Privacy Notice
Second Brain is designed around personal context. This notice explains what the invitation-only beta processes, why, where it may go, how long it is kept, and how to exercise your rights.
1. Controller and contact
Nicholas Hoff, operating Second Brain, is the controller for the personal data described here. Contact nick@nicholashoff.com for privacy questions or requests.
2. Data we process
- Account and access: identity, verified email, account and session identifiers, invitation/access status, and device registrations.
- Conversation and voice: typed messages, final voice transcripts, assistant responses, and instructions exchanged between agent components. Audio is sent to the speech/model provider for live processing; Second Brain does not intentionally store raw Realtime audio.
- Memory and knowledge: profiles, memories, summaries, plans, supplements, knowledge-base text, and files you deliberately upload.
- Computer-control data: tool requests and results, app/window context, and screenshots captured to understand or verify a task.
- Operational data: timestamps, event names, model and tool categories, counts, token usage, coarse success/failure status, error classes, security records, and support correspondence. Operational analytics excludes free-form prompts, transcripts, tool arguments/results, file paths, email bodies, and raw provider events.
Content may incidentally include information about other people. Do not provide data you lack authority to use. The beta is not intended for deliberate processing of health, biometric-identification, political, religious, sexual-life, trade-union, criminal-offence, or similarly specially protected data.
3. Sources
We receive data from you, your authorized devices, Clerk identity services, connected apps or websites you direct the agent to use, and the service providers that return model, extraction, hosting, or delivery results.
4. Purposes and legal bases
- Provide the requested beta service—including authentication, conversation, memory, uploads, voice, and computer-control actions—because it is necessary to perform our agreement with you.
- Operate, secure, troubleshoot, and improve reliability based on our legitimate interests in running a safe and functional private beta, balanced against your rights. Telemetry is minimized for this purpose.
- Comply with law and protect legal rights where processing is necessary for a legal obligation or the establishment, exercise, or defense of legal claims.
- Optional feedback or communications on the basis of consent where consent is requested; you may withdraw it at any time.
Second Brain is not intended to make solely automated decisions that produce legal or similarly significant effects about you.
5. Recipients and processors
We disclose data only as needed to provide and protect the beta, follow your directions, or comply with law. Important service providers currently include:
- Clerk for identity, sessions, and account emails.
- Vercel for website and backend hosting.
- PlanetScale for managed PostgreSQL database hosting.
- Amazon Web Services for object storage, releases, and WebSocket infrastructure.
- OpenAI for language, vision, embeddings, transcription, and Realtime voice.
- Unstructured for extraction of supported deliberately uploaded documents.
We do not sell personal data or use it for targeted advertising.
6. International transfers
Providers may process data in the United States and other countries outside the EEA, United Kingdom, or Switzerland. Where required, we rely on adequacy decisions, the European Commission’s Standard Contractual Clauses, the UK addendum, and provider contractual and technical safeguards. You may request information about applicable safeguards by email.
7. Retention
- Chats, memories, profiles, summaries, supplements, deliberate uploads, knowledge, and other core account data: while the account is active or until you request deletion, subject to narrow legal/security exceptions.
- Screenshots and their metadata: no more than 30 days.
- Operational logs, analytics events, and analytics spans: no more than 90 days.
- Backups: a rolling period of no more than 90 days.
During the private beta these limits may be enforced manually rather than by an automated deletion job. If data reaches the applicable limit, we will use the internal deletion procedure. Processor copies may remain briefly under their documented security and backup schedules.
8. Security
Measures include authenticated accounts, device/session binding, scoped product access, encrypted transport, platform credential storage, restricted internal dashboards, minimized operational telemetry, and access-controlled cloud storage. No system is completely secure, especially an experimental agent with broad device permissions.
9. Your choices and rights
Depending on applicable law, you may request access, a copy, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing and may complain to the data-protection authority where you live or work.
Email nick@nicholashoff.com from the verified address on your account. We may request proportionate identity verification. We aim to respond without undue delay and, where GDPR applies, within one month unless a lawful extension applies.
10. Cookies and local storage
The website currently uses only authentication, security, and service-delivery storage needed for requested functionality. We do not currently use advertising or nonessential analytics cookies, so no optional-cookie consent banner is shown. This notice will be updated and consent requested before nonessential cookies are introduced where required.
11. Children
The beta is for adults and is not directed to anyone under 18. Contact us if you believe a child has provided personal data.
12. Changes
We will post an updated effective date and give appropriate notice. Material changes to data use or user rights require renewed express acceptance before continued beta use.