# Privacy Policy Source: https://www.secondbrain.media/privacy Language: en Spanish version: https://www.secondbrain.media/privacy.es.md Last updated: August 28, 2026 --- This Policy explains how Second Brain (the "Service"), operated by Agustín Gandara, handles your information. By using the Service you agree to this Policy. ## 1. Information we collect - Account — your name and email, from sign-up or sign-in. - Content you create — notes, documents, tasks, canvases, files and recaps. - Connected-service data — only data from the third-party accounts you choose to connect (see section 3). - Technical data — the minimum usage and diagnostic information needed to operate the Service and detect incidents. - Billing — if you subscribe to a paid plan, the payment processor handles your payment details; we do not store your full card number. ## 2. How we use it To provide the Service, keep your account secure, and power the features and integrations you use. We do not sell your data and we do not use it for advertising. ## 3. Third-party integrations Integrations are optional. We only access a connected service after you explicitly authorize it, we use that data solely to provide the corresponding feature, and you can disconnect at any time, which revokes our access. - Google Calendar — Reads and writes calendar events to show them alongside your tasks and to create or update events when you schedule a task. - Microsoft / Outlook Calendar — The same two-way calendar sync, via Microsoft Graph. - Apple Calendar — iCal subscription: we read your events to show them inside your workspace, and you can subscribe to your Secondbrain tasks from Apple Calendar. - ClickUp — Reads and writes your tasks and lists to keep them in sync with the Service. - Slack — Reads the messages and commands you send the bot, and writes to the channel or direct message you choose to post the digest and its replies. It identifies your Slack user to link it to your account. - Notion — Reads the pages and databases you authorize in order to import them into your document tree. It is one-way and on demand: it never writes anything back to Notion. - MCP — External AI clients (Claude, ChatGPT and others) can query and operate your workspace over the MCP protocol, only with the token you generate. ## 4. Google user data — Limited Use > **Google API Services User Data Policy** > > Second Brain's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide user-facing features, is not sold, is not used for advertising, and is not shared except as needed to provide the Service or to comply with the law. > > Second Brain does not use, retain, or transfer data obtained through Google Workspace APIs to develop, improve, or train generalized AI and/or ML models. > > This commitment covers every Google Workspace scope Second Brain requests and every AI feature in the Service: Workspace data is processed only to produce the result you asked for, is never included in training or fine-tuning datasets —neither ours nor a model provider's— and is never retained or transferred for that purpose. ## 5. AI features and model providers When you use an AI feature —task extraction, transcription, translation, screen comprehension, document generation or the assistant chat— the content needed for that operation is transmitted to model providers acting as processors, under our instructions. That content is used solely to return your result. It is not used to train generalized AI models. Data obtained through Google Workspace APIs is covered by the specific commitment in section 4: it is never used to develop, improve or train generalized AI or ML models. ## 6. Storage and sharing Data is stored with our infrastructure provider (Supabase). We use trusted processors only to operate the Service —for example hosting, file storage, email delivery and AI providers for content you choose to process— always acting on our instructions. If you share a document or a canvas, that content becomes visible to the people you authorized, with the permission you set. A workspace is never shared. We do not sell personal data. ## 7. Retention and deletion You can disconnect any integration at any time from the app, which immediately revokes access. You can delete your content in the app, and your whole account too. When you delete it, your content is removed from our systems immediately: nothing sits in a bin or waits out a period. Backups rotate separately and are fully purged within 90 days. We keep only what the law requires us to keep, such as billing records for purchases, and the access audit log, which contains none of your content. You can also revoke access directly from each provider, e.g. Google or Microsoft. ## 8. Your rights You can request access, rectification, portability or deletion of your personal data, and object to certain processing, by writing to hello@secondbrain.media. We respond within the timeframes set by applicable law. If you live in the European Union, the United Kingdom or another jurisdiction with equivalent rules, you can also lodge a complaint with your supervisory authority. ## 9. Cookies and local storage This site stores your language preference in the browser's local storage. The app uses local storage and technical cookies to keep you signed in and remember your preferences. We use Google Analytics to measure usage of the site and the app: which pages are visited and where people arrive from. It sets first-party cookies (_ga) used to tell visits apart, and we use them for nothing else. We do not use advertising or cross-site tracking cookies. The two Google signals that would do that — Google Signals and ad personalization — are explicitly turned off in our configuration. We ask you first, wherever you are: nothing from Google is loaded until you accept, and if you say no it is never loaded. Nothing loads while you have not answered either. If your browser sends the Global Privacy Control signal, we treat it as a refusal and do not even ask. You can change your mind at any time from the "Cookies" link in this site's footer, and in the app from Settings → Security. ## 10. Security We use industry-standard measures, including encryption in transit (HTTPS), access controls and authenticated APIs. No system is 100% secure, but we work to protect your information. ## 11. Children The Service is not directed to children under 13, and we do not knowingly collect their data. ## 12. Changes We may update this Policy; material changes are reflected in the "Last updated" date above. ## 13. Contact The data controller is Agustín Gandara, Argentina. Any privacy question: hello@secondbrain.media.