Privacy Policy

The short version

DueBrain is a memory for AI chats that lives in your own Google Drive. You save chats and decisions from ChatGPT, Claude, Gemini, and Grok, and you can continue that memory in any model, including through an MCP connector you connect.

Chat content, decision text, notes, and Drive file bytes are stored in your Google Drive. They are not stored on DueBrain servers. On our systems we keep the account record described below: your email, your plan, usage counts, encrypted tokens, and any encrypted model API keys you choose to add.

Google data and the drive.file scope

DueBrain asks Google for one OAuth scope: https://www.googleapis.com/auth/drive.file. That scope lets an app create files and access files it created, and files you explicitly open or share with the app. It does not grant access to the rest of your Google Drive.

In practice, DueBrain uses that scope to create and update the vault files it writes for you, such as chat files, notes, and decision indexes in a DueBrain folder in your Drive. DueBrain does not browse your Drive, does not list unrelated folders, and does not read files it did not create unless you explicitly open or share that file with DueBrain.

Google shares with us the account identity needed to sign you in (including your account email) and the tokens required to call Drive on your behalf. We do not receive your Google password.

Chat content stays in your Drive

Transcripts, decisions, notes, and the bytes of those Drive files stay in your Google account. DueBrain’s servers do not keep a copy of that content. When you search, export, or continue a thread, the service reads the file from your Drive at that moment, using your token, and does not retain the body afterward.

An MCP connector you authorize can ask DueBrain to read or write that same vault. The connector does not receive a copy we stored on our servers, because we do not store one. You choose which client to connect.

What we store

If you create an account, the account mirror may hold:

• Your account email address.
• Your plan: trial dates, subscription status, and the end of the current paid period.
• Usage counts, including how many saves you have made in the current period and a monthly summary-spend figure.
• Encrypted Google OAuth tokens, so we can call Drive with the drive.file scope until you disconnect.
• Optional encrypted API keys for a model provider (OpenAI, Anthropic, Google, or xAI), and only if you choose to store one. Keys are used for actions you request. They are not used to train models.

If you join the beta waitlist, we store the email address you submit, and the time we received it when the database records that. Waitlist emails are not chat content and are not Google user data.

We do not store chat bodies, decision text, transcripts, or Drive file bytes in that database. We do not sell personal information. The public marketing pages do not use third-party advertising cookies.

How we use information

We use the information above to:

• Create and sign in to your account.
• Write, read, search, and export the memory files in your Drive, at your request.
• Apply the plan you are on (a 14-day trial, then Pro at $5 a month) and the related usage limits.
• Serve an MCP connector you connect, using the same Drive files.
• Send beta-waitlist mail to the address you gave us.
• Protect the service, debug failures, and meet legal duties.

We do not use Google user data for advertising, for retargeting, or to decide creditworthiness or lending.

Google API Services User Data Policy and Limited Use

DueBrain’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.

In plain language, that means:

• We use Google user data only to provide or improve user-facing features that are prominent in DueBrain: saving, reading, searching, and exporting your memory files, and operating an MCP connector you connect.
• We transfer Google user data only when that is required to provide or improve those features, to secure the service, to comply with the law, or as part of a merger, acquisition, or sale of assets with notice to users. We do not sell it.
• Humans do not read Google user data unless you ask us to, we need to for security (such as investigating abuse), we are required to by law, or the data is aggregated and de-identified and used for internal operations.
• We do not use Google user data for advertising, and we do not allow others to use it for advertising.

When we share information

We share information only in these cases:

• With Google, when we call Drive or OAuth to do what you asked. Google’s own terms apply to data in your Drive.
• With the infrastructure that holds the account mirror (a hosted database such as Supabase, when it is configured). That store receives the account fields listed above, not your chat content.
• With a model provider, if you have stored an API key and you ask DueBrain to call that provider. The request is the one you initiated. We do not send your Drive files to a provider in the background.
• With an MCP client you choose to connect, for the vault operations that client requests.
• With a payment processor, if one is later connected, and only for subscription billing.
• If the law, a court, or a government request requires it, or to protect the rights and safety of people using the service.
• With a buyer of the business, if ownership of Entrehold LLC changes, under the same promises in this policy or a successor policy we post.

How long we keep it

Drive files remain in your Google Drive until you delete them. Ending a trial, canceling Pro, or disconnecting DueBrain does not delete those files.

We keep the account record for as long as your account is open. Encrypted tokens are kept so the Drive connection works, and are deleted or left unusable when you disconnect Google or when we delete the account. Optional API keys are kept until you remove them or we delete the account. Waitlist emails are kept until we finish the beta invitation or you ask us to delete them.

We may keep a narrow record after deletion when we must, for example a billing entry, a security log, or a legal hold. Those records are not your chat content.

Deleting your data

You can delete or disconnect your information in these ways:

• Delete the files in Google Drive. They are yours. Deleting them there removes the chats and decisions. DueBrain does not keep a separate copy to restore.
• Revoke DueBrain’s access in your Google Account at Google permissions (opens in a new tab). Revocation stops further Drive access. We then delete the stored tokens associated with that connection, or they stop working because Google has revoked them.
• Email dev@knowprism.co and ask us to delete your DueBrain account. We delete the account email, plan, usage counts, encrypted tokens, and encrypted API keys within 30 days, except for the narrow records described above. Tell us the email address on the account.
• Email dev@knowprism.co to remove a waitlist address.

Account deletion does not delete files that are still in your Drive. You delete those in Google Drive if you want them gone.

Security

OAuth tokens and optional model API keys are encrypted before they are stored. The service is served over HTTPS. When the account database is provisioned, account rows are limited to the signed-in user. No method of storage is perfect. Please use a Google account you control, and revoke access if you think a token has been exposed.

Children

DueBrain is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, email dev@knowprism.co and we will delete it.

Changes

If this policy changes, we will post the new version on this page and change the date above. If a change materially affects how we use Google user data, we will also ask for consent where Google’s policy or the law requires it.

Contact

Entrehold LLC
dev@knowprism.co

The related Terms of Service apply together with this policy.