The short version. SecondBrain stores your notes, tasks, voice captures and media in a private database. We don't sell your data, we don't show ads, and we never allow your content to be used to train AI models. You can export or delete everything at any time.
This summary is for convenience — the full policy below is what governs.
Contents
1. Who we are 2. Information we collect 3. How we use your information 4. How AI processing works 4A. Advertising, attribution, and your tracking choice 5. Who we share information with 6. How long we keep it 7. Your rights and choices 8. Deleting your account 9. Security 10. Children 11. International transfers 12. Changes to this policy 13. Contact us1. Who we are
SecondBrain ("SecondBrain", "we", "us") provides a personal knowledge and task management application for iPhone and web browsers (the "App" or "Service"). This policy explains what we collect, why we collect it, and what control you have over it.
The data controller responsible for your information is [YOUR LEGAL ENTITY NAME], [REGISTERED ADDRESS].
2. Information we collect
Information you give us
- Account information — your email address and authentication credentials. If you sign in with a third-party provider, we receive the basic profile information you approve.
- Content you capture — the core of the Service. This includes voice recordings, transcriptions, typed notes, tasks, journal entries, ideas, project details, contact and relationship notes, imported book highlights, photos and videos you upload, and inventory records you create.
- Settings and preferences — your domains, projects, routines, notification preferences, time zone, and goals.
- Support correspondence — messages you send us and their contents.
Information collected automatically
- Usage data — features used and actions taken, to fix bugs and improve the Service.
- Device and log data — device type, operating system version, app version, IP address, and crash diagnostics.
- Push notification tokens — if you enable notifications, so we can deliver briefings, reminders and confirmations.
- Install attribution and advertising identifiers — so we can understand which marketing campaigns bring people to the app. This includes your device's vendor identifier (IDFV), general device and country information, and a record of app installs, app opens, subscription purchases and a small number of in-app milestones (finishing sign-up, viewing the subscription screen). If — and only if — you grant permission through Apple's App Tracking Transparency prompt, this also includes your device's advertising identifier (IDFA). See section 4A.
What we do not collect
We do not collect precise location data, your device contact list, health data, or financial account data. We never send the contents of your captures — the text of a note, a voice transcript, a document, or anything you search for — to any analytics, attribution, or advertising provider. Those providers receive only the fact that an action happened, never what the action was about.
4A. Advertising, attribution, and your tracking choice
We advertise the app on third-party platforms. To know whether that advertising works, we use AppsFlyer Ltd. as our measurement provider. AppsFlyer records app installs, app opens, and the milestone events listed above, and reports to the advertising platform that referred you — currently TikTok For Business — that an install or subscription occurred.
What those platforms receive from us is limited to attribution and conversion signals: that an install, sign-up, subscription-screen view or purchase happened, the purchase amount and currency, and the campaign it came from. They never receive your captures, notes, transcripts, searches, briefs, or any content you create in the app. We have deliberately configured these integrations so that only events attributed to that platform's own advertising are shared — activity from people who found us organically is not reported to advertisers.
Your choice. On first use we show Apple's App Tracking Transparency prompt. If you select Ask App Not to Track, we do not collect or share your IDFA and no cross-app tracking takes place; measurement continues in a privacy-preserving, aggregated form using Apple's SKAdNetwork, which does not identify you. If you select Allow, your IDFA may be used to attribute your install to the advertisement you saw. You can change this at any time in Settings → Privacy & Security → Tracking on your device. Declining has no effect on any feature of the app.
We do not use your information to build advertising profiles about you, we do not run advertising inside the app, and we do not sell or share your personal information for cross-context behavioural advertising as those terms are defined under California law.
3. How we use your information
We use your information only to operate and improve the Service:
- To transcribe, classify, title, and file the content you capture
- To display your tasks, notes, projects, people, and media back to you
- To generate your daily briefing, streaks, reminders, and resurfaced highlights
- To send push notifications and service emails you have enabled
- To provide support and respond to your requests
- To maintain security, prevent abuse, and diagnose problems
- To comply with legal obligations
- To measure whether our advertising works, as described in section 4A
We do not sell your personal information, and we do not share it with data brokers. We do share limited install and purchase signals with the advertising platform that referred you, strictly for measuring our own campaigns — never your content, and never to build a profile of you. Section 4A explains exactly what is shared and how to opt out.
4. How AI processing works
To make capture effortless, content you capture is processed by artificial intelligence services:
- Speech-to-text. Voice captures are transcribed by Apple's speech recognition (the iOS Speech framework) — on your device whenever your hardware supports it. On some devices or languages, Apple may process recognition on Apple's servers under Apple's own iOS privacy terms. Your audio is never sent to Anthropic or any other third-party AI provider — only the finished text transcript is processed as described below.
- Classification and filing. The resulting text is sent to Anthropic, PBC, whose Claude models determine what the item is (task, note, idea, journal entry, or person), which project and domain it belongs to, an appropriate title, and any due date implied by your words. Claude is also used to generate your Daily Brief and to answer questions about your saved content.
Important: we use Anthropic's API under commercial terms that prohibit using your content to train their models, and Anthropic is contractually obligated to provide protection for your data equivalent to the protections described in this policy. Your captures are transmitted to Anthropic solely for processing, and the results are returned to your account — they are not published, shared with other users, retained by Anthropic beyond limited operational periods, or used to build features for anyone else. You can read Anthropic's commitments at anthropic.com/legal/commercial-terms.
AI output can be imperfect. When the system is not sufficiently confident about where an item belongs, it routes that item to a review inbox for you to confirm rather than filing it automatically.
Our current AI and infrastructure providers are listed in section 5.
5. Who we share information with
We share information only with service providers who help us operate the Service, and only to the extent needed. These providers are bound by contract to protect your information and may not use it for their own purposes.
- Cloud hosting and database — [e.g. Supabase, Railway], to store your account and content.
- Speech recognition — Apple's iOS Speech framework (on-device where supported); audio is not shared with any other provider.
- AI processing — Anthropic, PBC (Claude), which receives text transcripts and typed captures to understand, classify, and file them and to generate your briefs and answers.
- Push notifications and email — [e.g. OneSignal, Klaviyo].
- Subscription management — RevenueCat, Inc., which validates your App Store purchase and tells the app whether your subscription is active. Apple processes the payment itself; we never see your card details.
- Marketing measurement — AppsFlyer Ltd., which records installs, app opens and the milestone events listed in section 4A so we can tell which campaigns work.
- Advertising platforms — currently TikTok For Business, which receives confirmation that an install or subscription resulting from its own advertising took place, plus the purchase amount. No content, and no data about people who found us organically.
- Analytics and crash reporting — [e.g. Plausible, Sentry].
We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, or property of our users or the public. If we are ever involved in a merger or acquisition, we will notify you before your information becomes subject to a different privacy policy.
6. How long we keep it
- Your content is kept until you delete it or delete your account — this is a memory system, so retention is the point.
- Raw voice recordings are retained for [X DAYS] after transcription and then deleted. The transcription remains as part of your content.
- Account records are deleted within 30 days of account deletion.
- Logs and diagnostics are typically retained for up to 90 days.
- We may retain limited records longer where required for legal, tax, or fraud-prevention purposes.
7. Your rights and choices
Depending on where you live, you may have the right to:
- Access the personal information we hold about you
- Export your content in a portable format
- Correct inaccurate information
- Delete your content or your entire account
- Object to or restrict certain processing
- Withdraw consent where processing is based on consent
- Lodge a complaint with your local data protection authority
You can exercise most of these rights directly in the App. For anything else, email support@second-brain.app and we will respond within 30 days.
California residents: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not offer financial incentives in exchange for personal information. You will not be discriminated against for exercising your rights.
8. Deleting your account
You can delete your account and all associated content at any time from Settings → Account → Delete account inside the App, or by visiting our account deletion page.
Deletion removes your account record, captured content, media, and derived data from our production systems within 30 days. Encrypted backups are purged on our standard rotation, no later than [X DAYS].
9. Security
We protect your information using industry-standard measures, including encryption in transit (TLS), encryption at rest, access controls that limit staff access to production data, and regular dependency updates.
No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and any required regulators without undue delay.
10. Children
The Service is not directed to children under 13 (or the minimum age of digital consent in your country), and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.
11. International transfers
We operate in [COUNTRY] and use service providers that may process data in other countries, including the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for these transfers.
12. Changes to this policy
We may update this policy as the Service evolves. If we make material changes, we will notify you in the App or by email before they take effect, and we will update the "last updated" date above.
13. Contact us
Questions, requests, or complaints about privacy:
- Email: support@second-brain.app
- Support: second-brain.app/support
- Postal: [YOUR LEGAL ENTITY + REGISTERED ADDRESS]