MumpadTRDownload
Privacy

Privacy policy

Last updated: November 12, 2026

Mumpad is an end-to-end encrypted notes and password app built by SyconX LLC. This page explains what data we process and why. In short: we cannot see your content, we do not sell it, and we run no ads or tracking.

Data we cannot see

The titles, content, tags, usernames and URLs of your notes and passwords are encrypted on your device. Only the encrypted versions reach our server; the key needed to decrypt them is derived from your master password and is never sent to us. If you forget your master password, we cannot recover this data. AI features you use with your own key do not pass through our server either (below).

AI features

AI features are off by default and run with your own Anthropic API key, which you enter in the app's settings. The key stays in that device's secure store. If you choose in settings to use it on your other devices too, it is encrypted on your device and synced with your account in encrypted form; we cannot decrypt it. Otherwise it is not synced. When you press correct on a note, approve reading a scanned PDF on desktop or Android, or approve turning a voice note into a note, that note's text, those pages' images or the text recognized on your device go straight from your device to Anthropic. They do not pass through our servers and we cannot see them. The audio itself is never sent anywhere. This is subject to the terms of your Anthropic account and is charged to it. You are asked before every send. Your passwords are never sent; if a note or document holds anything secret, don't use these features. On iOS and macOS scanned PDFs are read on the device and are not sent anywhere.

Data we store

  • Your email address: to identify your account and contact you if needed.
  • A hash of your sign-in key: not your master password, but a one-way (scrypt) hash of a key derived from it.
  • Your encrypted data key and encrypted items: for sync.
  • Your encrypted attachments: files you add to your notes. Their names, types and contents are encrypted; we can only see their encrypted size and upload time, not which note they belong to.
  • Technical details: each item's ID, type (note or password), version number and deletion state; hashes and expiry times of your session tokens.

Data we process temporarily

To limit failed sign-in attempts, your IP address is kept together with your email address for at most 15 minutes, only in server memory, and is never written to disk. The verification code we send when you create an account stays in memory with your address the same way, for at most 15 minutes; if you do not finish, your address is not stored anywhere.

Since November 5, 2026 our web server keeps no access logs (including IP addresses) for requests to this site. Logs from before that date are kept for 30 days and then deleted.

What we do not use

We use no advertising, analytics, tracking cookies or third-party trackers. The fonts on this website are served from our own server too.

Data on your device

App data is also stored encrypted on your device. Your fingerprint, Face ID or PIN never leave your device; your operating system performs the biometric check and we only see the result (success or not).

Browser extension

The Mumpad browser extension (Chrome, Edge, Firefox, and the Safari extension that comes with the Mac app) works with your Mumpad account. Your master password is turned into a key inside the extension; only your email address and a sign-in key derived from it reach our server. We cannot see your master password. The extension downloads only your password entries; they stay encrypted on your device, and the unlocked key is cleared from memory when the vault locks or the browser closes.

The extension sees a page only when you click its icon, and only in that tab; it has no script running all the time and no access to every site. It fills only when you pick an entry. When you press "Save the login on this page", it reads the address, username and password in the form, and saves them to your account, encrypted on your device, only if you confirm. The extension does not collect your browsing history, page content or usage data; there are no analytics or ads.

Note sharing

You can share a note with another Mumpad user. A shared note is end-to-end encrypted too: we cannot see its title or content. For this, your account gets a key pair; its public key is on our server, and its private key is stored only encrypted with your data key.

  • What we see: who shares which note with whom (the accounts' email addresses and ids), each person's permission (read or edit), whether an invitation was accepted, and the share's version numbers.
  • Looking someone up: when you share, we tell you whether the email you typed belongs to a Mumpad account; to prevent abuse we allow at most 30 lookups an hour.
  • Safety code: two people who want to be sure that not even the server can read their share can compare the short code in the app through another channel. Whether you compared it stays on your device.
  • Someone removed from a share can still see what had already reached their device, but not later changes. When you end a share or delete your account, its records are deleted from the server.

Camera and photos

We use the camera and your photo library only when you add an image to a note or scan a QR code for a verification code. Images are re-encoded on your device: location and other EXIF data are removed and the original file is never sent. Images are encrypted before they leave your device. When scanning a QR code the picture is not saved and does not leave your device.

Microphone

We use the microphone only while you record a voice note. The recording is encrypted before it leaves your device and only its encrypted form reaches our server; we can't listen to it.

Service providers

Our servers run on OVHcloud; domains and DNS are provided by Amazon Web Services, and your encrypted attachments are stored on Amazon S3 (Frankfurt). Emails about your account may be sent through Amazon SES. These providers only ever see encrypted content as well. When you use AI features with your own key, what you send goes straight to Anthropic; that provider works under your account, not on our behalf.

Backups

We back up the encrypted server database every night. Backups are encrypted again, the key to decrypt them is not kept on the server, and they are deleted after 30 days. Attachments are not part of these backups; they are stored on Amazon S3.

Deleting your data

You can delete your account and all of your encrypted data on our server from within the app, or ask us to do it by writing to destek@mumpad.app from your account's email address. Deleted data also drops out of backups within 30 days. See the terms of use for details.

Contact

Questions: destek@mumpad.app