No tracking: no ads, no analytics, no fingerprinting, no data sharing.
Your data: plain markdown, exportable anytime as a zip of .md files.
Local vault: with the desktop app's local vault, your notes never leave your machine at all.
Encryption: any cloud folder can be created as end-to-end encrypted — the server then stores only ciphertext for its pages. See below for what that trades away.
What we collect (cloud vault)
Email address: account sign-in and folder invitations.
Name: what @assigned(name) matches in task lines, and what collaborators see on your cursor.
Password: stored as a secure bcrypt hash, never in plain text.
Your notes: the pages you write — this is the service. Stored as plain markdown in the operator's database, unless the folder is end-to-end encrypted, in which case only ciphertext is stored.
Sharing metadata: the share links and invitations you create, so they can work and be revoked.
Agent tokens: if you connect an agent (MCP), its token and a coarse last-used timestamp.
We collect no payment information: subscriptions are
processed entirely by Stripe through a payment link, and card details
never touch brainlog. See
Stripe's privacy policy.
What we don't collect
No analytics trackers (no Google Analytics, no Mixpanel, nothing)
No advertising IDs or device fingerprinting
No content scanning or data mining
No location tracking
No third-party cookies
We do not sell, rent, or share your data with anyone.
Encryption
In transit: all connections to a hosted brainlog use TLS.
Normal folders: notes are stored as plain markdown in the server's database. They are not end-to-end encrypted: the operator's server can technically read them, and server-side features (task views, search, share pages, live co-editing, the agent connection) depend on that.
Encrypted folders: a folder can be created as end-to-end encrypted. Its pages are encrypted in your browser (AES-GCM-256, key derived from a passphrase you choose); the server stores and relays only ciphertext, so the operator cannot read the content of those pages. Collaborators need the passphrase, which you share with them yourself — it is never sent to the server.
What stays visible in an encrypted folder: page titles, folder and section names, membership and sharing metadata, and timestamps. Only page content is encrypted in v1.
What an encrypted folder gives up: task/board/due views, full-text search inside pages, public share links, agent (MCP) access, and live co-editing — all of these require the server to read the content, and it can't.
No recovery: the passphrase never leaves your browser, so there is no reset. A lost passphrase means those notes are permanently unreadable — by you, by us, by anyone.
Want everything off the server? Use the desktop app's local vault: everything stays in a folder on your own machine, served only on 127.0.0.1, and nothing is sent to any server. Combine with your OS's disk encryption.
Sharing — what becomes visible to whom
Folder members can read and edit everything in that folder.
Share links make a page or section readable by anyone who has the URL, until the link expires or you revoke it.
Agent tokens let an AI tool act as you — it can read and write (never delete). Treat tokens like passwords; revoking one cuts access immediately.
Your rights (GDPR)
Access & portability: export any folder as a zip of standard .md files, anytime, from the app.
Rectification: edit your profile and content directly in the app.
Erasure: delete your folders and pages in the app; for full account deletion, contact the operator.
Cookies & local storage
Session cookie: keeps you signed in.
CSRF token: a security measure.
Browser local storage: your theme and sidebar preferences — stored in your browser, never sent to the server.