Privacy policy

[publisher, see the legal notice]. For any question or to exercise your rights: [dedicated data protection email address].

• Your account (email, first name, hashed password, time zone, language): to give you access to the service. Legal basis: the contract.
• Your memory (notes, files, voice notes and their transcription, the entries and links Sidebrain draws from them, conversations with the assistant, reminders): this is the service itself. Legal basis: the contract.
• Your location, only if you share it: to work out when you need to leave. Only the latest one is kept, and you can erase it at any time in the Settings. Legal basis: your consent.
• Notifications, if you turn them on: the subscription identifier of your browser or phone. Legal basis: your consent.
• The microphone is only open while you record a voice note.
• Google, if you turn a service on: Calendar (read your events, create one after you confirm), Gmail (write drafts and send after you confirm, never reading your email), Drive (only the files you pick). Legal basis: your consent, revocable in the Settings.
• External services (MCP) you connect: their address and access tokens, encrypted. Legal basis: your consent.
• Technical logs (errors, timings, usage per account), with pseudonymous identifiers and without the content of your notes: for security and reliability. Legal basis: legitimate interest.

No one reads your memory. Technical providers process it on Sidebrain's behalf:

• OVHcloud (France): servers, database, files and backups, inside the European Union. Voice notes are transcribed by its AI Endpoints service.
• Google Cloud, Vertex AI (European Union multi-region): computing the numerical representations of your notes used for search.
• OpenRouter (United States) and the AI model provider it calls: the assistant's answers and the extraction of entries. Requests are sent with the requirement that the provider does not retain them. This transfer outside the European Union is covered by [transfer safeguards: standard contractual clauses, to be confirmed with OpenRouter].
• Sending emails: [email provider and country].
• Error tracking: Sentry, [hosting region], without personal data.

Services you connect yourself (Google, MCP servers) receive what you ask Sidebrain to send them, under their own terms.

Sidebrain's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Your memory and your account: as long as your account exists. A note you delete goes with its original file.
• When you delete your account: everything is erased right away, files included; encrypted backups are erased within 30 days.
• Your location: only the latest, replaced each time it is sent.
• The export archive of your data: 7 days, then erased.
• Logs of background jobs: 7 days.

At any time you can access your data and take it with you (Settings → export my data), correct it (directly on the entries), erase it (a single note, or your whole account in the Settings), withdraw a consent (location, notifications, Google, external services), object to or restrict a processing by writing to [dedicated data protection email address]. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

Encrypted connections, encrypted disks and storage, data isolated account by account down to the database, tokens of connected services encrypted separately. Sidebrain never acts outside (email, event, external service) without your confirmation, except with the reading tools you yourself exempted from it.

One cookie only, strictly necessary: the one that keeps you signed in. No analytics or advertising cookies, so no banner to accept.