Privacy Policy

Last updated: July 8, 2026

This Privacy Policy explains how Second Brain (the "Service") handles your information. By using the Service you agree to this policy.

1. Information we collect

Account — your name and email, from sign‑in.
Content you create — notes, documents, tasks, canvases and recaps.
Connected‑service data — only data from third‑party accounts you choose to connect (see section 3).

2. How we use it

To provide the Service, keep your account secure, and power the features and integrations you use. We do not sell your data and we do not use it for advertising.

3. Third‑party integrations

Integrations are optional. We only access a connected service after you explicitly authorize it, we use that data solely to provide the corresponding feature, and you can disconnect at any time, which revokes our access.

Google Calendar — read and write calendar events to show them alongside your tasks and to create/update events you schedule in the app.
Microsoft / Outlook Calendar — read and write calendar events for the same two‑way calendar sync, via Microsoft Graph.
ClickUp — read and write your tasks and lists to keep them in sync with the Service.
Notion — access the pages and content you authorize, to import and sync them.

4. Google user data — Limited Use

Second Brain's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide user‑facing features, is not sold, is not used for advertising, and is not shared except as needed to provide the Service or to comply with the law.

Second Brain does not use, retain, or transfer data obtained through Google Workspace APIs to develop, improve, or train generalized AI and/or ML models.

5. Storage & sharing

Data is stored on our infrastructure provider (Supabase). We use trusted processors only to operate the Service (e.g. hosting and AI providers for content you choose to process), acting on our instructions. We do not sell personal data.

6. Retention & deletion

You can disconnect any integration at any time from the app, which immediately revokes access. You can delete your content in the app, and request full account deletion (removed within 30 days). You can also revoke access directly from each provider, e.g. Google or Microsoft.

7. Security

We use industry‑standard measures, including encryption in transit (HTTPS), access controls and authenticated APIs. No system is 100% secure, but we work to protect your information.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect their data.

9. Changes

We may update this policy; material changes are reflected by the "Last updated" date above.