How we handle your data

When you create an account we store your email and a bcrypt hash of your password (never the plaintext). We also store the IP address and browser user-agent of your signup and active sessions for security and abuse investigation.

Tasks, objectives, notebooks, and notes you create are stored in our PostgreSQL database scoped to your account. They are not shared with other users, indexed by search engines, or sold.

If you supply your own OpenAI API key in Settings, it is encrypted with AES-256-GCM using a server-side secret before being stored. The plaintext key is never written to disk, never sent to your browser, and never logged. When we use it to make an OpenAI call we decrypt it in memory and discard the plaintext immediately afterward.

When you use the AI brain-dump or prioritize features, the text and tasks you submit are sent to OpenAI's API for processing per their API data usage policy. Before sending, we apply regex-based redaction to remove obvious email addresses, phone numbers, credit-card-shaped digit runs, and OpenAI/Stripe-style API keys. This is best-effort, not cryptographic protection — do not paste sensitive personal, financial, or medical data into the app.

If you connect Google Calendar from Settings, we request a single scope: https://www.googleapis.com/auth/calendar.events. This lets us create, update, and delete events on calendars you already have access to — we don't read your existing calendar contents and we don't enumerate other calendars.

Google's OAuth refresh token is encrypted at rest with the same AES-256-GCM machinery used for OpenAI keys. The short-lived access token (~1 hour) is kept in plaintext so background syncs can run without re-entering consent. Disconnecting at any time revokes the token at Google, deletes every Calendar event we created on your behalf, and clears the stored credentials.

We only mirror tasks that have a due date. Completing or removing a task removes its mirror event. Events we create are tagged with source: "braindump.work" in Google's metadata so you can identify them.

We set a single HttpOnly cookie named bd_session after sign-in. It holds a signed JWT containing your user and session IDs (no email or personal data). It expires after 30 days and is marked Secure in production. We do not set advertising or analytics cookies.

If we have Sentry configured we send unhandled errors and performance traces (at 10% sampling) to Sentry. Sentry payloads do not include your password, OpenAI key, or note content.

Sign out clears your session cookie and marks the session row as revoked in our database. To delete your account and all associated data, email [email protected]. We'll confirm and permanently delete your row from users within 7 days — all your tasks, notes, notebooks, sessions, and encrypted secrets cascade-delete with it.

We'll update this page if we change anything material. The "Last updated" date at the top tracks the most recent change.