Privacy

Last updated 2026-05-18

What we collect

When you sign in with Google, we get your name, email, and profile image. When you connect a source (Gmail, Drive, Calendar, Granola, GitHub, Notion, LinkedIn, Obsidian, etc.) we hold an OAuth token and use it only to read the content you authorized — never to write, send, or modify on your behalf.

We pull content into a database (your private brain) and chunk + embed it so your agents can answer questions over it. We log every query you run so you can see your own history.

Where it lives

  • Postgres on Neon — your objects, embeddings, query history, and connection tokens
  • OpenAI— receives chunk text at embedding time. OpenAI's API terms state inputs to embedding models are not used for training.
  • Anthropic — receives retrieved chunks + your question at synthesis time. Anthropic does not train on API inputs by default.
  • Apify (LinkedIn extraction only) — receives a LinkedIn URL you paste; returns scraped profile data.
  • Resend — used to send shared-brain invite emails on your behalf.
  • Vercel + Cloudflare — host the web application and route requests.

Sharing

Your private brain is never queryable by anyone but you. To share, you explicitly create a shared brain and hand-pick which objects from your private brain are exposed to which audience members (matched by email). Audience members only see what you exposed.

When PII protection is enabled on a shared brain, retrieved chunks pass through a deterministic redactor that replaces emails, phone numbers, addresses, SSNs, and credit-card-shaped strings with class tokens ([email], [phone], etc.) before any audience member sees them.

Public brains and MCP-exposed brains are queryable by their declared audience — anyone for public, your buyer-agents' API keys for MCP.

Retention & deletion

Disconnect any source any time from /settings/sources — that revokes our token and stops future sync. Existing indexed content stays until you delete it (per-object remove from brains, or contact us for full account wipe).

What we don't do

  • We don't sell your data.
  • We don't train models on it.
  • We don't use it for advertising.
  • We don't share it with anyone you haven't explicitly added.

Questions