any request, it also reaches us with your IP address. Nothing else is sent.

If you connect an integration to a local workspace, the app also talks to that service and, for sign-in and token refresh, to our server. That is covered under Integrations below.

Accounts

You only need an account for sync. You sign in with Google or Microsoft; Mitra has no passwords of its own. When you sign in, we store:

• your email address, name and a link to your profile picture
• the account id Google or Microsoft gives us
• the devices you sign in on, with the device name your system reports
• if you subscribe, a Stripe customer id and your subscription status

Sign-in asks Google or Microsoft for your basic profile. Google may also ask, in the same step, whether Mitra can use your calendar. On your device, the sign-in tokens are kept in an encrypted vault.

We do not send email. There is no newsletter and no account recovery by email; you recover access by signing in again with Google or Microsoft.

Cloud sync

Sync is off by default and is set per workspace. When you turn it on:

• Our server stores a copy it can read. The workspace is sent to our server and stored there in readable form. This is not end-to-end encryption. We chose it because it is what lets the server sync your devices, run your integrations while your devices are off, and, where your plan includes it, answer an agent you have connected remotely.
• Two copies on the server.The workspace is stored in our database and again in the sync service's own store, which sends changes to your devices.
• Workspace settings sync too. That includes the access token for local agent access, if you have turned it on.
• Encrypted in transit. Everything travels over HTTPS.
• Service tokens encrypted at rest. Tokens for your connected services are encrypted with AES-256-GCM. The keys are held in HashiCorp Vault, not with the data.
• Our own servers. The servers run on {{HOSTING_PROVIDER}}, managed with Coolify.

Your devices keep their own encrypted copy, exactly as for a local workspace.

Integrations

You can connect Google, Microsoft, Jira, Linear, Todoist, Asana, ClickUp, Trello and Monday.com. Sync is two-way, so Mitra asks each service for permission to read and to change your items. These are the permissions we request:

How your data moves depends on the workspace:

• Local workspace. The app talks to the service directly from your device, and imported items are stored only on your device. The service sends its tokens to our server when you connect; our server holds them for at most five minutes, until your app collects them. When a token needs refreshing, the request passes through our server, which does not store it.
• Synced workspace. Our server runs the integration. It stores the tokens (encrypted, as above) and the items it imports, and it receives change notifications from the service. Those notifications are checked for a valid signature and are not stored.

When you disconnect a service, Mitra deletes its copies of the tokens. It does not yet revoke Mitra's access at the service itself. To do that, remove Mitra from the connected apps page of your account at that service. For example, Google lists it under Security, Third-party apps with account access, and Microsoft under Privacy, Apps and services.

Payments

Pro is sold through Stripe. You enter your card details on Stripe's pages; they never reach us. We store your Stripe customer id and the state of your subscription. Stripe handles your payment data under its own privacy policy.

Diagnostics

In the app

Crash reporting is off until you turn it on. Until then the reporting library is not loaded. Once you turn it on, the app sends to Sentry, in the EU:

• crash and error reports: what failed, app version, system
• a sample of performance traces
• for sessions that hit an error, a replay of the screen with all text and media masked

You can turn it off again at any time in the app's settings.

On this website

This website has no analytics and no ads. When a page breaks, it sends an error report to Sentry in the EU: the error, the page address and your browser and system versions. We do not attach your IP address or any identifier. There is no session replay, no performance tracing and no log forwarding.

We set no cookies on this website. It remembers your light or dark choice in your browser's local storage, which never leaves your browser. When you sign in to the app, our API sets one short-lived cookie on its own domain to carry the sign-in state; it is needed for sign-in to work.

On our API

Our API sends its own errors to Sentry, plus a sample of request timings. Query strings are removed from every address before sending, and request headers and bodies are not included.

Server logs

Our servers log requests so we can run and secure the service. A log line can contain:

• your user id, workspace id and device id
• the request path, without its query string
• your IP address, on downloads and on routes where we limit abuse

Logs are sent to Axiom and kept for {{LOG_RETENTION}}. They do not contain the contents of your tasks or notes.

Subprocessors

These services process personal data for us:

The integration services only receive data when you connect them. Some of these services process data outside the UK and the EU, including in the United States. Where the law requires it, those transfers rely on an adequacy decision or on standard contractual clauses.

Why we process your data

• To provide the service you asked for: accounts, sync, integrations and billing.
• Our legitimate interest in keeping the service working and secure: server logs, website and API error reports.
• Your consent: crash reporting in the app. You can withdraw it at any time.
• Legal obligations: tax and accounting records for payments.

Retention

• Local data: on your device until you delete it.
• Cloud data: kept while your account and the workspace are active. When you delete a cloud workspace or your account, we purge the data 30 days later.
• Revoked sign-in tokens: deleted 7 days after they are revoked.
• Deletion markers: when you delete an item in a synced workspace, a marker without its content is kept for 90 days so every device learns about the deletion.
• Diagnostics: kept by Sentry for the retention period of our Sentry plan, then deleted.
• Server logs: {{LOG_RETENTION}}.
• Payment records: kept by Stripe and by us as long as tax law requires.

Your rights

Export

The app can export a workspace as an SQLite file. The file is not encrypted and contains the tokens for your connected services, so store it somewhere safe and delete it when you no longer need it. There is no export of the server copy yet; a synced workspace is also on your devices, and you can export it from there.

Delete

You can delete a cloud workspace, or your whole account, from the app. We purge the server copy 30 days later. Your local workspaces stay on your device until you delete them there. If you pay for Pro, cancel your subscription in the billing portal before you delete your account.

Under the GDPR, the UK GDPR and similar laws

You have the right to:

• know what data we hold about you and get a copy of it
• have it corrected
• have it deleted
• restrict or object to how we use it
• receive it in a portable format
• withdraw consent, where we rely on consent
• complain to your data protection authority

Under the CCPA

California residents have the right to know, delete and correct personal information, and not to be treated differently for using these rights. We do not sell or share personal information for advertising.

To use any of these rights, email [email protected] from the address on your account. We answer within one month.

Children

Mitra is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us data, email us and we will delete it.

Changes

When we change this policy, we post the new version here with a new date. We do not send email notifications, so check this page if you want to follow changes.

Contact

{{LEGAL_ENTITY}}, {{JURISDICTION}}. Email [email protected].