MossyMind stores a working copy on your device so the daily desk can keep working offline. Readable task names and notes, category names, habit names, goal content, journal text, quotes, and profile content are encrypted in the client before synchronization. The server receives ciphertext plus the operational metadata needed to sync records.
What stays on your device
The web app uses IndexedDB for the encrypted local store, queued changes, recovery state, and device-bound key material. A service worker caches the application shell and public reading pages for resilient loading. Signing out or clearing browser storage can remove local access, so account recovery and data export still matter.
What synchronization stores
Encrypted content synchronizes through the authenticated API. The service also stores record type, record identity, version, dates, completion state, priority, urgency, and other operational fields needed to merge devices and render the daily desk. Encryption protects content fields; it does not make all metadata invisible.
The recovery boundary
MossyMind maintains a restricted server-side escrow copy of the account content key to support seamless access on a newly authenticated device. Normal browser clients cannot query another account’s escrow or records, and private tables are not exposed to anonymous clients. However, this architecture is not zero-knowledge: an operator with sufficient privileged database access could obtain the escrow key and encrypted records.
Behavioral analytics
Content-free behavioral analytics are enabled by default and can be turned off in Settings. Events can include actions such as session start, task creation or completion, habit completion, goal activity, journal saves, focus activity, billing, checkout, and support submission, along with platform and app version. The ingestion layer rejects content-like properties such as titles, messages, ciphertext, keys, and diagnostics before forwarding approved events.
Recovery, export, and deletion
Recovery codes and registered devices protect access if a device is lost. Settings let you download your data, revoke other devices, and schedule account deletion. Deletion has a seven-day cancellation window before the account’s application records are permanently purged. Contact Support before deleting your account if you need details about backup retention.
What privacy does not mean
MossyMind does not claim that servers learn nothing, that encrypted metadata is impossible to correlate, or that a compromised signed-in device is safe. Do not put information in any digital tool if disclosure would create unacceptable harm. Report privacy questions or suspected defects through Support in the app.