Privacy Policy

Last updated: October 15, 2026

This Privacy Policy explains what personal data METHMINE LLC (Methmine, we, us) collects through the methmine.com website, the beta application form, the Methmine account service, and Methmine Browser (the Methmine application and the Methium engine), what we do with it, who else receives it, how long we keep it, and the rights you have. Methmine VPN and other products have their own privacy policies on their own websites; where one of them applies, it governs that product.

We are the controller of the personal data described here. Contact: contact@methmine.com, with the subject "Privacy request", or METHMINE LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA.

1. The short version

Your profiles live on your computer, encrypted. We do not see them unless you put a profile in our cloud or share it with a team.
If you use the cloud or a team, we can technically read those copies. The keys are generated and held by us under a cloud key-management service, so that you can sign in on another computer and find your profiles without a separate password. A cloud or team copy contains the profile's live session cookies, saved passwords and form data, proxy logins, and its device identity. We describe below when we would ever open one.
We do not use analytics, advertising or tracking on the website or in the application, and we do not sell or share your personal data for advertising.
The application does not send telemetry or crash reports to us.

2. What we collect, and why

2.1. The website

Server logs. When you visit methmine.com, our server and our network provider record the request: your IP address, the page, the time, your browser's user-agent string and the referring page. We use these to run, secure and debug the site.
Browser storage. The site stores two items in your browser's local storage: the language you chose and your answer to the cookie notice. We set no cookies of our own. Our network provider may set a strictly necessary security cookie to protect the site from automated abuse.
No analytics, no advertising, no third-party scripts or fonts.

2.2. The beta application form

When you apply, we receive the contact you give (a Telegram handle or an email address), the name of the member who invited you if you give one, what you write about your work, the language of the page and the time. The request itself is logged as in 2.1. We use this to decide on your application and to reply to you. We may show your application to existing members of the programme before deciding, as described on the beta page; we do not show them your contact.

2.3. Your Methmine account

Sign-in data: your email address and an Argon2id hash of your password (never the password itself).
Sessions: a hash of each session token, its creation and expiry times, a random identifier of the computer it belongs to, and the user-agent string the application sends.
Computers: for each computer signed in to the cloud, a random identifier, the label you give it, when it was added, last seen and removed.
Your name and picture, if you set them. They are encrypted at rest under a key held in our key-management service, which our service can use to read them.
Recovery keys. So that a forgotten password does not cost you your profiles, a recovery key for each of your computers is stored with us, wrapped under a key held in our key-management service, together with the state of any recovery request (including a 24-hour waiting period that protects you, and the coarse network address the request came from).
Security logs: when a sign-in is refused, we log the email address entered, the full IP address and the reason. For other security events we log your account identifier and a coarse network address (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address). Rate limits are counted in memory by IP address and by network.
Acceptance of terms: which version of our terms you accepted, and when, so that we can show what you agreed to.

We use account data to provide the account, keep it secure, prevent abuse, recover access, and send you the messages in 2.6.

2.4. Cloud copies

If you turn on the cloud for a profile, the application seals a copy of it on your computer and uploads it. A cloud copy contains: the profile's name, tags, folder and note; its device identity (the seed and the machine description); its proxy settings, including the proxy password; its cookie keys; its cookies, local and session storage and open tabs; its saved passwords and autofill data, which can include payment card details you saved in the profile; and its icon. It does not contain the profile's browsing history, preferences, extensions or caches.

We also keep the copy's size, engine version, which of your computers last updated it, and which computer currently has it open.

We hold the keys. Your account's cloud key is generated on our server and kept wrapped under a key in our key-management service; computers signed in to your account receive it in memory. Our service can therefore decrypt any cloud copy. The copies themselves are stored separately from the keys, so the storage alone yields only ciphertext. We do not open cloud copies except where you ask us to in a support request, where we are required to by law (Section 5), or where it is strictly necessary to investigate a security incident affecting the copy. Turn the cloud off for any profile you do not want held this way.

A device identity does not expire as a cookie does: anyone who reads a cloud copy could recognise that profile's device on every website for as long as it is used.

Copies made with older versions of the application under a separate sync password are sealed under a key we never received; we cannot read those.

2.5. Teams

If you create or join a team, we store: the team (its name, encrypted under the team key); its members, their roles and when they joined and were admitted; invitations (a hash of the code, a label, who created and used them, and, if the inviter asked us to email the code, the recipient's email address, encrypted); shared folders and who shared them; team copies of profiles (with the same content as a cloud copy, sealed under a team key that we generate and hold, so we can technically decrypt them); who has each shared profile open; and a 30-day history of who opened, closed, took over, added or deleted which shared profile and who joined, was admitted, removed or left, without IP addresses or device identifiers.

Owners and admins of a team can see the sign-in email addresses of its members. Members can see each other's display names.

Invitations by email. If a team owner or admin asks us to email an invitation code to an address, we send one message to that address, on their instruction, and keep the address only, encrypted, with the invitation. The message is the same whether or not the address has a Methmine account. If you received such an email and want no more, write to contact@methmine.com.

2.6. Email we send

We send account confirmation and password-reset links, recovery notices (which include the label of the computer and a coarse network address), password-change notices, and team invitation codes. We send them through an outside email delivery service, which receives the recipient address and the content of each message. We do not send marketing email without your consent.

2.7. Updates and the proxy check

Updates. The application checks updates.methmine.com for new versions of itself and of the engine. These requests carry no identifier of you or your account; our server logs the IP address and user-agent as in 2.1.
Proxy check. When you check a proxy, the application asks our server, through that proxy, which address it sees, and shows you the answer. We do not log these requests.

2.8. On your computer only

The following stays on your computer and is not sent to us unless a cloud or team copy carries it (2.4, 2.5): your profiles and everything in them; the local activity journal; and, if you choose to stay signed in, your account password, encrypted with Windows' per-user data protection and erased when you sign out or after 30 days of disuse.

2.9. Assistants

If you connect an AI assistant to the application, the assistant reads and acts on your profiles through a local interface on your computer. What it reads may be sent to the assistant's provider under that provider's terms and privacy policy. We receive nothing through this interface.

2.10. Support and correspondence

If you write to us, we keep the correspondence and what you tell us in it, to answer you and to keep a record.

3. Legal bases (EEA, UK and similar laws)

Performing our contract with you: the account, cloud, team, updates, recovery and the email in 2.6.
Our legitimate interests in running, securing and improving our services, preventing abuse and fraud, and defending legal claims: server and security logs, rate limits, the application form, the 30-day team history, emails to invitees on a member's instruction, and support records. We have weighed these interests against your rights; you may object (Section 7).
Legal obligation: where we must keep or disclose data by law.
Consent: where we ask for it; you can withdraw it at any time.

4. Who receives your data

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We disclose it only to:

Amazon Web Services, a service provider acting on our instructions: key management, and encrypted storage of cloud and team copies, in Ireland (EU).
Our server hosting provider, acting on our instructions: the account service, the website, the application form and backups, in the Netherlands (EU).
Cloudflare, acting on our instructions: the domain name service, and delivery and protection of the methmine.com website, worldwide.
Resend, our email delivery service, acting on our instructions, in the United States.
Let's Encrypt, which issues the website's certificates and receives no customer data.
Other people you choose: members of a team you share with, and the account you hand a profile to.
Authorities and others where required by law, as described in Section 5.
A successor if Methmine is reorganised, merged or sold, under this policy.

5. Requests from authorities

We disclose personal data to a government or law-enforcement authority only when we are legally required to, in response to valid legal process that we have reviewed, or where we believe in good faith that disclosure is necessary to prevent imminent death or serious physical harm. We disclose no more than the request requires. Unless the law or the request forbids it, or notice would create a risk of harm, we will tell the affected customer before disclosing.

Because we hold the keys to cloud and team copies, a lawful order could require us to decrypt and produce one. Profiles kept only on your computer are not in our possession.

6. International transfers

METHMINE LLC is a United States company, and our service providers are in the EU, the United States and elsewhere. When personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or another lawful mechanism. You can ask us for a copy of the relevant safeguards.

7. Your rights

Depending on where you live, you may have the right to access your personal data, to correct it, to delete it, to receive it in a portable format, to restrict or object to our processing of it, and to withdraw consent. Residents of California and other US states may have the right to know, delete and correct personal data, and not to be discriminated against for exercising these rights.

To exercise a right, write to contact@methmine.com from the email address of your account, with the subject "Privacy request". We will verify the request, may ask for information to confirm it is yours, and will answer within one month (or 45 days where US state law applies), which may be extended where the law allows. Deleting your account deletes your cloud copies, your recovery keys and your account data as set out in Section 8; it cannot delete profiles on your computer, which only you control, or copies that team members have already opened. A beta application you sent before you had an account is not part of the account: it is deleted on its own schedule in Section 8, or sooner if you ask.

If you are in the EEA or the UK, you may complain to your local data protection authority. We would appreciate the chance to address your concern first.

8. How long we keep data

Account data: for as long as your account exists, then deleted within 30 days of its closure, except where we must keep something longer by law or to resolve a dispute.
Unconfirmed registrations and expired sessions and links: deleted within 30 days of expiry.
Cloud and team copies: until you delete them, turn the cloud off for the profile, leave or are removed from the team, or close your account. Deleted copies remain in versioned storage for up to 15 days and in encrypted database backups for up to 15 days, then are gone.
Team history: 30 days.
Invitation records: unused invitations lapse after 24 hours; the record, including any encrypted email address, is deleted within 30 days after that.
Applications to the beta: up to 12 months after we receive them, then deleted. If you become a member, what we need to keep your membership is kept for as long as you are one.
Server and security logs: up to 90 days, unless needed longer to investigate an incident.
Database backups: up to 15 days, encrypted with a key that is not kept on the server.
Support correspondence: up to 3 years after it ends.

9. Security

We encrypt profiles on your computer and cloud and team copies before they leave it, store copies apart from the keys that open them, keep those keys in a hardware-backed key-management service with access logging, hash passwords with Argon2id, encrypt backups, and limit access to our systems to the people who run them. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.

10. Children

Our products are not for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, write to contact@methmine.com and we will delete it.

11. Changes

We may change this policy. We will post the new version here with a new date and, for material changes, tell account holders in the application or by email before the change takes effect.

12. Contact

contact@methmine.com, subject "Privacy request" METHMINE LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA

The English version of this policy is binding. Translations are provided for convenience only.

Version history

October 15, 2026: first version.