Security & Privacy

Privacy is the foundation of MindCradle. Because you trust our application with your daily thoughts and reflections, we design our database and AI architecture around data segregation and cryptographic validation.

Supabase JWT Verification

All requests are validated in the backend using the project's Supabase JWT Secret.
- The token contains your user UUID (`sub` claim).
- Every database query is isolated by your user ID, preventing cross-tenant data leaks.
- We never log raw token payloads.

AI Data Safeguards

When we send context to our language models via the OpenRouter API:
- We do not send your email, real name, or billing details.
- Context is structured as anonymized nodes (e.g. "User experiences work fatigue").
- Data transmitted is subject to zero data retention policies of the endpoint providers, meaning your reflections are never used to train global AI models.

User Control

We support full GDPR compliance:
- Data Export: Export your complete timeline, mood logs, and knowledge graph in JSON format.
- Account Deletion: Delete your account in one click. Doing so triggers a database cascade that completely wipes your user history, credentials, and knowledge graph.