The most common question we get from people considering Mandaire is some version of "what does it actually do with my data?" This is the straight answer.
When you connect Gmail to Mandaire, Mandaire reads your email. When you connect iMessage, it reads your messages. When you connect your calendar, it reads your events. This is the point: a personal AI that does not have access to your actual history cannot reason about your actual life.
The question that follows is reasonable: what happens to all of that?
The short version is this. Mandaire reads your sources to build a personal knowledge graph. The raw corpus is retained locally on the server you control, inside your own trust boundary. The graph is what your AI reads. The destination architecture: raw source discarded after indexing, only the encrypted graph retained, with key derivation on your device. We are not there yet. Here is where we are.
For people who want to understand the architecture before they trust it, this is the straight answer.
Every source connection goes through OAuth. OAuth is the same standard that lets you sign in to a site using your Google account without giving the site your Google password. When you connect Gmail to Mandaire, you authorize access via Google's servers, not by handing Mandaire your credentials.
The scope of that authorization matters. Mandaire requests the minimum scope required to read what it needs. Read-only. No writes. Mandaire cannot send email on your behalf, create calendar events, or modify any source. The authorization is strictly for reading.
You can revoke it at any time through the source settings page, through your Google account's connected apps page, or both. Revoking disconnects the source. Mandaire's OAuth token for that source stops working.
When Mandaire reads a source, the processing happens locally on the server you control. The raw data does not leave to be processed elsewhere. The indexing runs on your infrastructure, against your data, without routing your messages through a third-party service.
For exported data formats (AI conversation histories from providers that let you export a zip file), the process is: upload the export, index it locally. What the indexing produces is a structured representation of what the source material reveals.
Today, the raw source corpus is also retained locally, on the same server you control, to power live retrieval. The destination: raw source discarded after indexing, only the encrypted knowledge graph retained.
The ingest layer builds two things. First: a personal knowledge graph. For each person in your communications, the graph holds one resolved entity record: how often you interact, on which topics, with what recency weighting, what communication patterns are normal for the relationship, what you typically share. Second: the raw corpus itself, retained locally on your server to power live retrieval. Today, both exist.
The distinction that matters: both live on the server you control. Neither leaves your infrastructure for processing. The raw corpus is not held by Mandaire's infrastructure or any third party. It is on your machine, inside your trust boundary.
The goal architecture takes this further. The destination: raw source discarded after indexing, only the encrypted graph retained. Key derivation on your device, so only you hold the decryption key. We are building toward that. The full cryptographic specification is at mandaire.org.
When you ask your AI assistant something and it reads from Mandaire, what it receives is a response constructed from the knowledge graph. The AI reads the graph output for that query, already filtered through the disclosure rules you have set. The surface area of what your AI receives is the structured graph response, not a raw message dump.
This matters for two reasons. First, the surface area is smaller. Your AI is not receiving a dump of your email; it is receiving structured facts about the people and situations relevant to your query. Second, the disclosure policy runs before the AI sees anything. The filtering happens at the data layer, not inside the AI. A separate post covers how disclosure works in detail.
The sources page shows exactly which sources are connected and what has been indexed. You can see what Mandaire has read and disconnect any source at any time. Disconnecting stops future reads from that source. The graph data derived from that source is retained until you request deletion.
Data deletion requests are handled through the privacy request page under CCPA and GDPR timelines. You can request deletion of data from a specific source, or deletion of all data.
The privacy model here is architectural, not policy-based. A policy says "we do not share your data." An architecture says "the data is stored in a form that limits the exposure surface structurally." Both matter, but they are different kinds of assurances.
Today, Mandaire's architecture retains the raw corpus locally and builds the knowledge graph on top of it. The AI reads the graph. The raw corpus stays on your server. This is a meaningfully different exposure profile than a cloud-held corpus: the trust boundary is your infrastructure, not a shared service. But it is not the same as not retaining the raw corpus. The goal architecture eliminates local raw retention too. That is what we are building toward, and we say so explicitly because the gap between today and the destination matters.
The full specification, including the cryptographic design, the data retention schedule, and the ingest architecture, is published at mandaire.org. We publish it because "trust us" is not the architecture. The architecture is the architecture.