SecondBrain ("we", "our", or "the app") is an AI-powered note-taking assistant. Your privacy matters to us. This policy explains what data we collect, how we use it, and the choices you have.
1. Data We Collect
We collect only the data necessary to provide the app's features:
- Account information, your email address and display name, collected during sign-up via Google, Apple, or email and password authentication.
- User-generated content, the notes, folders, summaries, and calendar events you create within the app.
- Voice recordings, audio you record is processed in real time to create notes. Recordings are sent to Google Gemini for transcription and are not permanently stored on our servers.
- Timezone, used to correctly schedule calendar events.
- Advertising and usage identifiers, only if you agree to the App Tracking prompt on your device. In that case a small set of app events (such as install and app open) and your device advertising identifier are shared with Meta so we can measure whether our ads bring people to the app. If you decline the prompt, no advertising identifier is collected and no cross-app tracking takes place. Your notes, voice, and calendar are never part of this.
2. How We Use Your Data
- AI processing, your text and audio are sent to Google Gemini (paid API tier) to generate notes, summaries, and calendar events. Your content is processed in real time, is not used to train AI models, and is retained by Google only briefly for abuse and safety monitoring, per Google's paid API terms.
- Storage, your notes, folders, and calendar events are stored in a Supabase PostgreSQL database hosted in the European Union, isolated by user account via Row-Level Security (RLS).
- Authentication, we use Supabase Auth with Google OAuth and Apple Sign-In to securely manage your account.
- Advertising measurement, if you allow tracking, Meta's SDK reports coarse app events so we can tell which ads work. It never receives your notes, voice, or calendar.
3. Third-Party Services
We rely on the following services to operate the app:
- Google Gemini, AI processing of voice and text (paid API tier, no training on your data).
- Supabase, database, authentication, and backend functions, hosted in the EU.
- Google OAuth / Apple Sign-In, secure authentication.
- RevenueCat / Apple / Google Play, to manage subscriptions. They receive purchase data, never your notes.
- Meta, app-install ad attribution only, and only with your consent through the App Tracking prompt.
Each service processes data in accordance with its own privacy policy.
4. What We Never Do With Your Content
- We never use your notes, voice, or calendar for advertising.
- We never use your content to train AI models.
- We never sell your personal data.
- The only tracking we do is optional ad-performance measurement through Meta, which you control with the App Tracking prompt and which never touches your notes, voice, or calendar.
5. Data Security
All data is transmitted over HTTPS. Database access is enforced by Row-Level Security policies, meaning each user can only access their own data. Access tokens are stored hashed, and integration tokens can be revoked at any time. Authentication is managed securely by Supabase Auth.
6. Data Retention & Deletion
Your data is retained for as long as you maintain an active account. You may delete your entire account and all associated data at any time from within the app (Settings, then Delete Account). Deletion is immediate and irreversible across our live database. Encrypted operational backups roll off on a short schedule (days, not months), after which the data is permanently gone. You can request a full export of your data at any time by emailing us.
7. Children's Privacy
SecondBrain is not intended for children under the age of 13. We do not knowingly collect personal data from children.
8. Changes to This Policy
We may update this policy from time to time. Changes will be reflected on this page with an updated date. Continued use of the app constitutes acceptance of the revised policy.
9. Contact
If you have questions about this Privacy Policy, or wish to report a security issue, contact us at:
[email protected]






