Privacy

Data controller

The data controller for the processing described here is NaughtyDevelopment Ltd · 17 Green Lanes, London, N16 9BS, United Kingdom · company no. 12477931, registered in England and Wales. Send questions and requests to hello@naughtydevelopment.com.

The contact person for the data controller is Salih Devran Tirik (salih@naughtydevelopment.com, salihdevran9@gmail.com).

For data that Mimir processes on your computer and that never reaches us (see “Data that stays on your computer” and “Data about other people” below), you are the data controller; we have no access to it.

What the website collects

When you fill in the trial form, we receive your email address, your store's website address, the platform you chose (Shopify, ikas or another platform) and whether you want product announcements. The form has no other fields.

What you type into the demo and the website's question bar is processed in your browser; it is not sent to us.

The website sets no cookies, writes nothing to your browser's storage and loads no fonts, scripts or images from other servers. It has no analytics, no ad trackers and no visitor tracking.

Railway, which hosts the website, keeps a short-lived technical log of incoming requests (IP address, browser details, requested address, time), as every web server does, for security and operations. We do not use these logs for marketing or profiling.

Product announcements

The form's box “Send me product announcements and release notes by email.” is unticked by default and optional. If you leave it unticked, we only send you emails about your trial request and your account.

If you tick it, we send you product announcements and release notes by email. We keep a record of your consent together with the sentence you ticked and the date; as required by Turkish Law No. 6563 on the Regulation of Electronic Commerce, the consent is also registered with the Message Management System (İYS).

You can withdraw your consent at any time: use the unsubscribe link in any announcement, opt out through İYS, or write to hello@naughtydevelopment.com. Once you withdraw it, we stop sending announcements; essential emails about your trial and account continue.

Your Mimir account

You open a Mimir account with an email address and a password. We send you one-time codes to verify your email address and to reset your password. The authentication service stores your password as a hash, never in plain text.

For your account our servers hold: your email address, when the account was first and last seen, your plan and its expiry date, and session records. The authentication service keeps a security log of sign-in events, which may include your IP address.

Every six hours the app sends a short record for each device linked to your account: a random device ID, your computer's name, operating system, app version, and whether you are signed in to Claude and Gemini and, if so, on which plan. A computer's name often contains its owner's name; you can change it in your operating system's settings. We use this record to enforce the limit of 20 devices per account, to list your devices on the account screen and to provide support. It contains no email address, no password and no Claude or Gemini session keys.

The app checks your plan with the server once an hour and keeps the result on your computer for seven days of offline use. Your account session (your user ID, email address and session keys) is stored on your computer in a file only your user account can read.

Payment

You pay for the subscription through Stripe. You enter your card details on Stripe's own payment page; they never reach us.

We pass your email address and account ID to Stripe. From Stripe we keep the customer and subscription IDs, the subscription status and the end date of the current period.

The site crawl on our servers

The site crawl runs on our servers so that it can run every day, even when your computer is off. It reads only the public pages of the site you added; at most 5,000 pages per run.

For each page we keep: the address, status code, title, meta description, canonical address, robots directives, H1 heading, Open Graph and structured data types, a fingerprint used to tell whether the page text changed (not the text itself) and speed measurements (Core Web Vitals). For the speed measurement, the addresses of at most five pages per crawl are sent to Google PageSpeed Insights.

This data is kept in a separate file for each account. The last 30 crawls per site are kept; only the last three hold page details and findings. Per page, the last three snapshots and at most 365 speed measurements are kept. The old and new values of page changes (at most 300 characters) are kept for the last 5,000 changes per site; critical and high-severity changes you have not seen yet stay for up to 90 days even beyond that limit. Older data is deleted automatically.

If personal data (for example an employee's name) appears on your site's public pages, it may also appear in the crawled titles and descriptions.

Data that stays on your computer

The rest of Mimir's work runs on your computer, and its results stay there; they do not reach us. This covers: your product files and catalog; the copy, drafts and translations Mimir writes; the backups taken before a push to Shopify; AI visibility measurements; web, market, lead and ad research; “Sor” (Ask) conversations and the files you attach; documents you open in PDF Studio; coding jobs; voice reminders, lists and notes; project memory and the knowledge graph.

For projects you register with Mimir, the transcripts of your Claude Code sessions (your prompts, the model's replies, the commands that ran) are archived in the database on your computer for project memory.

This data lives in ~/Library/Application Support/mimir on macOS and in %APPDATA%\mimir on Windows. Mimir does not encrypt this database itself; we recommend keeping disk encryption on (FileVault on macOS, BitLocker or Device Encryption on Windows).

The app's logs (~/Library/Logs/Mimir on macOS) may contain the paths of the projects you work on and web addresses; they contain no voice transcripts and no session keys. Each log file rolls over at 5 MB, and only the previous one is kept.

Store connection details (the Shopify Client ID and Client secret) and other access keys are kept in your computer's credential store (Keychain on macOS, Credential Manager on Windows). If the credential store cannot be reached, they are written to a file only your user account can read.

You can delete conversations, coding jobs, project memory, catalog imports and the people attached to leads from within the app. Shopify backups, lead lists and social media research have no delete option in the app yet. To remove everything, first disconnect the Claude account in “Ayarlar” (Settings), then quit the app and delete the folder above, the log folder, the folders under ~/.claude/projects whose names contain “Application-Support-mimir”, and the “studio.mimir” entries in your credential store.

The dynamic island and Munin

The island at the top of your screen shows what your Claude Code sessions (and Codex and Gemini, if you connected them) are doing. To do that it reads the session events in your terminals (the tool running, a question asked, a permission request, the files changed) and the list of claude processes running on your computer. These events are held in memory only and are not saved; they leave your computer only for the phone you paired. The phone receives the session events (tool running, question, permission request); it receives counts of changes, not the changed lines of your files.

When you drop Munin onto a window or select an area of the screen, the island takes that app's name, the window title, the page address if it is a browser, and a screenshot of the window or the area you selected. These go to your AI provider only when you send them to “Sor” (Ask) (see “AI providers” below). Files you drop on the island may be up to 10 MB and are copied to the attachments folder; attachments that nothing uses are deleted at the app's next launch once 24 hours have passed.

The music indicator reads the track playing in Spotify or Apple Music; the album artwork is downloaded from Spotify's servers. The system indicators (processor, temperature, memory, battery and the names of the busiest processes) and how long you have been away from your computer are read on your computer only and sent nowhere. While an approval card is open, a few keys are listened to briefly so that you can answer the card with a single key. The Touch Bar shows what the island shows.

The island asks for screen recording permission for window screenshots, automation permission for the browser address, the terminal tab and music control, and notification permission for alerts. If you refuse a permission, only that feature stops working.

Voice: “Hey Mimir”, conversation and dictation

The microphone is on only while Mimir is listening to you: while you hold the key, in conversation mode, or while waiting for the wake word if “Hey Mimir” is on. “Hey Mimir” is off by default; conversation mode asks for your consent separately.

Your speech is turned into text on your computer, with the Whisper model. No recording is kept and the audio never leaves your computer; the short clips taken while waiting for the wake word are processed once and discarded.

Where the transcribed text goes depends on what you are doing. Dictated text is typed only into the app where your cursor is. A request you say to Mimir, or a sentence in conversation mode, is handled like a “Sor” (Ask) message you typed: it is saved and sent to your AI provider. Reminders, lists and notes you create by voice are kept on your computer word for word; reminders that have gone off are deleted when you set a new reminder once seven days have passed.

For the hold-to-talk shortcut, only the state of the right ⌘ and right ⌥ keys and whether a key was pressed are read from the keyboard; which key you pressed is never read. On Windows the same job is done with the right Ctrl key; this listening is on by default and can be turned off in the settings. To paste dictated text, dictation keeps your clipboard's contents for a moment and puts them back after pasting; it does not dictate into password fields.

Voice asks for microphone and input monitoring permission; dictation also asks for accessibility permission.

The phone app

The iPhone app connects to Mimir on your Mac over the same local network. Pairing uses the QR code shown on the Mac; the connection is encrypted and pinned to your Mac's certificate. Traffic between the phone and the Mac does not pass through our servers.

You sign in on the phone with your Mimir account; your email address and password go to the authentication service through your Mac. The session key is kept in the phone's Keychain for that device only and does not move to other devices with backups. Face ID for approvals is checked on the phone itself; your face data never reaches us or the Mac.

The phone can see your sessions, pending approvals, conversations, the catalog, visibility measurements, the site crawl, and lead, ad and social media research, and it can send messages or files to “Sor” (Ask); it cannot see PDFs, the knowledge graph or store keys. The phone app uses local notifications only and does not register with Apple's remote notification service. It does not access the camera, microphone, location, contacts or photos.

The Chrome extension

Mimir's Chrome extension shows the island in your browser too. To show the island on every page it asks for access to all sites, but it does not read page content. Only when you choose “Sekmeyi ekle” (Add tab) does it take that tab's screenshot, title, address and up to 2,000 characters of the text you selected, and pass them to Mimir on your computer.

In the browser's extension storage, the extension keeps whether the island is on or off, which view the side panel opens and the island's display settings (theme, sound, shortcuts); none of this is personal data. It talks to Mimir on your computer through Chrome's native messaging channel and never sees session keys.

AI providers

Mimir has no AI account of its own. Work that needs a model is done with your own accounts, through tools running on your computer: your Anthropic account with Claude Code, your Google account with Gemini and Antigravity if you choose them, or a local model running on your computer (Ollama). The content of these requests does not reach us.

What goes to your provider: the messages you type or say in “Sor” (Ask), the files and window screenshots you attach; catalog content for copy and drafts; page text collected for research; your project's files in coding jobs; the text of PDF documents you want summarized or translated; summaries drawn from your Claude Code sessions for project memory; and the questions you track for visibility measurement. In visibility measurement these questions are asked to Claude with web search and to Gemini with Google Search.

With the default settings, short summarization jobs run on the local model on your computer; if the local model is not running, they go to Claude. How your provider processes this data, how long it keeps it and whether it is used to train models depends on the terms between you and your provider.

Mimir reads the email address and plan of your Claude and Gemini accounts to show them in the app; your session keys stay where the provider's own tool keeps them.

The knowledge graph and project memory

By default the knowledge graph scans the files in your ~/development and ~/Documents folders and writes a short assessment of each file; it does not store the file's content. You can change the folders it scans on the “Hafıza” (Memory) screen's “Yapılandırma” (Configuration) tab, under “Tarama izinleri” (Scan permissions), or turn the scan off. Files that carry secrets, such as .env files, key and certificate files, and the .ssh and .aws folders, are never read.

File contents go to the summarization model for assessment: with the default settings the local model on your computer, or Claude if that is not running.

Store connections

When you connect Shopify, Mimir reads your store's name, currency, domain, languages and product catalog (title, description, SEO fields, tags, variants, publication status), and sends the copy you approve to your store as drafts. The only permissions it asks for are writing products, writing translations and reading languages: it has no access to your customers, orders or payments.

This connection goes straight from Mimir on your computer to Shopify; store data and the backups taken before a push stay on your computer. ikas is connected through files only.

Requests made during research

When it researches, Mimir sends requests from your computer directly to these services: DuckDuckGo for web search; Google Maps and LinkedIn for lead research; the Meta, TikTok, Pinterest, Microsoft and Google ad libraries, YouTube, Instagram and web.archive.org for ad and social media research. The pages you want read are opened by a browser running on your computer.

These requests carry the words you search for, business names, domains and usernames to those services, which process them under their own terms. The requests do not pass through our servers.

Data about other people

Lead, ad and social media research collects information from public sources: businesses' names, addresses and phone numbers; decision makers' names, titles and public LinkedIn addresses; email addresses published on company websites; usernames, names and follower counts of advertisers and creators. If you connect LinkedIn, your session lives only in a separate Chrome profile on your computer; Mimir does not read your cookies.

This data is stored only on your computer and does not reach us. For these people you are the data controller: it is up to you to decide the purpose and legal basis for processing it, to inform the people concerned where required, and to obtain any permission needed before sending them marketing messages. Mimir does not send the email drafts it prepares.

Who we share data with

We do not sell or rent data, and we do not share it with anyone for advertising or data enrichment. We use these providers to run the service; each receives data only for the job listed:

Railway (outside Türkiye): hosting the website and its request logs; account and device records, plan and subscription details, the authentication service and site crawl data.

Resend (USA): forwarding trial requests to us, account verification and password reset codes, product announcements.

Stripe (USA and Ireland): payment and subscription.

Cloudflare (USA): domain, encrypted connections and protection against attacks; your IP address is visible as requests pass through its network.

Google (USA): page addresses for the speed measurement in the site crawl.

The email provider hosting the hello@naughtydevelopment.com mailbox: trial requests, correspondence and applications.

Beyond these, we share data only when the law requires it, on a lawful request from an authorised public authority.

Transfers abroad

Because the servers of the providers above are located outside Türkiye, your data is transferred abroad. We make these transfers in line with Article 9 of Law No. 6698, relying on the standard contracts published by the Personal Data Protection Board.

Retention

Trial request: deleted once the correspondence has ended and no reason to keep it remains, at the latest within one year.

Product announcement consent: kept while the consent lasts; after it is withdrawn, kept as evidence for the period the law requires (three years).

Account, device and site crawl data: kept while your account is open; deleted within 30 days after you close your account. The site crawl limits described above also apply.

Payment and invoice records: for the period tax and commercial law requires (up to ten years).

Sign-in security logs and server logs: at most 90 days.

Data on your computer: until you delete it.

Closing your account and deletion

Signing out in the app only deletes the session files on your computer; it does not close your account on the server. To have your account and all your data on the server deleted, write to hello@naughtydevelopment.com from your account's email address. We end your subscription, delete your account, device records and site crawl data within 30 days at the latest, and ask Stripe to delete your customer record. Invoice records we are legally required to keep remain until their period ends.

If you want a copy of your data on the server, write to the same address; we send it in a machine-readable format.

Security

All connections with the website, our servers and between the phone and the Mac are encrypted. Mimir on your computer answers only requests from your own computer and checks each one with a secret key generated anew at every launch; if you turned on the phone connection, requests from your phone on the same network are accepted after they are verified with your Mimir account, and only for permitted actions. On the server, each account's site crawl data is kept in a separate file, and the app reaches it only with that account's session key. Your account, plan, subscription and device records can be seen, for support and billing, only by authorised team members, through an admin panel verified by email and with an admin key issued for automation. Payment notifications are not processed until their signature is verified.

The app has no analytics, no crash reporting and no automatic updates. No system is flawless; if you find a security vulnerability, report it to us as described on the responsible disclosure page. If a breach affects your personal data, we notify the Personal Data Protection Board and you as the law requires.

Your rights

Your rights under Article 11 of KVKK (to learn whether your data is processed, to have it corrected or erased, to object, to compensation and others) and how to apply are set out in the KVKK notice.

If you are in the European Economic Area, you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection under the General Data Protection Regulation (GDPR), and you may complain to the data protection authority of your country.

Send your requests to hello@naughtydevelopment.com; we reply within thirty days at the latest.

Age limit

Mimir is a product for businesses; it is not directed at people under 18, and we do not knowingly process the data of anyone under 18.

If this notice changes

When a feature that processes data is added, or a feature starts processing data differently, we update this notice and its date. For a significant change we notify you at your account's email address.

Language

This is an English translation of the Turkish text. If the two differ, the Turkish text prevails.