Privacy policy

We collect what we need to run the service: account info, usage telemetry, and the prompts you submit. We don't sell your data, and we don't train shared models on private project content.

What we collect

• Account details: email, name, avatar, and OAuth identifiers when you connect GitHub, Google, or another SSO provider.
• Usage logs: sessions, page views, agent turns, credit consumption, and errors. We use them to size capacity and price plans.
• Project files and chat messages: encrypted at rest and served from your region. Private projects are never used to train shared models.
• Billing details: handled by Stripe. We never see your full card number; we store the last four digits and a payment-method token.

How long we keep it

• Account data: until you delete the account, then 30 days for backups.
• Public projects: kept indefinitely while live; deleting removes them within 24h.
• Private projects: same as account data.
• Telemetry: rolled up after 90 days, raw events purged.

Subprocessors

• Anthropic: Claude model inference.
• OpenAI, Google AI, OpenRouter: alternative model providers when you opt in or use the Universal Key.
• Stripe: payments, subscription management.
• Vercel: hosting, sandboxes, deployments.
• GitHub: OAuth and repository sync (only when you connect).
• Resend: transactional email (signup, billing, reset links).

Your rights

You can export or delete your data at any time from account settings. EU and UK residents can request a full export under GDPR / UK-GDPR by emailing privacy@braincell.sh.

Children

braincell is not intended for users under 16. If you believe a minor has created an account, email privacy@braincell.sh and we will remove the account within 7 days.

Changes

Material changes get a 30-day notice via email and an in-product banner. The full revision history lives in our GitHub mirror.

Contact

Data protection officer: privacy@braincell.sh. For security disclosures: security@braincell.sh.