Mimir · Legal
Security
A summary of how Mimir protects data. It is meant to be checkable: the code is in the project's repository.
Encrypted on your device
- An account is a random 160-bit recovery key. Your browser derives from it a vault identifier, a login secret and an AES-256-GCM encryption key using HKDF-SHA256. The three are independent, so the server, which sees the first two, cannot work out the third.
- Your data is encrypted in the browser with a fresh nonce each time and bound to your vault identifier. The server stores only ciphertext.
- The encryption key is held in your browser as a key that cannot be exported.
On the server
- The login secret is stored only as a keyed hash and compared in constant time. An unknown vault and a wrong secret get the same answer.
- Repeated wrong attempts are limited per connection and per vault; creating vaults and saving are limited too.
- No cookies are set, no keys or contents are logged, and IP addresses are not stored.
- Analytics is separate from your vault, off until you allow it, and holds counts only.
Limits you should know
- Anyone who holds your recovery key can open your vault; keep it private. If you lose it, nobody can recover your data.
- The server operator can see that a vault exists, its size and when it was last used, and can delete it.
- The server runs on shared WordPress.com hosting. We rely on the host for network and physical security, for keeping PHP and WordPress patched, and for daily backups To be added: how long backups are kept, to be confirmed with the host.
If something goes wrong
We keep a written incident response plan. If a personal data breach affects you we will tell you, and the Data Protection Board of India, as the law requires.
Reporting a problem
Found a security problem? Email hello@terratalesmedia.world with "Security" in the subject. Please give us reasonable time to fix it before sharing details. We do not currently run a bounty programme.
Related: privacy notice. Version 2026-10, updated 27 October 2026.
Version history
- 27 October 2026 (version 2026-10): first published.