Privacy policy

We collect what we need to run the service: account info, usage telemetry, and the prompts you submit. We don't sell your data, and we don't train shared models on private project content.

What we collect

• Account details: email, name, avatar, and OAuth identifiers when you connect GitHub.
• Usage logs: sessions, page views, agent turns, credit consumption, and errors. We use them to size capacity and price plans.
• Project files and chat messages: stored in our Postgres database. Private projects are never used to train shared models.
• Billing details: handled by Stripe. We never see your full card number; we store the last four digits and a payment-method token.

How long we keep it

• Account data: until you delete the account, then 30 days for backups.
• Public projects: kept indefinitely while live; deleting removes them within 24h.
• Private projects: same as account data.
• Telemetry: rolled up after 90 days, raw events purged.

Subprocessors

• Anthropic: Claude model inference.
• OpenRouter: routing to alternative model providers (OpenAI, Google, and others) when you pick a non-Claude model or use the Universal Key.
• Stripe: payments, subscription management.
• Cloudflare R2: project version history and asset storage.
• GitHub: OAuth and repository sync (only when you connect).
• Resend: transactional email (password reset links).

The app, database, and sandbox hosts run on servers we operate ourselves. Email privacy@braincell.sh for the current hosting providers and full subprocessor list.

Cookies

We use cookies only to keep you signed in: one Better-Auth session cookie (named braincell.session_token) and its short-lived cache companion. There is no advertising, analytics, or fingerprinting cookie on the site, so EU and UK visitors do not see a consent banner - essential cookies do not require one. If we add analytics later we will ship an opt-in banner first and update this section.

Your rights

You can export your projects (as working zip archives) and your full activity history (as CSV) from the app at any time. To delete your account and data, email privacy@braincell.sh - we complete deletions within 30 days. EU and UK residents can request a full GDPR / UK-GDPR export the same way. In-app account deletion is coming.

Children

braincell is not intended for users under 16. If you believe a minor has created an account, email privacy@braincell.sh and we will remove the account within 7 days.

Changes

Material changes get a 30-day notice via email and an in-product banner. Previous versions are available on request via privacy@braincell.sh.

Contact

Data protection officer: privacy@braincell.sh. For security disclosures: security@braincell.sh.