A feature-by-feature list of where your data actually goes. No summaries, no trust-us — this is the whole map.
| Feature | Where | Detail |
|---|---|---|
| Account / login | Local | No account server — your session is stored in browser localStorage. The user list is bundled into the app's public source file, not fetched from a database: each entry's credential is a PBKDF2-SHA256 hash of name+DOB+access code (150,000 iterations), and non-admin users' names are AES-GCM encrypted with a key derived from the admin's own login secret — so reading the raw file gets you neither a working credential nor a readable name without already knowing someone's login. This is a light access gate for personal/family use, not enterprise-grade authentication. |
| Saved articles, angle drafts, quiz progress | Local | localStorage, mirrored to your own vault's _reports/*.json backup files. |
| AI provider API key | Local | Stored in browser localStorage only. Never transmitted anywhere except directly to that provider's API when you generate content. |
| Feature | Where | Detail |
|---|---|---|
| Angle generation (Publish, Study Guide, Frameworks, etc.) | Third-party | Article text + your prompt sent directly from your browser to whichever provider you picked (Anthropic, OpenAI, Gemini, Groq, Ollama, OpenRouter, Cohere, MiniMax…). Never touches a TheVaultMind server — there isn't one. |
| Feature | Where | Detail |
|---|---|---|
| RSS feed refresh | Server | Routed through a small Node relay to bypass CORS. Optional: you can point it at your own self-hosted instance instead of the default one. |
| Full-article fetch | Server | Same relay — fetches the article URL server-side and returns clean text, since browsers can't fetch arbitrary cross-origin pages directly. |
| Hacker News angle sourcing | Third-party | Direct browser calls to the public Hacker News API (Firebase). |
| Feature | Where | Detail |
|---|---|---|
| Obsidian export | Local | Written directly to your local filesystem via the browser's file system access — never leaves your device. |
| Google Drive backup/export | Third-party | Direct browser calls to Google's Drive API using your own OAuth session. TheVaultMind never sees the file contents or your Google credentials. |
| Notion / OneNote export | Third-party | Direct browser calls to Notion's or Microsoft Graph's API with your own integration token. |
| Report → Vault Health scan | Local | Reads every note in your connected local vault (not just what this app saved) via the same file system access as the row above, and scores duplicate/near-duplicate content, broken links, orphans, and stale notes entirely in your browser. Nothing is uploaded — it's a read-only scan of files already on your device. |
| Feature | Where | Detail |
|---|---|---|
| Feed scoring ("✦ Score my feeds") | Third-party | Sampled headlines from your configured feeds + your prompt, sent directly from your browser to whichever AI provider you already have set up — same call mechanism as angle generation, your own key. Never touches a TheVaultMind server. |
| Feed Quality Backend (optional) | Server | A separate small self-hosted relay, off by default. If connected, it stores only your last scoring report (feed name + tier + reason) so it survives a closed tab and syncs across devices — it never sees your AI provider key or your feed content. |
| Feature | Where | Detail |
|---|---|---|
| Login verification | Local | Name + date of birth + code are hashed (PBKDF2-SHA256) in your browser and checked against a list shipped in auth.js — the raw values never leave your device. |
| Users backend (optional) | Server | If the admin has connected one (Settings → admin panel → "Users backend"), a login not found in the shipped list is checked against a small self-hosted server instead — only the one-way hash is sent, never your name/DOB/code. Lets an admin add or remove a login without redeploying the app. Off by default; when off, login works exactly as the row above describes. |
| Cross-app session (Lens) | Server | A signed, expiring cookie shared between TheVaultMind and Lens so logging into one unlocks the other — carries only your name and role, never anything you've written. Verified by the same users backend above; issued fresh on login, cleared on logout from either app. |
| "Email credentials to..." (admin panel) | Local | Opens your own mail client via a mailto: link, pre-filled with a new user's login details — nothing is sent through any server; it's the same as you typing and sending that email yourself. One click (Send) still required on your end. |
| Feature | Where | Detail |
|---|---|---|
| Local detection models | Local | The heuristic model and the trained logistic-regression model both run entirely in your browser — your draft is never sent anywhere to be scored this way. |
| ONNX transformer models | Local | Downloaded once from a public model CDN and run in-browser via WebAssembly (a dedicated worker, so the tab stays responsive) — same as the models above, your text stays local, only the one-time model download touches the network. |
| External API providers (GPTZero, Winston AI, Sapling, Originality.ai, Copyleaks) | Third-party | Off by default, and the toggle to enable them stays disabled until you've saved at least one provider key yourself (Settings, AES-256 encrypted). When used, your text and your own key go directly to that provider for a single scan — Lens's server relays the request but never stores the key or the text. |
| Personal model training | Local | Retraining the local model on your own writing reads a local folder you pick (e.g. an Obsidian vault) via the browser's file system access, and trains entirely in-browser — nothing is uploaded. |
| Feature | Where | Detail |
|---|---|---|
| Similarity / plagiarism scoring | Local | Shingle (n-gram) overlap scoring and the semantic-similarity model both run entirely in your browser (the semantic model is downloaded once from a public model CDN, same pattern as Lens's ONNX models below). Your text is never sent anywhere — this app has no backend at all. |
TheVaultMind is not affiliated with, endorsed by, or sponsored by Obsidian.md / Dynalist Inc., Google, Notion Labs, or Microsoft. Their product names and trademarks are referenced on this site only to describe file/export compatibility with those products.
Concrete, checkable claims only — this isn't a marketing list, everything here can be verified by reading the source or the headers yourself.
Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers set on every response (.htaccess) — HTML documents (index.html, app.html) additionally get Cache-Control: no-cache so a stale cached page can never reference scripts that were never actually deployednpm audit reports 0 known vulnerabilities as of the date above (a moderate qs/body-parser advisory found during this check was patched the same day), and all four ship a committed package-lock.json so a redeploy installs the exact versions last checked, not whatever a version-range resolves to that daytrust proxy) — without it, rate limiting keyed every visitor into one shared bucket instead of per-IP, weakening the brute-force/abuse protection those limits exist for!==This is a self-audit, not an independent third-party penetration test — treat it as a starting point, not a certification.
There is no TheVaultMind account server, no analytics beacon, no ad network call, and no proxy sitting between you and your AI provider. TheVaultMind operates a small number of optional, self-hostable relays (RSS/Scrape fetching, Users, Feed Quality) — every one of them is off by default, holds no AI provider keys, and can be pointed at your own instance instead of the default one. PlagiarismCheck has no server at all.
TheVaultMind is an integration layer, not a party to how your AI provider (Anthropic, OpenAI, Gemini, Grok, Mistral, Groq, Together AI, Cohere, Perplexity, DeepSeek, OpenRouter, MiniMax, Zhipu AI, Moonshot, Ollama, or LM Studio — whichever you connect), Obsidian, Google, Notion, or Microsoft handle your data — every call to those services in the table above uses your own API key or OAuth session, made directly from your browser. Using each integration means you've agreed to that provider's own terms, not TheVaultMind's:
Anthropic · OpenAI · Google Gemini · xAI (Grok) · Mistral AI · Groq · Together AI · Cohere · Perplexity · DeepSeek · OpenRouter · MiniMax · Zhipu AI (GLM) · Moonshot · Google Drive · Notion · Microsoft · Obsidian
Ollama and LM Studio run entirely on your own machine — no third-party terms apply since no data leaves your device for that path.
TheVaultMind's own usage policy: Acceptable Use Policy.