Privacy Policy
Last updated: June 2026
The short version
- Your data is yours. We never sell it. We never share it with advertisers.
- Sensitive data (health, finance, journals) is stored in a database with row-level security so no other user can read it.
- You can export everything as CSV at any time.
- Delete your account and we delete your data within 30 days.
What we collect
The data you enter — classes, tasks, notes, finances, health logs, journal entries, etc. — plus an email and (optionally) a display name. We also log standard request metadata (timestamps, anonymized IPs) for security and abuse prevention.
How we use it
To run BrainBoard for you: render your dashboard, send reminders you opted into, and power AI features when you trigger them. AI requests are sent to our AI gateway provider and processed only for that request — they are not used to train models.
Who can see your data
- You — always.
- Other users — only if you explicitly share something (e.g. a study group). Otherwise, never.
- Us — a small number of engineers may access encrypted backups for recovery or debugging only with your permission.
- Sub-processors — hosting (Cloudflare), database (Supabase / Postgres), payments (Paddle), AI inference (Lovable AI Gateway). Each is bound by contract.
Your rights
You can export, correct, or delete your data at any time from Settings. We respond to verified requests within 30 days. For users in the EU/UK, this includes your rights under GDPR; for California users, your CCPA rights.
Children
BrainBoard is intended for users 13 and older. If a school deploys BrainBoard for younger students, it does so under a separate institutional agreement.
Contact
Questions? Email privacy@brainboardstudio.org.