Privacy Policy

Second Brain ("the app") is a personal voice and text journal. This policy explains what data we collect, how it is used, and how it is protected.

Data we collect

• Account info: your Google name, email address, and profile picture, obtained when you sign in with Google.
• Journal content: the text and voice recordings you enter into the app, along with summaries, to-do items, and calendar events extracted from them.
• Google Calendar data: with your permission, using Google's https://www.googleapis.com/auth/calendar.events.owned scope, we send the title, date, time, recurrence, and optional description needed to create a new event on your primary Google Calendar. The app does not read, update, or delete your existing Google Calendar events.

How we use your data

Your journal entries are stored in the app's server-side database so they can sync across your devices. Voice recordings are accepted in temporary server memory for transcription and are not saved as a permanent audio file by the app. Journal text may be sent to an AI service to generate summaries, clean up transcription, extract to-do items, and detect calendar events — this is done solely to provide the feature you requested, not for advertising.

Google Calendar access is used only to create new events that you request on your primary calendar. Although Google's calendar.events.owned permission can support broader event access, Second Brain's implementation uses it only for event creation. Second Brain does not load your existing Google Calendar events and does not update or delete events after they are created. You manage those events directly in Google Calendar.

Google Workspace data and AI/ML

Second Brain does not use, retain, or transfer Google Workspace API data to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models. The calendar.events.owned permission is used only to create a new event in the user's primary calendar at the user's request. Journal text that a user enters directly into Second Brain may be processed by an AI service for that user's requested transcription, cleanup, summary, search, task-extraction, or calendar-extraction feature; this journal text is not obtained from Google Workspace APIs.

How we protect sensitive data

• Encrypted transmission: the app communicates with our API and Google over HTTPS/TLS. Authorization headers and tokens are not included in normal request logging.
• Authenticated access: journal, task, search, and Calendar API routes require an authenticated bearer token. After Google sign-in, the server issues a signed session token that expires after 30 days; Google access tokens are checked for expiry before Calendar use.
• Per-account isolation: authenticated requests are associated with one account, and journal, task, and summary queries are filtered to that account. One user cannot use the app's normal API to request another user's journal records.
• Limited processing: voice audio is held in temporary memory for transcription, and journal text is sent to AI processing only when needed for transcription, cleanup, summaries, search answers, or extraction features.
• Credential handling: Google access is used only for the Google profile and Calendar capabilities the user authorizes. Signing out removes the app's locally stored session and Google credentials; Google access can also be revoked from the user's Google Account permissions.

Second Brain does not claim end-to-end encryption. Access to stored data is controlled by account authentication and server-side authorization, and the app does not sell journal content, Calendar data, or account information.

Data sharing

We do not sell your data. We do not share your journal content, calendar data, or account information with third parties, except with service providers (such as our AI processing, database, and cloud hosting providers) strictly to operate the app's features, and only to the extent necessary.

Data retention & deletion

Your journal entries, summaries, to-dos, and account data are retained until you delete them or ask us to delete your account. Contact us using the details below to request deletion of your data. Account deletion requests are processed within 30 days as described on the account deletion page.

Google API Services User Data Policy

Second Brain's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Contact

Questions about this policy? Contact us at adriancheok@gmail.com.