SecondBrainBridge Privacy Policy

Last updated: July 15, 2026

SecondBrainBridge lets you use your Obsidian-style Markdown notes from AI assistants such as ChatGPT. It is built so that your notes live on your own Mac — the service relays requests, it does not host your notes.

Data we collect and why

• Account data: your email address, a salted, hashed password (scrypt), and your plan/subscription status (free or Pro). Used solely to operate your account and apply your plan. We never store plaintext passwords.
• Device pairing tokens: a signed token identifying the Mac agent you paired. Used to route your requests to your own device.
• Note content in transit: when your assistant requests a note operation — a search or read of the notes in the vault folder you choose, including their text, titles, passages, folder structure, and [[wikilinks]] — the request and its result pass through our relay queue. This content is transient: it is held in encrypted storage (Supabase Postgres, in our own project) with a time-to-live of 45–60 seconds and is not logged, indexed, or retained. We do not maintain any copy of your notes. (Demo/reviewer accounts use fictional sample notes stored server-side instead.)
• OAuth tokens: standard access/refresh tokens so your assistant can act on your behalf. Refresh tokens rotate on every use.

What we do NOT do

• No selling or sharing of personal data with third parties for their own purposes.
• No advertising, tracking, surveillance, or behavioral profiling.
• No storage of your notes at rest, and no access to anything outside the vault folder you choose — not Apple Notes, Reminders, Mail, Messages, Contacts, or files elsewhere on your Mac.
• No collection or storage of payment card data (Stripe handles card details for billing), health records, or government identifiers.

Data recipients (subprocessors)

Infrastructure and billing: Vercel (application hosting), Supabase (transient job queue & account records, Postgres), Resend (sends the one-time email-address verification message — receives only your email address, never note content), and Stripe (payment processor for the Pro subscription — receives your email address and payment details to process billing; we store only the resulting plan status and never see or store your card numbers). Your assistant provider (e.g., OpenAI) processes the content you exchange with it under its own privacy policy.

Plans & billing

SecondBrainBridge offers a free tier (with a daily cap on searches) and a paid Pro subscription ($8/month) that unlocks unlimited searches, the backlink graph, and note creation. Payments are handled by Stripe; we receive only your resulting plan status and never see or store your card numbers.

Retention

Note content in transit: ≤ 90 seconds (automatic expiry). Account records, plan status, and pairing tokens: until you delete your account. OAuth refresh tokens: 90 days or until revoked/rotated.

Your rights & deletion

Email us to access or delete your account data at any time. Unpairing your Mac (deleting ~/.second-brain-agent.json and stopping the agent) immediately severs all access to your notes, regardless of any tokens outstanding.

Security

All traffic is TLS-encrypted. Authentication uses HMAC-signed tokens with PKCE-protected OAuth flows. Write actions require explicit confirmation in your assistant before they execute.

Contact

Questions or requests: isaiahdupree33@gmail.com · Support