Privacy Policy

Introduction

Welcome to Brainfo ("we," "our," or "us"). Brainfo is an offline-first note-taking and collaboration platform that helps you organize your thoughts, collaborate with your team, and access your content anywhere, even without an internet connection.

We are committed to protecting your privacy and being transparent about how we collect, use, and protect your personal information. This Privacy Policy explains:

• What information we collect from you
• How we use that information
• Who we share it with
• Your rights and choices regarding your information
• How we protect your data

This policy applies to all users of Brainfo, including our web application, mobile applications (iOS and Android), and desktop applications (Windows, macOS, Linux). It also applies to visitors of our website, brainfo.ai (see Section 2.4).

Who we are: Brainfo is provided by Climax Web Solutions, with its principal place of business at 6075 Yonge St., Level 2, Toronto, Ontario M2M 3W2, Canada. For most of the processing in this policy, Climax Web Solutions is the data controller. When a workspace owner adds personal information about its members, we process that information on the owner's behalf, as its processor or service provider.

By using Brainfo, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use our services.

Information We Collect

We collect information that you provide directly to us, information that is automatically collected when you use our service, and information from third parties in limited circumstances.

2.1 Information You Provide Directly

Account Information

When you create a Brainfo account, we collect:

• Email address: Required for account creation, login, and communication
• Password: Stored securely using industry-standard hashing (managed by our authentication provider)
• Name: First and last name (optional but recommended for collaboration features)
• Profile avatar: Optional profile picture that you may upload

Waitlist Information

When you join the Brainfo waitlist, we collect:

• Email address: To confirm your place on the waitlist and invite you when a spot opens
• Newsletter choice: Whether you ticked the box to receive product updates. The box is unticked by default.
• Sign-up type: Whether your email address is a Gmail address, which we use to guess whether you are signing up as an individual or for a company

Workspace Information

When you create or join workspaces, we collect:

• Workspace name: The name you give to your workspace
• Workspace icon: Optional icon/image for your workspace
• Member information: Email addresses of users you invite to collaborate
• Role assignments: Your role and the roles you assign to workspace members (owner, admin, member)

Content You Create

We store the content you create within Brainfo, including:

• Documents: Text, formatting, and rich media content in your notes and documents
• Tasks: Task descriptions, due dates, status, and related information
• Links: URLs and metadata for links you save
• Tags: Tags and labels you create to organize your content
• Folders: Folder names and organizational structure
• Comments and annotations: Any comments or annotations you add to content
• File attachments: Images, documents, and other files you upload to your content
  • Supported formats: JPEG, PNG, and other common file types
  • Size limits vary based on your subscription plan (Lite, Pro, Team, Max)
• Version history: Previous versions of your content for recovery purposes

Communication with Us

If you contact us for support or provide feedback:

• Support messages: The content of your communications with our support team
• Feedback: Any feedback, suggestions, or feature requests you provide

Payment Information (via Paddle)

When you upgrade to a paid subscription:

• Billing name and address: Collected by our payment processor, Paddle
• Payment method details: Credit card or other payment information (collected and stored by Paddle, not by us)
• Transaction history: Records of your subscription purchases and renewals

Important: We do not directly store or process credit card information. All payment processing is handled by Paddle, our PCI-compliant payment processor.

2.2 Information Collected Automatically

Usage Information

When you use Brainfo, we automatically collect:

• Feature usage: Which features you use (documents, tasks, AI chat, etc.)
• AI usage metrics: Number of AI requests you make (for usage limit enforcement)
• Last activity timestamps: When you last accessed your workspace or content
• Workspace membership: Which workspaces you belong to and your role in each
• Product analytics events: The screens you view and the features and buttons you use in the app, with timestamps, linked to your account ID (see Section 3.7). They never include the content of your notes, documents, or other content.

Device and Technical Information

We collect technical information about your device and how you access our service:

• IP address: Your device's internet protocol address (used for security and regional services)
• Device type: Whether you're using web, mobile (iOS/Android), or desktop (Windows/macOS/Linux)
• Browser type and version: If using the web application
• Operating system: Your device's operating system and version
• Device identifiers: Unique identifiers for your device (for mobile and desktop apps)
• Screen resolution: To optimize the user interface
• Network connection: Whether you're online or offline (for offline sync functionality)
• Font requests: The app loads fonts from Google Fonts, so your device sends your IP address and browser information to Google. Exporting a document to HTML or PDF, and opening an exported HTML file, also loads a font from Google Fonts (see Section 5.8).

Collaborative Editing Information

When you collaborate with others in real-time:

• Cursor position: Your cursor location in shared documents (visible to other collaborators)
• User presence: Whether you're currently viewing or editing a document
• Edit operations: The specific changes you make to documents (for real-time sync and version history)
• Session metadata: When you join and leave collaborative editing sessions

Local Storage

For offline functionality, we store data locally on your device:

• IndexedDB: A local database containing your synced workspaces, documents, and settings
• LocalStorage: Session tokens and application preferences
• Service Worker cache: Cached application files for offline use

This local data is encrypted and synchronized with our servers when you're online.

2.3 Information from Third Parties

Authentication Providers

If you sign up or log in using a third-party provider:

• Google OAuth: If you sign in with Google, we receive your email address, name, and profile picture from Google. We do not receive your Google password.

Video Metadata Services

When you embed videos in your documents:

• YouTube: We fetch public video metadata (title, thumbnail) via YouTube Data API v3
• Vimeo: We fetch public video metadata via Vimeo API
• Dailymotion: We fetch public video metadata via Dailymotion API

We only access publicly available information and do not access your private video libraries.

2.4 Information from Our Website (brainfo.ai)

Our website, brainfo.ai, is separate from the Brainfo app. When you visit it:

• Website analytics: Google Analytics records the pages you visit, the page that referred you, your approximate location (derived from your IP address), your device and browser type, and actions such as form submissions. It sets cookies to recognize repeat visits (see Section 6.2). Where the law requires consent, including in the EEA, UK, and Switzerland, Google Analytics runs only after you accept analytics cookies in our cookie banner.
• Fonts: The website loads fonts from Google Fonts. Your browser sends your IP address and browser information to Google to fetch them.
• Newsletter form: If you enter your email address in the newsletter form in the website footer, it is sent to Google FeedBurner, a Google service that handles the subscription.
• Server logs: Like any website, our hosting receives standard request data, such as your IP address, browser type, and the page requested.

The website does not require an account. Joining the waitlist happens in the Brainfo app (see Section 2.1).

How We Use Your Information

We use the information we collect for the following purposes:

3.1 Provide and Improve Our Service

• Service delivery: To provide you with access to Brainfo and all its features
• Account management: To create and manage your account, workspaces, and subscriptions
• Content storage and sync: To store your content and sync it across your devices
• Offline functionality: To enable offline access to your content via local storage and synchronization
• Real-time collaboration: To enable real-time editing with other workspace members
• Version history: To maintain version history and allow you to restore previous versions
• Search and organization: To enable you to search, tag, and organize your content

3.2 AI-Powered Features

We use your content to provide AI-powered features:

• Document Copilot: To generate, edit, and improve text based on your prompts and selected content
• AI Chat Assistant: To answer questions and help you create and organize content, using content from your current workspace
• Automatic Tag Generation: To suggest relevant tags based on your document titles and content

What each AI feature reads:

• Document Copilot: Your prompt and the text you select
• Automatic Tag Generation: The title and content of the document being tagged
• AI Chat Assistant: Your messages and anything you attach or mention. While answering, it can also search your current workspace and open notes, documents, and other items on its own. It can only reach content you already have access to.

Everything an AI feature reads is sent to our AI provider as part of the request.

Important: Your content sent to AI services is:

• Processed by OpenRouter (our AI service provider)
• Used only to generate your requested output
• Not used to train AI models (per OpenRouter's data handling policies)
• Subject to usage limits based on your subscription plan

3.3 Communication

• Service notifications: To send you important updates about your account, workspaces, or service changes
• Workspace invitations: To send email invitations when you invite someone to your workspace
• Subscription management: To send billing confirmations, renewal notices, and payment receipts
• Waitlist communications: To notify you when you're approved from the waitlist
• Support responses: To respond to your support requests and provide assistance
• Optional newsletters: To send product updates and tips (only if you opt in)

All transactional emails are sent via Resend, our email service provider.

3.4 Payment Processing

• Subscription billing: To process subscription payments and manage your billing information
• Plan management: To upgrade, downgrade, or cancel your subscription as requested
• Usage enforcement: To enforce plan limits (storage, AI requests, team members)
• Proration: To calculate prorated charges when you change plans mid-cycle

All payment processing is handled by Paddle, our payment processor.

3.5 Security and Fraud Prevention

• Authentication: To verify your identity and prevent unauthorized access
• Session management: To maintain your logged-in state securely
• Abuse prevention: To detect and prevent fraudulent activity, spam, and abuse
• Security monitoring: To monitor for security threats and respond to incidents
• Access control: To ensure users can only access workspaces they're authorized to view

3.6 Legal Compliance

• Legal obligations: To comply with applicable laws, regulations, and legal processes
• Terms enforcement: To enforce our Terms of Service and other agreements
• Rights protection: To protect the rights, property, and safety of Brainfo, our users, and the public

3.7 Analytics and Improvement

We collect usage metrics to improve Brainfo:

• Feature usage tracking: Which features are most used to prioritize improvements
• Performance monitoring: To identify and fix bugs and performance issues
• Error tracking: To diagnose and resolve technical problems

Website Analytics (Google Analytics, brainfo.ai only):

• Purpose: To understand how visitors find and use our website, and which pages and campaigns bring them
• Scope: Runs on our website only. It is not part of the Brainfo app and does not see your notes, documents, or account.
• Provider: Google. See how Google uses data from sites that use its services: https://policies.google.com/technologies/partner-sites
• Your choice: Where the law requires consent, it runs only after you accept analytics cookies in our cookie banner. You can change your choice at any time with the "Cookie settings" link in the website footer.
• Opt out: You can also refuse or delete cookies in your browser, or install Google's opt-out add-on: https://tools.google.com/dlpage/gaoptout

Product Analytics (PostHog, Brainfo app):

• Purpose: To learn which features people use, where they get stuck, and what to improve next
• Data collected: The screens you view and the features and buttons you use, with timestamps, your account ID, device and browser type, and approximate location (country and city) derived from your IP address. We configure PostHog not to store your full IP address.
• What it never collects: The content of your notes, documents, tasks, chats, or anything you type. We mask text and input fields, and we do not record your screen or sessions.
• Your choice: In the EEA, UK, and Switzerland, product analytics runs only after you agree. Everywhere, you can turn it off at any time in Settings.
• Location: PostHog's EU cloud
• Retention: When you delete your account, we delete your product analytics data too.

Cloudflare Infrastructure Analytics (Infrastructure-Level):

• Real User Monitoring (RUM): We use Cloudflare's built-in infrastructure analytics to monitor application performance
• Data collected by Cloudflare:
  • Page load times and performance metrics
  • CDN request statistics (cache hit rates, response codes)
  • Geographic distribution of users (country/city level, derived from IP address)
  • Browser type and device information
  • Referrer URLs (where you came from)
• Purpose: To optimize application performance, CDN configuration, and user experience
• Privacy: This data is processed by Cloudflare per their privacy policy (https://www.cloudflare.com/privacypolicy/)
• No cross-site tracking: Only tracks performance on Brainfo, not across other websites
• No personal identification: This analytics data is not linked to your account or user profile

Error Tracking and Performance Monitoring (Sentry):

• Real-time error tracking: We use Sentry to monitor and fix bugs in real-time
• Data collected by Sentry:
  • Error messages and stack traces (technical details of bugs)
  • Performance metrics (page load times, slow database queries, API response times)
  • User context: User ID only (no email or name - configured for privacy)
  • Browser and device information (user agent, OS, screen resolution)
  • URL and route information (which pages you were visiting when errors occurred)
  • IP address (for geographic context, can be scrubbed)
• Purpose: To identify, diagnose, and fix bugs and performance issues quickly
• Privacy protections:
  • PII scrubbing enabled: Email addresses, usernames, and other personal info automatically removed
  • Sensitive field filtering: Passwords, tokens, and credit card information never sent
  • Data retention: Error data retained for 30 days, then automatically deleted
  • User context: Only user ID sent (not email or name), or fully anonymous if preferred
• Privacy Policy: https://sentry.io/privacy/
• GDPR Compliance: Sentry is GDPR-compliant and has a Data Processing Agreement

3.8 Advertising Brainfo

We advertise Brainfo on other platforms, such as Reddit.

• Campaign tags: Links in our ads carry campaign tags (UTM parameters). A tag names the campaign and ad group. It does not identify you.
• How we use them: To see which campaigns bring visitors to Brainfo, and to decide where to advertise. We look at these numbers only in aggregate.
• What we do not do: We do not put advertising pixels, tracking SDKs, or conversion APIs from any ad platform on our website or apps. We do not upload email lists to ad platforms. We send no personal data to the platforms where we advertise.
• The ad platform's own data: When you see or click one of our ads, the platform may collect data about that under its own privacy policy. For Reddit, see https://www.reddit.com/policies/privacy-policy.

3.9 Legal Bases (EEA, UK and Switzerland)

We process personal data on these legal bases:

• Contract: To create your account and provide sync, collaboration, and the AI features you request
• Legitimate interests: To secure the service, prevent abuse, fix bugs, improve features, and measure our advertising in aggregate
• Legal obligation: To keep invoices and tax records and to answer lawful requests
• Consent: To send optional newsletters, to set analytics cookies on our website, and to run product analytics in the app. You can withdraw consent at any time.

When we rely on legitimate interests, we do not do so where your rights and interests override them.

Data Storage and Security

4.1 Where Your Data is Stored

Your data is stored in secure, professional infrastructure:

Primary Database

• PostgreSQL database hosted by our database provider
• Location: Data centers chosen for optimal performance and reliability
• Encryption: Data encrypted at rest using industry-standard encryption

File Storage

• Cloudflare R2 for file attachments and media
• Encryption: All files encrypted at rest

Real-Time Collaboration

• Cloudflare Durable Objects for real-time collaborative editing
• Location: Cloudflare's global network (automatically routes to nearest data center)
• Persistence: Collaboration state synced to primary database

Offline Sync

• PowerSync service for offline-first synchronization
• Local storage: IndexedDB on your device (encrypted)
• Sync: Bidirectional synchronization when online

API and Backend

• Cloudflare Workers (serverless compute platform)
• Global distribution: API available from Cloudflare's global network
• DDoS protection: Built-in protection against distributed denial-of-service attacks

4.2 Security Measures

We implement multiple layers of security to protect your data:

Encryption

In Transit (Data being transmitted):

• TLS 1.2+: All data transmitted over HTTPS with modern TLS encryption
• WebSocket Secure (WSS): Real-time collaboration uses encrypted WebSocket connections
• Certificate verification: Valid SSL/TLS certificates for all domains

At Rest (Data being stored):

• Database encryption: PostgreSQL data encrypted at rest by our hosting provider
• File encryption: All uploaded files encrypted at rest in Cloudflare R2
• Local storage encryption: IndexedDB data encrypted on your device

Authentication and Access Control

• Password hashing: Passwords hashed using bcrypt/scrypt via Supabase Auth (never stored in plaintext)
• JWT tokens: Secure JSON Web Tokens for session management
• Token expiration: Automatic token expiration and refresh for security
• Multi-factor authentication (MFA): Optional TOTP-based 2FA for enhanced account security
• OAuth 2.0: Secure integration with Google for single sign-on

Role-Based Access Control (RBAC)

• Workspace roles: Owner, Admin, and Member roles with different permissions
• Resource-level permissions: Users can only access workspaces they're members of
• Data isolation: PowerSync sync rules ensure you only sync data you're authorized to access

Input Validation and Sanitization

• Schema validation: All API inputs validated using Zod schemas
• XSS prevention: User input sanitized to prevent cross-site scripting attacks
• SQL injection prevention: Parameterized queries via Drizzle ORM
• CSRF protection: Cross-site request forgery protection on all state-changing operations

Security Headers

Our web application uses security headers to protect against common attacks:

X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Content-Security-Policy: [comprehensive policy]
Strict-Transport-Security: max-age=31536000; includeSubDomains

Network Security

• Cloudflare DDoS protection: Protection against distributed denial-of-service attacks
• Firewall rules: Restricted access to backend infrastructure
• Origin validation: CORS policies restrict which origins can access our API

Monitoring and Incident Response

• Error monitoring: Cloudflare observability enabled for error tracking
• Security logging: Logging of authentication events and suspicious activity
• Incident response: Procedures in place to respond to security incidents

Note: We do NOT log sensitive information like passwords, credit card numbers, or session tokens in our logs.

4.3 Data Backup and Recovery

• Automated backups: Regular automated backups of all data
• Version history: Content versions stored for recovery
• Durable Object persistence: Collaboration state persisted to prevent data loss
• Disaster recovery: Infrastructure designed for high availability and disaster recovery

4.4 Your Responsibility

While we implement strong security measures, your security also depends on:

• Strong passwords: Use unique, strong passwords for your account
• Enable MFA: Use multi-factor authentication for additional protection
• Keep devices secure: Protect devices with passwords/biometrics
• Be cautious with sharing: Only share workspace access with trusted collaborators
• Report security issues: Report any suspected security vulnerabilities to [email protected]

4.5 International Transfers

We are based in Canada. Our service providers (see Section 5) may process your information in other countries, including the United States and the European Union.

• Safeguards: When we transfer personal data from the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on safeguards such as the European Commission's Standard Contractual Clauses or an equivalent transfer tool.
• Nearest data centre: Real-time collaboration runs on Cloudflare's global network, so your session may be processed in the data centre nearest to you.

Third-Party Services

We use carefully selected third-party services to provide Brainfo. Each service processes specific types of data as described below.

5.1 Essential Services

Supabase (Authentication and Database)

• Purpose: User authentication, database hosting
• Data Shared: Email, password (hashed), profile information
• Location: Supabase's data centers
• Privacy Policy: https://supabase.com/privacy
• Data Processing Agreement: Available upon request

Cloudflare (Infrastructure)

• Purpose: API hosting (Workers), real-time collaboration (Durable Objects), DDoS protection, CDN, AI request routing, analytics
• Data Shared: All data passing through our API and web application
• Services Used:
  • Cloudflare Workers: Serverless API backend and static web asset hosting
  • Cloudflare Durable Objects: Real-time collaboration state
  • Cloudflare R2: File attachments, media, content version files, and data exports
  • Cloudflare AI Gateway: Routes AI requests to OpenRouter (caching and monitoring)
  • Cloudflare Infrastructure Analytics: Performance monitoring (RUM and CDN analytics)
• Analytics Data:
  • Page load performance metrics
  • CDN request statistics
  • Geographic location (country/city level from IP)
  • Browser and device information
  • Referrer URLs
• Location: Cloudflare's global network
• Privacy Policy: https://www.cloudflare.com/privacypolicy/
• GDPR Compliance: Cloudflare is GDPR-compliant

PowerSync

• Purpose: Offline-first data synchronization
• Data Shared: Workspace data, documents, tasks, tags, folders
• Location: PowerSync data centers
• Privacy Policy: https://www.powersync.com/legal/privacy-policy
• Data Processing: Real-time bidirectional sync with your devices

5.2 Payment Processing

Paddle

• Purpose: Payment processing, subscription management, billing
• Data Shared:
  • Billing information (name, address, email)
  • Payment method details (stored by Paddle only, not by us)
  • Transaction amounts and subscription details
  • Customer ID and subscription status
• Location: Paddle's secure payment infrastructure
• Privacy Policy: https://www.paddle.com/legal/privacy
• Compliance: PCI DSS Level 1 certified, GDPR-compliant
• Important: We do not store or process credit card information. Paddle handles all payment data securely.

5.3 Communication Services

Resend

• Purpose: Transactional email delivery
• Data Shared:
  • Email addresses (recipients)
  • Email content (invitations, notifications, receipts)
  • Sender information
• Location: Resend's email infrastructure
• Privacy Policy: https://resend.com/legal/privacy-policy
• Use Cases:
  • Workspace invitations
  • Waitlist approvals
  • Subscription notifications
  • Payment confirmations

5.4 AI Services

OpenRouter (via Cloudflare AI Gateway)

• Purpose: AI-powered features (Copilot, AI Chat, Tag Generation)
• Routing: Requests routed through Cloudflare AI Gateway before reaching OpenRouter
• Data Shared:
  • Your prompts and questions
  • Text you select for Document Copilot
  • Document titles and content for tag generation
  • Workspace content the AI Chat Assistant searches for or opens while answering (only content you can access)
• Cloudflare AI Gateway:
  • Routes and optionally caches AI requests
  • Provides monitoring and rate limiting
  • Logging: request/response
• Location: OpenRouter's infrastructure (routes to various AI model providers)
• Privacy Policy: https://openrouter.ai/privacy
• Data Usage:
  • Your content is NOT used to train AI models
  • Data processed only to generate your requested output
  • OpenRouter may temporarily cache requests for rate limiting
• AI Models: Access varies by subscription plan (Lite: a limited set of models, Pro, Team and Max: all models)

How to minimize AI data sharing:

• Only use AI features on non-sensitive content
• Review AI-generated content before sharing
• Don't include personal information in AI prompts
• The AI Chat Assistant can read content in the workspace where you use it. Keep highly sensitive material in a workspace where you don't use AI chat.

5.5 Video Services

YouTube Data API v3

• Purpose: Fetch video metadata for embedded videos
• Data Shared: Video URLs you embed in documents
• Data Accessed: Publicly available video information (title, thumbnail, duration)
• Privacy Policy: https://policies.google.com/privacy
• Important: We only access public video data; we do not access your YouTube account or private videos.

Vimeo API

• Purpose: Fetch video metadata for embedded videos
• Data Shared: Video URLs you embed in documents
• Data Accessed: Publicly available video information
• Privacy Policy: https://vimeo.com/privacy
• Important: We only access public video data; we do not access your Vimeo account.

5.6 Third-Party Service Policies

All third-party services we use:

• Are selected for their security and privacy practices
• Have their own privacy policies (linked above)
• Are required to protect your data in accordance with applicable laws
• Are periodically reviewed for continued compliance and security

We do NOT use:

• Advertising networks or ad-serving code on our website or apps
• Advertising or social media tracking pixels, SDKs, or conversion APIs
• Data brokers or data resellers
• Marketing tools that track you across other websites

What we DO use (with strong privacy protections):

• Cloudflare Infrastructure Analytics: Infrastructure-level performance monitoring (RUM and CDN analytics)
• Sentry: Error tracking with PII scrubbing, sensitive data filtering, and 30-day retention
• Google Analytics: Visitor analytics on our website, brainfo.ai, only (see Sections 2.4 and 5.8)
• PostHog: Product analytics in the Brainfo app, with content masked and no session recordings (see Sections 3.7 and 5.9)
• Campaign tags (UTM parameters): Tags in our ad links that tell us which campaign brought a visitor (see Section 3.8)

Your rights with third parties:

• You can exercise privacy rights (access, deletion) directly with these services via their privacy policies

5.7 Links and Embedded Content

Some content in Brainfo may link to or embed third-party services. Their own privacy policies govern how they collect and use information. We are not responsible for their practices.

5.8 Website Services (brainfo.ai) and Google Fonts

Google Analytics and Google FeedBurner run on our website only, not in the Brainfo app. Google Fonts is used by both the website and the app.

Google Analytics

• Purpose: Website visitor analytics
• Data Shared: Pages visited, referring page, approximate location from IP address, device and browser information, website actions such as form submissions, and a cookie identifier
• Privacy Policy: https://policies.google.com/privacy

Google Fonts

• Purpose: Loading the fonts the website and the app use, including in documents you export to HTML or PDF
• Data Shared: Your IP address and browser information, sent when your browser requests the fonts
• Privacy Policy: https://policies.google.com/privacy

Google FeedBurner

• Purpose: Newsletter sign-up from the website footer
• Data Shared: The email address you enter in the newsletter form
• Privacy Policy: https://policies.google.com/privacy

5.9 Product Analytics

PostHog

• Purpose: Product analytics in the Brainfo app (see Section 3.7)
• Data Shared: Screens viewed, features and buttons used, timestamps, your account ID, device and browser type, and approximate location. Never the content of your notes, documents, tasks, or chats.
• Location: PostHog's EU cloud
• Privacy Policy: https://posthog.com/privacy
• Data Processing Agreement: PostHog processes this data on our behalf under a data processing agreement

Cookies and Tracking Technologies

6.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help us recognize you and remember your preferences.

6.2 Cookies We Use

We use cookies and similar technologies for the following purposes:

Essential Cookies (Required)

These cookies are necessary for the service to function and cannot be disabled:

• Session cookies: Maintain your logged-in state (sb-access-token, sb-refresh-token)
• Authentication tokens: Securely store your authentication credentials
• Workspace context: Remember your last visited workspace
• Preference cookies: Remember your theme (light/dark mode) and language preferences

Functional Cookies (Optional)

These cookies enhance functionality:

• Editor preferences: Remember your editor settings and view preferences
• UI state: Remember sidebar open/closed state, panel layouts
• Recently viewed: Track recently accessed documents for quick access

Website Analytics Cookies (brainfo.ai only)

Our website sets Google Analytics cookies, such as _ga, to count visits and recognize returning visitors. Where the law requires consent, it sets them only after you accept analytics cookies in our cookie banner. The Brainfo app does not set them.

Product Analytics Storage (Optional, Brainfo app)

PostHog stores an identifier in a cookie and in local storage so it can link your product analytics events together. It is set only when product analytics is on (see Section 3.7).

6.3 Local Storage

In addition to cookies, we use browser local storage:

• LocalStorage: Session tokens, user preferences, UI state
• IndexedDB: Offline-synced data (workspaces, documents, tasks)
• Service Worker cache: Application files for offline use

6.4 Third-Party Cookies

When you use third-party features, those services may set their own cookies:

• Google OAuth: If you sign in with Google, Google may set cookies (see Google's privacy policy)
• Paddle Checkout: When you make a payment, Paddle may set cookies (see Paddle's privacy policy)
• Google Analytics: On our website, brainfo.ai, Google sets analytics cookies (see Section 6.2)

6.5 Your Cookie Choices

How to control cookies:

• Browser settings: Most browsers allow you to refuse cookies or delete existing cookies
  • Chrome: Settings > Privacy and security > Cookies
  • Firefox: Settings > Privacy & Security > Cookies
  • Safari: Preferences > Privacy > Cookies
  • Edge: Settings > Cookies and site permissions
• Essential cookies: Disabling essential cookies will prevent you from using Brainfo
• Functional cookies: You can disable these, but some features may not work as expected
• Website analytics cookies: Accept or refuse them in our cookie banner, and change your choice later with the "Cookie settings" link in the website footer. You can also block them in your browser or use Google's opt-out add-on (https://tools.google.com/dlpage/gaoptout). The website works without them.
• Product analytics: Turn it off at any time in Settings in the Brainfo app. The app works without it.

Do Not Track:

• We do not track you across other websites
• We do not use advertising or social media tracking pixels
• Google Analytics on our website does not respond to Do Not Track (DNT) signals. Use the opt-out options above instead.

Data Sharing and Disclosure

7.1 Sharing Within Workspaces

When you collaborate in workspaces:

• Workspace members: Other members of your workspace can see:
  • Your name and profile picture
  • Content you create or edit in shared workspaces
  • Your comments and activity in shared documents
  • Your online/offline status (when you're actively using the workspace)
• Workspace owners and admins: Can additionally see:
  • Workspace usage statistics
  • Member roles and permissions
  • Subscription and billing information

Control your sharing:

• Only join workspaces with people you trust
• Create separate workspaces for different projects or teams
• Use private workspaces for personal content

Organization workspaces: When an organization or workspace owner adds personal information about its members, that organization controls the information. We process it only to provide the service, under our agreement with that organization.

7.2 Service Providers

We share data with third-party service providers who help us operate Brainfo:

• Infrastructure providers: Cloudflare, Supabase, PowerSync (see Section 5)
• Payment processor: Paddle (for billing and payments)
• Email service: Resend (for transactional emails)
• AI service: OpenRouter (your prompts, and the content an AI feature reads to answer them; see Section 3.2)
• Product analytics: PostHog (usage events only, never your content)

Our requirements for service providers:

• Process data only as instructed by us
• Maintain appropriate security measures
• Comply with applicable privacy laws
• Not use your data for their own purposes
• Have data processing agreements in place

Google services: On our website, brainfo.ai, Google provides analytics, fonts, and the newsletter sign-up. Google Fonts also serves the fonts the app uses (see Section 5.8). Google may also use this data for its own purposes, as described in its privacy policy.

7.3 Legal Requirements

We may disclose your information if required by law or in response to valid legal processes:

• Legal obligations: To comply with applicable laws, regulations, or legal requests
• Legal process: In response to subpoenas, court orders, or other legal processes
• Rights protection: To protect the rights, property, or safety of Brainfo, our users, or the public
• Fraud prevention: To detect, prevent, or address fraud, security, or technical issues
• Terms enforcement: To enforce our Terms of Service or other agreements

Our commitment:

• We will notify you of legal requests unless prohibited by law
• We will contest overbroad or inappropriate requests
• We will only disclose the minimum information necessary

7.4 Business Transfers

In the event of a merger, acquisition, or sale of assets:

• Your information may be transferred to the acquiring entity
• We will notify you via email and/or prominent notice on our service
• The acquiring entity will be required to honor this Privacy Policy
• You will have the opportunity to delete your account before the transfer

7.5 With Your Consent

We may share your information for other purposes with your explicit consent:

• If you authorize us to share data with third-party integrations
• If you participate in joint promotions with partners
• If you opt in to beta programs or research studies

7.6 Aggregated and De-Identified Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably identify you:

• Usage statistics (e.g., "X% of users use AI features")
• Performance metrics
• General trends and insights

This data does not identify individual users and is not subject to this Privacy Policy.

7.7 Error Tracking and Performance Monitoring

Sentry

• Purpose: Real-time error tracking and performance monitoring
• Data Shared:
  • Error messages and stack traces
  • Performance metrics (transaction times, slow queries)
  • User context: User ID only (not email or name)
  • Browser and device information
  • URL and route information
• Privacy Protections:
  • PII scrubbing enabled: Email addresses, IP addresses, and usernames automatically removed
  • Sensitive field filtering: Passwords, tokens, credit cards never sent
  • Data retention: 30 days (errors automatically deleted after 30 days)
  • User context: Only user ID sent (not email/name) for privacy
• Location: Sentry's secure data centers (US and EU regions available)
• Privacy Policy: https://sentry.io/privacy/
• GDPR Compliance: Sentry is GDPR-compliant with Data Processing Agreement
• Purpose: To identify, diagnose, and fix bugs quickly to improve your experience

Why we use Sentry:

• Immediate notification when errors occur
• Understand the context of bugs (what page, what action)
• Track performance issues (slow pages, database queries)
• Prioritize fixes based on impact
• Ensure a smooth, bug-free experience

Your privacy:

• Sentry never sees your passwords, payment information, or document content
• We've configured Sentry to minimize personal information collection
• You can request deletion of your data from Sentry at any time

7.8 What We Do NOT Do

We do NOT:

• Sell your personal information to third parties
• Share your content with advertisers
• Use your data for targeted advertising
• Send your personal data to the platforms where we advertise Brainfo
• Share your data with data brokers
• Rent or lease your information to others

Your Rights and Choices

You have rights regarding your personal information. This section explains what rights you have and how to exercise them.

8.1 Access Your Information

What you can do:

• View and edit your profile information in account settings
• Access all your workspaces, documents, and content through the app
• Review your subscription and billing information in workspace settings

8.2 Correct Your Information

What you can do:

• Update your name, email, and profile picture
• Edit or correct any content you've created
• Update workspace names and settings

8.3 Delete Your Information

Delete Specific Content

What you can do:

• Delete individual documents, tasks, or links
• Remove file attachments
• Clear AI chat history

Delete Your Account

What you can do:

• Permanently delete your entire account and all associated data

How to do it:

• Settings > My Account > Delete My Account
• Confirm deletion

What is NOT deleted:

• Shared workspaces you don't own continue to exist (you're just removed as a member)
• Content created by other users in shared workspaces remains available to those users
• Transaction records may be retained for legal and accounting purposes (as required by law)

8.4 Export Your Data

What you can do:

• Export individual documents to DOCX or PDF format
• Request an archive of your data under Settings > Export my data

8.5 Manage Communications

What you can do:

• Unsubscribe from optional newsletters and product updates
• Control notification preferences

What you CANNOT opt out of:

• Transactional emails (account notifications, billing receipts)
• Security alerts (password changes, unauthorized access attempts)
• Workspace invitations (sent by other users)

How to do it:

• Click "Unsubscribe" at the bottom of any marketing email

8.6 Object to Processing

What you can do:

• Object to certain types of data processing (subject to legal limitations)

How to do it:

• Email [email protected] with your specific objection

8.7 Restrict Processing

What you can do:

• Request that we limit how we use your data in certain circumstances:
  • You contest the accuracy of your data
  • You object to processing and we're verifying legitimate grounds
  • We no longer need the data, but you need it for legal claims
  • Processing is unlawful, but you don't want data deleted

How to do it:

• Email [email protected] with your request

8.8 Data Portability

For information you provided to us:

• You can export your data in machine-readable format (JSON)

8.9 Withdraw Consent

Where we rely on your consent to process data:

• You can withdraw consent at any time
• Withdrawing consent does not affect lawfulness of processing before withdrawal
• Some features may become unavailable if you withdraw consent

8.10 How to Exercise Your Rights

To exercise any of these rights:

1. In-app: Many rights can be exercised directly in Settings
2. Email: Contact [email protected] with your request
3. Include: Your name, email address, and specific request
4. Verification: We may request additional information to verify your identity

8.11 Region-Specific Notices

• EEA, UK, and Switzerland: You have the right to lodge a complaint with your local data protection authority.
• Canada (PIPEDA): You may request access to, or correction of, your personal information, subject to limited exceptions. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.
• U.S. state privacy laws (including California): We do not sell or "share" personal information for cross-context behavioral advertising. You may ask to know, delete, or correct the personal information we hold about you by emailing [email protected]. We will not discriminate against you for using these rights.

Data Retention

9.1 How Long We Keep Your Data

We retain your information for as long as necessary to provide Brainfo and fulfill the purposes described in this Privacy Policy.

Active Accounts

• Account information: Retained while your account is active
• Content (documents, tasks, links): Retained while your account is active and you haven't deleted it
• File attachments: Retained while associated content exists

Deleted Content

• Trash: Deleted content moves to Trash and is retained for 30 days
• After 30 days: Content in Trash is permanently deleted
• Empty Trash: You can manually empty Trash to immediately delete permanently

Deleted Accounts

• Personal data: Deleted within 30 days of account deletion
• De-identified data: May be retained indefinitely for analytics (cannot identify you)

9.2 Why We Retain Data

We retain data for legitimate business and legal purposes:

• Service provision: To provide you with access to your content
• Legal compliance: To comply with legal, tax, and accounting obligations
• Dispute resolution: To resolve disputes or enforce our Terms of Service
• Fraud prevention: To detect and prevent fraud and abuse
• Security: To maintain security and prevent unauthorized access

9.3 Data Deletion

When we delete data:

• Secure deletion: Data is securely deleted from production systems
• Irreversibility: Deletion is permanent and cannot be undone

9.4 Your Control Over Retention

You can control how long we keep your data:

• Delete content: Delete individual documents, tasks, or files at any time
• Empty Trash: Immediately permanently delete content in Trash
• Delete account: Delete your entire account and all data
• Export before deletion: Export your data before deleting (deletion is permanent)

Offline copies: Deleting data on our servers does not delete the offline copies stored on your devices (IndexedDB and local storage). Clear those on each device, or sign out and remove the app.

Children's Privacy

Brainfo is not intended for use by children under the age of 13 (or 16 in the European Economic Area).

10.1 Age Restrictions

• Minimum age: You must be at least 13 years old (16 in the EEA) to use Brainfo
• No collection from children: We do not knowingly collect personal information from children under 13 (or 16 in the EEA)
• Parental consent: If we learn we have collected information from a child without parental consent, we will delete it promptly

10.2 If You Believe a Child Has Provided Information

If you believe a child under 13 (or 16 in the EEA) has provided personal information to us:

• Contact us immediately at [email protected]
• Include details about the child's account (email address, name, etc.)
• We will investigate and delete the account if confirmed

10.3 COPPA Compliance (United States)

We comply with the Children's Online Privacy Protection Act (COPPA):

• We do not knowingly collect information from children under 13
• We do not market to children under 13
• We do not have features specifically designed for children

Changes to This Policy

11.1 Policy Updates

We may update this Privacy Policy from time to time to reflect:

• Changes to our services or features
• Changes in legal requirements or regulations
• Improvements to our privacy practices
• Feedback from users or regulators

11.2 How We Notify You

When we make changes to this Privacy Policy:

• Material changes: We will notify you at least 30 days in advance via:
  • Email to your registered email address
  • Prominent notice in the Brainfo app
• Non-material changes: We will update the "Last Updated" date at the top of this policy

11.3 What Constitutes a Material Change

Material changes include:

• Adding new types of data collection
• Sharing data with new categories of third parties
• Using data for purposes not previously disclosed
• Reducing your rights or protections
• Changes to data retention periods

11.4 Your Choices After Changes

After we notify you of changes:

• Review: Review the updated Privacy Policy carefully
• Accept: Continued use of Brainfo constitutes acceptance of the new policy
• Object: If you don't agree with the changes:
  • You can delete your account before the changes take effect
  • You can export your data before deleting
  • Contact us with questions or concerns at [email protected]

11.5 Version History

• Current version: September 30, 2026
• Previous versions: Available upon request at [email protected]

Contact Information

12.1 General Inquiries

If you have questions about this Privacy Policy or our privacy practices:

Email: [email protected]
Subject Line: "Privacy Policy Inquiry"

We will respond to your inquiry within 7 business days.

12.2 Security Issues

To report a security vulnerability or concern:

Email: [email protected]
Subject Line: "Security Report"

12.3 Breach Notification

If a security incident creates a real risk of significant harm to you, we will notify you. Where the law requires it, we will also notify regulators, including under Canadian, EU, and UK rules.

Acknowledgment

By using Brainfo, you acknowledge that you have read and understood this Privacy Policy and agree to be bound by its terms.

Last Updated: September 30, 2026

If a translated version of this Privacy Policy differs from this English version, the English version prevails.