# Privacy Policy Source: https://www.onsecondbrain.com/privacy Language: en Spanish version: https://www.onsecondbrain.com/privacy.es.md Last updated: October 16, 2026 --- This Policy explains how Second Brain (the "Service"), operated by Agustín Gandara, handles your information. By using the Service you agree to this Policy. ## 1. Information we collect - Account — your name and email, from sign-up or sign-in. - Content you create — notes, documents, tasks, canvases, files and recaps. - Connected-service data — only data from the third-party accounts you choose to connect (see section 3). - Technical data — the minimum usage and diagnostic information needed to operate the Service and detect incidents. - Billing — if you subscribe to a paid plan, the payment processor handles your payment details; we do not store your full card number. ## 2. How we use it To provide the Service, keep your account secure, and power the features and integrations you use. We do not sell your data and we do not use it for advertising. ## 3. Third-party integrations Integrations are optional. We only access a connected service after you explicitly authorize it, we use that data solely to provide the corresponding feature, and you can disconnect at any time, which revokes our access. - Google Calendar — Reads and writes calendar events to show them alongside your tasks and to create or update events when you schedule a task. - Microsoft / Outlook Calendar — The same two-way calendar sync. - Apple Calendar — iCal subscription: we read your events to show them inside your workspace, and you can subscribe to your Secondbrain tasks from Apple Calendar. - ClickUp — Reads and writes your tasks and lists to keep them in sync with the Service. - Jira — Reads and writes the issues of the projects you choose to sync, and reads the projects and epics of your Atlassian site to show them in the Service. - Notion — Reads the pages and databases you authorize in order to import them into your document tree. It is one-way and on demand: it never writes anything back to Notion. - MCP — External AI clients (Claude, ChatGPT, Gemini and others) can query and operate your workspace over the MCP protocol, only with the token you generate. ## 4. Google user data — Limited Use > **Google API Services User Data Policy** > > Second Brain's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to provide user-facing features, is not sold, is not used for advertising, and is not shared except as needed to provide the Service or to comply with the law. > > Second Brain does not use, retain, or transfer data obtained through Google Workspace APIs to develop, improve, or train generalized AI and/or ML models. > > This commitment covers every Google Workspace scope Second Brain requests and every AI feature in the Service: Workspace data is processed only to produce the result you asked for, is never included in training or fine-tuning datasets —neither ours nor a model provider's— and is never retained or transferred for that purpose. ## 5. AI features and model providers When you use an AI feature —task extraction, transcription, translation, screen comprehension, document generation or the assistant chat— the content needed for that operation is transmitted to model providers acting as processors, under our instructions. That content is used solely to return your result. It is not used to train generalized AI models. Data obtained through Google Workspace APIs is covered by the specific commitment in section 4: it is never used to develop, improve or train generalized AI or ML models. ## 6. Storage and sharing Data is stored with our infrastructure provider (Supabase). We use trusted processors only to operate the Service —for example hosting, file storage, email delivery and AI providers for content you choose to process— always acting on our instructions. If you share a document or a canvas, that content becomes visible to the people you authorized, with the permission you set. A workspace is never shared. We do not sell personal data. ## 7. Retention and deletion You can disconnect any integration at any time from the app, which immediately revokes access. You can delete your content in the app, and your whole account too. When you delete it, your content is removed from our systems immediately: nothing sits in a bin or waits out a period. Backups rotate separately and are fully purged within 90 days. We keep only what the law requires us to keep, such as billing records for purchases, and the access audit log, which contains none of your content. You can also revoke access directly from each provider, e.g. Google or Microsoft. ## 8. Your rights You can request access, rectification, portability or deletion of your personal data, and object to certain processing, by writing to hello@onsecondbrain.com. We respond within the timeframes set by applicable law. If you live in the European Union, the United Kingdom or another jurisdiction with equivalent rules, you can also lodge a complaint with your supervisory authority. ## 9. Cookies and local storage This site stores your language preference in the browser's local storage. The app uses local storage and technical cookies to keep you signed in and remember your preferences. We use Google Analytics to measure usage of the site and the app: which pages are visited and where people arrive from. It sets first-party cookies (_ga) used to tell visits apart, and we use them for nothing else. When you create an account, our server reports that sign-up to Google Analytics with your browser's identifier, never with your email. We use the Meta Pixel on this site to measure the campaigns we run on Facebook and Instagram. It sets advertising cookies (_fbp) and tells Meta which pages of this site you visit and which buttons you tap to sign up or download the app, which is cross-site tracking: if you have a Facebook or Instagram account, Meta can associate that visit with it. In addition, when you create an account from the site or from the desktop app, our server tells Meta that a sign-up happened (its Conversions API), to learn which campaign brought it: it sends your email and an internal identifier, both hashed with SHA-256 — Meta never receives them in clear text —, Meta's cookies if they exist, your IP address and your browser. Sign-ups from the iPhone or Android apps are not reported. It is the only processing we do for advertising purposes, and it never reaches your content or what you do inside the app. If you said no to measurement, or your browser sends Global Privacy Control, nothing is sent. In Google Analytics the two signals that would do the same — Google Signals and ad personalization — remain explicitly turned off: measuring usage and measuring campaigns are kept separate on purpose. Google Analytics and the Meta Pixel follow the same rule. If you are in the European Union, the European Economic Area or the United Kingdom, we ask you first: neither of them is loaded until you accept, and if you say no they are never loaded. To tell, we look at your device's time zone, not your IP address, and when in doubt we ask. Everywhere else both load when you open the site, and you can say no at any time from the "Cookies" link in the footer: they switch off on the spot and we delete the cookies they had already set. If your browser sends the Global Privacy Control signal, we treat it as a refusal of both, wherever you are. In the app, Google Analytics follows the same rule and is changed from Settings → Security. ## 10. Security We use industry-standard measures, including encryption in transit (HTTPS), access controls and authenticated APIs. No system is 100% secure, but we work to protect your information. ## 11. Children The Service is not directed to children under 13, and we do not knowingly collect their data. ## 12. Changes We may update this Policy; material changes are reflected in the "Last updated" date above. ## 13. Contact The data controller is Agustín Gandara, Argentina. Any privacy question: hello@onsecondbrain.com.