Privacy

The short version

We collect the least we can get away with: an email address so you have an account, a phone number if you want to text things in, and whatever you put on your board. We do not sell it, we do not share it for advertising, and there are no trackers on this website at all. Card details never touch our servers — Stripe handles those.

The rest of this page is the detail behind that paragraph.

Who we are

BrainSack is operated by RW Business Solutions LLC. For anything on this page, including a request to see or delete your data, email [email protected] or write to Chapin, South Carolina.

What we collect

Your account

• Email address. It identifies your account and it is where password resets and confirmation links go.
• A password, or a Google sign-in. Passwords are stored only as a salted hash — we cannot read yours, and neither can anyone who steals the database. If you sign in with Google we store the identifier Google gives us for you, never your Google password.
• A display name, if you set one.

Your phone number, if you give us one

Texting things in only works if we know which number is yours, so a number you register is stored against your account and used to route your messages to your board. It is not used for marketing and we do not text you unprompted.

What you put on your board

Notes, checklists, links, tags and any files you attach. This is your content. We store it so we can show it back to you; we do not read it, mine it, or train anything on it.

Encrypted notes are handled differently. The body of an encrypted note is encrypted with a key belonging to your account, which is itself wrapped by Azure Key Vault. It is left out when your board loads and left out when you search, and is decrypted only at the moment you open that one note. Be clear about what this is and is not: it protects the note if our database is exposed. It is not end-to-end encryption — the key is held in our infrastructure, so it does not protect against us, and we could in principle be compelled by a lawful order to decrypt. If you need a secret that nobody can be compelled to reveal, this is the wrong place to keep it.

Text messages you send in

The content of a message you text in becomes an item on your board, exactly as if you had typed it. Separately we keep a short record of each inbound message — the carrier’s message ID, when it arrived and what we did with it — so that a message the network delivers twice does not land on your board twice. That record never contains the message body, and it is deleted automatically after 30 days.

Billing

Stripe processes payments. We never see or store your card number — it goes from your browser to Stripe and not through us. What we store is Stripe’s identifier for your customer and subscription, whether that subscription is active, and when the current period ends. We also keep a record of each billing event Stripe sends us for 90 days, so that a question about a charge months later can still be answered.

Logs

Our servers keep ordinary operational logs — timestamps, error traces, which requests were served. These exist to keep the thing running and are not used to build a profile of you.

This website

The page you are reading sets no cookies, runs no analytics, and loads nothing from a third party. Nothing about your visit here is recorded beyond the standard server logs of our host.

Who else sees it

We do not sell your data and we do not share it for advertising. We use a small number of service providers to make the product work, and each one sees only what it needs to:

• Microsoft Azure — hosting, databases and file storage. Your board lives here.
• Stripe — payments and subscriptions. Sees your card details and your email address; never sees your board.
• Twilio — sending and receiving text messages, and delivering account emails such as password resets. Sees your phone number, your email address, and the content of messages you text in.
• Google — only if you choose to sign in with Google, and only to confirm that the account is yours.

We will also disclose data where we are legally required to. If that happens and we are permitted to tell you, we will.

Share links

If you share a note or a checklist you get a link that shows that one item, read-only, and stops working after 24 hours. Anyone holding the link can see that item while it is live, so treat it as public for that window. Encrypted notes and files cannot be shared this way at all.

How long we keep it

• Your board — for as long as your account exists. Cancelling does not delete it: if you come back later it is all still there.
• Inbound message records — 30 days, then deleted automatically.
• Billing event records — 90 days, then deleted automatically.
• All of it — deleted on request. See below.

Your choices

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and everything on it. Depending on where you live you may have these rights by law; we will honour the requests either way.

Deletion is currently a manual process rather than a button in the app — email [email protected] from the address on the account and we will do it. We aim to complete requests within 30 days. Records we are required to keep for accounting purposes will survive the deletion of your board; the automatic expiries above apply to the rest.

Security

Traffic is encrypted in transit with TLS, data is encrypted at rest by our hosting provider, passwords are hashed, and encrypted notes get the additional treatment described above. No system is perfect and anyone claiming otherwise is selling something — but if we ever discover a breach affecting your data, we will tell you.

Children

BrainSack is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us information, email us and we will remove it.

Where your data lives

Our infrastructure and our providers are based in the United States, so that is where your data is stored and processed. If you are using BrainSack from elsewhere, that is where it is going.

Changes

If we change this policy in a way that matters, we will email the address on your account before it takes effect. The date at the top of this page always reflects the current version.

See also the Terms of Service.