Privacy Policy

Effective date: April 4, 2026 · Last updated: April 4, 2026

1. Information We Collect

1.1 Information You Provide

• Account information: email address and password when you create an account.
• Captured content: web pages you save using our browser extension, including page titles, URLs, page content, and metadata (favicons, OpenGraph images, descriptions).
• Organizational data: brain names, folder structures, and tags you create.
• Payment information: billing details processed through our payment provider LemonSqueezy. We do not store your credit card number directly.
• Communications: information you provide when contacting us for support.

1.2 Information Collected Automatically

• Usage data: pages visited within the Service, features used, and interaction patterns.
• Device information: browser type, operating system, IP address, and device identifiers.
• Cookies and similar technologies: session cookies for authentication and analytics cookies (see Section 9).

1.3 Information from Third Parties

• Authentication providers: if you sign in via a third-party service, we receive your profile information from that provider.
• Analytics: we use PostHog to understand how users interact with the Service.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Process and store your captured web pages and organize them into brains.
• Generate AI-powered search results and chat responses using your saved content.
• Create vector embeddings of your content for semantic search functionality.
• Process payments and manage your subscription.
• Send you service-related communications (e.g., account verification, billing).
• Monitor and analyze usage trends to improve the Service.
• Detect, prevent, and address technical issues and security threats.

3. Legal Basis for Processing (EEA/UK Users)

If you are in the European Economic Area or United Kingdom, our legal bases for processing your personal data include:

• Contract performance: processing necessary to provide you with the Service.
• Legitimate interests: improving the Service, ensuring security, and preventing fraud.
• Consent: where you have given explicit consent (e.g., marketing communications).
• Legal obligation: compliance with applicable laws and regulations.

4. Sharing and Third Parties

We do not sell your personal information. We share data with third parties only in the following circumstances:

• Service providers: we use trusted third-party services to operate the Service:
  • Supabase — database hosting and authentication.
  • OpenRouter — AI/LLM processing for search and chat features. Your captured content may be sent to AI models to generate responses.
  • LemonSqueezy — payment processing and subscription management.
  • PostHog — product analytics (when enabled).
  • Sentry — error tracking and monitoring (when enabled).
• Shared brains: if you use our brain-sharing feature, other users you invite will have access to the content within that shared brain.
• Legal requirements: we may disclose information if required by law, regulation, or legal process.
• Business transfers: in connection with a merger, acquisition, or sale of assets.

5. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. We take appropriate safeguards to ensure your personal data remains protected in accordance with this Privacy Policy, including the use of Standard Contractual Clauses where required. [LEGAL REVIEW REQUIRED]

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Service. Captured content and memories are retained until you delete them or close your account. We use soft deletion — when you delete a memory, it is marked as deleted but may remain in our systems for a limited period before permanent removal.

After account closure, we may retain certain information as required by law or for legitimate business purposes (e.g., fraud prevention, dispute resolution). [LEGAL REVIEW REQUIRED]

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate personal data.
• Deletion: request deletion of your personal data.
• Portability: request a copy of your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.
• Restriction: request restriction of processing in certain circumstances.
• Withdraw consent: where processing is based on consent, you may withdraw it at any time.

California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, request deletion of your data, and opt out of the sale or sharing of your personal information. We do not sell or share your personal information as defined under the CCPA/CPRA.

To exercise any of these rights, please contact us at privacy@brainextension.ai.

8. AI Processing

BrainExtension.ai uses artificial intelligence to provide search and chat features. When you use AI search or chat, your captured content may be processed by third-party AI models (via OpenRouter) to generate responses. We generate vector embeddings of your content to enable semantic search. These embeddings are mathematical representations of your content and are stored alongside your data.

We do not use your personal content to train AI models. Your data is processed solely to provide you with the Service's features.

9. Cookies and Tracking Technologies

We use the following types of cookies:

• Essential cookies: required for authentication and core Service functionality.
• Analytics cookies: used by PostHog to understand usage patterns and improve the Service (when enabled).

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using the Service.

10. Security Measures

We implement appropriate technical and organizational measures to protect your personal data, including encrypted connections (HTTPS), Row Level Security for multi-tenant data isolation, rate limiting, and secure authentication via Supabase. However, no method of transmission over the Internet is 100% secure.

11. Children's Privacy

The Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information. [LEGAL REVIEW REQUIRED]

12. Contact Information

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.