Privacy, connection by connection
Everything Mandala stores lives on your node, in your data directory. Credentials are encrypted with your node's master key. Some features send data to outside services to work; this page lists them all.
Always
- Your model provider sees what your accomplice reads to answer: your messages, and the tool results of the turn (an email it opened, a document it read). Choose a provider whose terms you accept, or a local model with Ollama. Choose a model
By connection
| Connection | What Mandala reads | What your accomplice may read | Outside services involved |
|---|---|---|---|
| Gmail | Every thread, into a local index for Communications | Per account and service, as you set in Settings → Extensions → Google | |
| Calendar, Drive, Docs, Sheets | What you or your accomplice open | Per service, per account | |
| Telegram | Your chats, stored locally (TDLib) | Only chats you allow, one by one, in Communications | Telegram |
| Messages arriving after linking, stored locally | Only chats you allow in Communications | WhatsApp (unofficial protocol: a number can be banned) | |
| Apple Health | What your phone pushes, as daily measurements | Your personal records | None |
| PostHog, Ahrefs, Meta Ads, GitHub, Facebook & Instagram, Cloudflare | What your accomplice queries | Projects, accounts and repositories you list | That provider |
| MCP servers | What the server returns | Tools you reviewed and allowed | That server |
| Voice | Recordings and spoken replies | — | Inworld |
| Web search | Search queries | Results | Brave |
| Pictures | Prompts and reference pictures | — | WaveSpeed |
Optional: Jev (TypeSafe)
Three features use Jev, a model hosted by TypeSafe. They are off until you add a TypeSafe key:
- Approval by words and the risk check: the action's name and arguments, which may include finance and health details.
- Smart boxes in Communications: a thread's title, people and latest text, for threads your accomplice may read.
- Routing with Jev: your last few messages, to pick a model.
Your accomplice's limits
Your accomplice reads only what the connection's settings allow, and only for the identity you are acting as. Reading a chat it has not been allowed to read fails, whatever it is asked.