Minty Path

Privacy Policy

How Minty Path handles your data.

This policy explains what is collected, why it is used, and the choices available to you.

Effective: July 31, 2026Last updated: October 16, 2026Operator: Marko VasicJurisdiction: Serbia

1. Controller and contact

Minty Path is operated by Marko Vasic in Serbia. Privacy, account, export, deletion, or security questions can be sent to contact@vasicmarko.com.

2. Data collected

Minty Path collects account data such as name, email address, password hash, role, verification state, session/security information, timestamps, login activity, password reset tokens, and email verification tokens.

An account record also stores how the account was acquired: up to three short campaign labels and the host name of a referring website, copied once at signup from the mp_src cookie described in section 9. These four values are written a single time and never updated, are not linked to Guest Mode usage, and exist only so that signups can be attributed to a channel.

Minty Path stores the content you create in the app, including Growth Paths, branches, descriptions, status, Focus, Aim dates, Deadlines, Evidence entries, branch file attachments, relationships, Inbox items, reminders, recurring reminder settings, Todos, notes, imports, exports, and backups needed to operate or recover the service.

When you configure inbound email capture, calendar feeds, or browser-extension access, Minty Path stores the settings and protected token records needed to provide and revoke those connections. When you share a Growth Path, it stores the access mode, protected share credentials, invitations, included-content choices, reviewer threads, comments, and notification records.

When you submit a Growth Path to the Public Library, Minty Path stores a reviewed snapshot, its title and description, the creator name you provide, categories, revision feedback, and limited usage events: views, “Use this Path” clicks, and copies into an account. Administrators see these as counts per Path.

Technical data may include IP address, browser/device information, request timestamps, security logs, rate-limit records, and error logs generated by the server.

When you use Path Assistant, Minty Path stores your AI provider connections (provider, label, model, and the encrypted credential), your conversations and their messages, proposed changes with their review status, source-backed Research runs with their sources and findings, request records (provider, model, time, token counts, and a broad error category), and temporary section snapshots while a large-Path review runs. Messages, proposals, Research records, and snapshots can contain copies of the Growth Path text they discuss.

When you send a message through the contact form or Send feedback in Profile, it is emailed to the operator together with your name and email address, the topic or subject, and your IP address. Feedback from Profile also includes your browser details and an account reference. These messages are not stored in the Minty Path database.

Optional public-site analytics or marketing tags load only after you allow them in the privacy choice shown on the website. Those providers may then receive public-page usage, device, browser, referral, and campaign information.

Minty Path does not place those tags inside the authenticated app, Admin, or private Growth Paths.

Guest preview measurement

Guest Mode records a small first-party usage funnel so the preview can be improved: whether an anonymous browser opened the workspace, started fresh, added branches, returned on another day, or kept the preview after creating an account. The server receives a random browser identifier and stores only its one-way hash in daily counters for no more than 90 days. These records contain no Guest Path titles or text, IP addresses, user-agent strings, or account link.

This built-in measurement does not load third-party analytics. If optional public tracking is disabled, Minty Path does not show an analytics banner because no optional tracking code is loaded.

Checking this browser…

3. Why data is used

Data is used to provide the service, authenticate users, secure accounts, prevent abuse, save organizer content, display linked Growth Path information, deliver authorized email captures and calendar feeds, enforce sharing and review choices, operate the Public Library, support imports/exports and extension capture, create recovery backups, troubleshoot problems, respond to user requests, and maintain the app.

Minty Path does not sell user data to advertisers.

4. Legal bases

Depending on context, processing may be based on providing the service requested by the user, legitimate interests in operating and securing Minty Path, legal obligations, or user consent where consent is specifically requested.

5. Sharing and providers

Data may be processed by hosting, email, domain, backup, security, analytics, or infrastructure providers as needed to run Minty Path. Public-site measurement providers may be configured through Google Tag Manager or the controlled custom tracking settings and load only as described in section 2.

AI is optional. When you connect an AI provider, Assistant requests use the API account you selected and may incur that provider’s charges. Every Assistant request includes your display name, time zone, and safe workspace preferences. A general conversation also receives a compact index of your ordinary Growth Paths (titles, state, and branch counts). When a Growth Path is connected, its branches, relationships, Notes, Todos, Evidence, dates, and Reminders may be sent as working context. Exact Inbox content is sent only when you intentionally open or request an Inbox task. To suggest where Inbox items belong, Minty also sends the titles, descriptions, Notes, and open Todos of the branches it may file them under: the connected Growth Path, or all of your active Growth Paths when you choose that. Source-backed Research contacts external search and AI services only after you request and confirm it.

Provider credentials, passwords, encrypted Private Details, attachment file contents, recovery material, hidden system data, and other users’ data are excluded from normal Assistant context. Stored content is treated as reference data rather than trusted instructions. AI suggestions do not silently change a Growth Path: proposed mutations remain subject to ownership checks, review, validation, stale-state checks, and recovery safeguards before application.

External links, Trello files, Evidence links, and resources may involve third-party services outside Minty Path. Those services are governed by their own privacy practices.

6. Retention

Account and organizer content is kept while the account remains active. Permanent account deletion removes the live account, its owned workspace, provider credentials, attachments, shares, and account-level recovery backups. Immediately before deletion, Minty Path saves one protected recovery copy of the deleted account’s Growth Paths and companion content (Notes, Todos, Evidence entries, Reminders, Inbox items, sharing settings including the email addresses you invited, attachment names and sizes, and still-encrypted Private Details) so a mistaken deletion can be recovered. That copy excludes attachment files, AI connections, and sign-in details, is available only to administrators, and is removed automatically after seven days. Other records are kept only for a limited time. Rate-limit records are deleted about a day after they expire. Used or expired verification and reset links, inbound-email delivery records, branch change history, review notifications, revoked browser-extension keys, and administrator audit records are deleted after 90 days. Captured email text is kept only in its Inbox item, and its delivery record is deleted when you delete that item. Error records are deleted after 30 days, Guest preview counts after 90 days, and Public Path usage counts after 400 days. Sharing and review records are kept while the account is active. Path Assistant conversations are kept until you delete them or the account; proposals, request records, and Research records are kept while the account is active. Snapshots from a full large-Path review are deleted 30 days after the review completes, or 7 days after it fails or is cancelled. Contact and feedback emails stay in the operator's mailbox only as long as needed to answer and follow up.

Guest Mode content remains in that browser rather than the Minty Path account database. Clearing browser storage or starting fresh removes that local copy.

Administrator full-system or host-level backups created before deletion may retain an earlier database copy until that protected backup rotates out under the service's backup policy. They are isolated recovery snapshots rather than active account records.

7. Security and backups

Minty Path uses password hashing, session controls, CSRF protection, ownership checks, rate limiting, protected backup folders, and other reasonable safeguards. No system can be guaranteed perfectly secure.

Branch Private Details are encrypted and decrypted in the browser using the passphrase you provide. Minty Path cannot recover that passphrase or decrypt those entries for you. Normal Notes, Todos, Evidence, Inbox items, and other ordinary organizer fields are not the same as Private Details.

Administrative full-system backups may include database rows such as account hashes, tokens, encrypted content, and user-created content. These backups are intended for recovery and must be kept private.

Users should export and keep independent copies of especially important information, Evidence, or linked files.

9. Cookies and local storage

Minty Path uses essential session cookies for authentication, security, CSRF protection, and administrator separation. These essential cookies are not used for advertising.

If you arrive from a campaign link or another website, a first-party cookie named mp_src records which campaign or referring site brought you, so that a later signup can be attributed to a channel. It stores up to three short campaign labels and the referring website's host name only — never the full referring address, which can contain search terms and page paths. It is written once on your first visit and is not updated afterwards, expires after 30 days, and is not used for advertising or profiling. If you create an account, those same values are copied once onto the account record and never changed again; if you do not, the cookie simply expires.

These two Minty Path cookies are part of how the site itself runs. They are set for every visitor, whichever privacy choice is made, are never shared with analytics or marketing providers, and are kept only on Minty Path.

The public homepage may run a design test. When it does, a first-party cookie named mp_home_variant records which homepage design you were shown so that the page does not change on you between visits. It stores a layout name and nothing else, expires after 30 days, is never used for advertising or profiling, and is not read anywhere inside the signed-in app. The accompanying measurement is a daily count per design and copy setting, held on the Minty Path server: how many times a design was shown and how many times a button on it was used. The content setting can switch between shared core wording and design-specific wording. No identifier, session, address, or device information is recorded alongside those counts, so they cannot be traced back to a person or joined to an account.

Public Path view and use counts do not set an analytics cookie. To avoid counting repeated requests as separate events, the server temporarily combines the Path, event type, date, IP address, and browser user-agent with an installation-only secret. Only the resulting one-way, per-Path daily hash is stored with the event; the raw address and browser value are not placed in the event row, the hash changes each day, cannot be compared across different Paths or event types, and is not joined to an account or used for advertising or profiling. Public Path event rows are retained for up to 400 days.

The privacy choice on public pages offers Accept only needed, which keeps only Minty Path's own cookies described above, and Accept all, which also loads the approved analytics and marketing providers; those providers may then set their own cookies or similar identifiers on public pages. The website stores your choice in local storage, and you can change it any time from Privacy choices in the public footer.

Local storage is also used for Guest Mode Growth Path content, theme preference, dismissed onboarding or tour state, default view, list page size, reminder defaults, reduced motion, and other device-specific interface preferences. Clearing browser data removes the local guest workspace and resets those preferences.

10. International transfers

Hosting, email, or infrastructure providers may process data outside Serbia. Where applicable, reasonable steps will be taken to use providers and safeguards consistent with legal requirements for international data transfers.

11. Children

Minty Path is not directed to young children. A person who is not legally able to agree to these terms in their jurisdiction should use the service only with appropriate parent or guardian involvement.

12. Changes to this policy

This policy may change as Minty Path develops, moves to a new domain, adds providers, or introduces new functionality. Material changes will be reflected by updating the effective date and, where appropriate, providing additional notice.

Questions can be sent to contact@vasicmarko.com.