Last updated: August 1, 2026
This Privacy Policy explains how Research Maestro Limited Liability Company (doing business as Blue Compass Software, LLC) ("we," "us," or "our") collects, uses, and protects your information when you use MindBucket at mindbucket.net (the "Service"). By using the Service, you agree to the practices described here.
The Service is operated by Research Maestro Limited Liability Company, based in New Jersey, United States. For any privacy-related questions or requests, contact us at sbersey@bluecompasssoftware.com.
We collect only what we need to provide the Service:
| Category | Examples |
|---|---|
| Account information | Your email address and authentication credentials. |
| Content you create | The mind maps, nodes, labels, notes, checklists, uploaded files, and transcribed audio you create and store in the Service. |
| Subscription information | Your plan status and billing records. Payment card details are handled by our payment processor (Stripe) and are not stored by us. |
| Technical information | Basic information necessary to operate the Service, such as session data. We do not run third-party advertising trackers. |
Legal bases (EEA/UK users). Where the GDPR applies, we rely on the following legal bases: performance of a contract with you (to create your account, store and display your Content, and provide and bill for the Service); our legitimate interests in keeping the Service secure, reliable, and functioning properly; compliance with legal obligations (such as tax and accounting requirements); and, where applicable, your consent (which you may withdraw at any time). We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
We do not sell, rent, trade, or share your personal information or your Content — including for cross-context behavioral advertising (as those terms are used under U.S. state privacy laws such as the CCPA/CPRA). We do not use your Content for advertising.
We use a small number of trusted third-party providers to operate the Service. They process data only on our behalf and only as needed:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, and file storage hosting for your account and Content. |
| Stripe | Payment processing and Merchant of Record for subscriptions. Stripe collects and processes payment information directly under its own privacy policy. |
| Resend | Delivery of transactional emails such as confirmations, password resets, and billing notices. |
| Netlify | Hosting and delivery of the website and application. |
Each provider maintains its own privacy and security practices. We may also disclose information if required by law or to protect our legal rights.
Your data is stored on infrastructure provided by our hosting partners. Our primary database, authentication, and file storage are hosted by Supabase on Amazon Web Services in the United States (US East / Ohio region, us-east-2). Access controls are in place so that your Content is accessible only to your account. We use industry-standard measures to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. We encourage you to keep backups of important Content.
Private Vault (attachment encryption). MindBucket offers a Private Vault that encrypts your attachment file contents on your device before upload, using an encryption password and one-time recovery key that only you hold. We never receive or store your encryption password or recovery key and cannot access the contents of your encrypted attachments. Because this encryption happens on your device, if you lose both your encryption password and your recovery key, your encrypted attachments cannot be recovered by anyone, including us. Only attachment file contents are encrypted — file names, map names, and node labels are not — so please avoid placing sensitive information in names or labels. Full terms, including limitations of our responsibility for data loss, are in our Terms of Service.
We retain your account information and Content for as long as your account is active. If you delete your account, we permanently delete your Diagrams, attachments, and account data from our active systems. Certain records (such as billing records held by Stripe) may be retained as required for legal, tax, or accounting purposes.
Depending on your location, you may have rights regarding your personal information, including the right to access, correct, or delete it, and to object to or restrict certain processing. You can:
We honor applicable rights under laws such as the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act, as amended by the CPRA (CCPA). We will not discriminate against you for exercising these rights.
Sensitive information. We do not request or intentionally collect special-category or “sensitive” personal information (such as health, precise geolocation, or government identifiers). Please do not store such information in your Content. Where U.S. state law provides a right to limit the use of sensitive personal information, we honor it, though we do not use your information for the purposes that trigger that right.
How we handle requests. To protect your data, we may take reasonable steps to verify your identity before acting on a request — typically by confirming control of the email address on your account. You may use an authorized agent to submit a request on your behalf where the law permits, subject to verification. We aim to respond within the timeframes required by applicable law (generally within 30 days under the GDPR and 45 days under the CCPA, with extensions where permitted).
Complaints. If you are in the EEA or UK, you have the right to lodge a complaint with your local data protection supervisory authority. We would appreciate the chance to address your concern first, so we encourage you to contact us.
The Service uses essential cookies and browser storage solely to keep you logged in and to operate core functionality. We do not use advertising or cross-site tracking cookies.
The Service is intended for users who are at least 18 years old, or who use it with the consent and involvement of a parent or guardian. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.
We are based in the United States, and your information may be processed in the United States and other countries where our service providers operate. By using the Service, you understand that your information may be transferred to and processed in countries with different data protection laws than your own. Where personal data is transferred out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses and equivalent UK and Swiss mechanisms — together with the data protection commitments of our service providers (including Supabase and Stripe).
We may update this Privacy Policy from time to time. We will revise the "Last updated" date when we do, and material changes may be communicated to you. Your continued use of the Service constitutes acceptance of the updated policy.
For privacy questions or requests, contact us at sbersey@bluecompasssoftware.com.