Privacy Policy - Second Brain

1. Who we are

Second Brain (the website at secondbrain.ltd and the Second Brain mobile apps) is operated by Gianlucca Vick, an individual based in São Paulo/SP, Brazil. In this policy, "we", "us" and "our" mean the operator of Second Brain.

We are the controller of your personal data under Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, LGPD, Law 13,709/2018). Gianlucca Vick is also the person in charge of data protection (encarregado). You can reach us about anything in this policy at gian@secondbrain.ltd.

2. What we collect

Information you give us

Account details: your email address, your password and your birthday. Your password is stored only as a one-way hash, so nobody, including us, can read it. We ask for your birthday to confirm that you meet the minimum age.
Your content: the notes, folders, tasks, projects, daily notes, habits, events and other text you write in Second Brain.
Your settings: which parts of the app you have turned on or off.
Messages you send us: if you email us, we keep the conversation so we can help you.

Information collected automatically

Server logs: when your browser or the app talks to our servers, they record your IP address, the address requested, the time, the response, and your browser or device type.
Time zone: your device's time zone, so dates like "today's daily note" match your day.
Security counters: short-lived counters linked to your IP address or account that limit how often actions like logging in can be tried.
Error reports: when something breaks, a report with the error, the page or screen, your browser or device type and your account's internal ID (not your email). Reports are cleaned of passwords, login tokens and email addresses before they leave our servers, and your IP address is not stored with them. Performance information is also recorded for a sample of about 1 in 10 requests.

What we don't collect

Second Brain has no advertising, no analytics or tracking tools, and no social media trackers. We don't collect your location, your contacts or payment details, and we never sell your data.

3. How we use it, and why we're allowed to

The LGPD requires a legal basis for each use of personal data. Ours are:

To provide Second Brain (to run the contract between us, LGPD art. 7, V): creating and securing your account, storing and showing your content, checking the minimum age, and sending the emails the service needs, such as verifying your address and resetting your password.
To keep Second Brain secure and working (our legitimate interest, art. 7, IX): server logs, security counters and error reports, used to prevent abuse, investigate problems and fix bugs.
To meet legal obligations and exercise our rights (art. 7, II and VI): for example, answering a valid order from a court or authority.

We don't send marketing emails, and we don't use your content for advertising, profiling or anything other than providing the service to you.

4. Who else handles your data

We use a few service providers to run Second Brain. They process data only on our behalf and under their own data protection terms:

DigitalOcean: hosts our servers and database, in New York, USA.
Backblaze: stores our encrypted nightly backups, in the western USA.
GoDaddy (Titan email): sends our account emails (verification and password reset) and receives the emails you send us.
Sentry (Functional Software, Inc., USA): receives the error reports described above.

If you download the mobile app, Apple or Google also process data under their own privacy policies. Apart from these providers, we only share personal data when the law requires it.

5. Data stored outside Brazil

Our servers, backups and error reports are in the United States, so your data is transferred outside Brazil. We only use providers that commit to protecting it, and these transfers are needed to provide the service you ask for (LGPD art. 33).

6. How long we keep it

Your account and content: until you delete them or delete your account.
Notes in the trash: deleted permanently 7 days after you move them there.
Accounts never verified: deleted automatically after 7 days.
After you delete your account: it and all its content are removed from our database right away. Copies remain in our encrypted backups for up to about 30 days, until those backups expire and are deleted.
Server logs: kept in size-limited files that are overwritten automatically.
Error reports: kept by Sentry for up to 90 days.

7. How we protect it

All connections to Second Brain use HTTPS.
Passwords are stored only as one-way hashes.
Backups are encrypted before they leave our server.
Server access is restricted to the operator, with key-based logins, a firewall and regular security updates.
Every account can only see its own data.

Your content is not end-to-end encrypted: it is stored on our server as you wrote it, so it is technically accessible to the operator. We only access it when needed to keep the service running, to fix a problem you report, or when the law requires it.

8. Cookies and storage on your device

We don't use advertising or tracking cookies. On the website we store:

Two login cookies (access_token and refresh_token) that keep you signed in. They are required for the service to work and expire after 1 and 90 days.
Your display preferences (light or dark theme, line numbers in notes) in your browser's local storage.

The mobile app stores your login tokens and email address on your device, so you stay signed in. Signing out removes them.

9. Your rights

Under the LGPD (art. 18) you can ask us to:

confirm whether we process your data, and give you access to it;
correct incomplete, inaccurate or outdated data;
anonymize, block or delete data that is unnecessary or processed against the law;
give you your data in a portable format;
delete your data;
tell you who we share it with;
withdraw any consent you gave, and explain what happens if you don't give it.

Many of these you can do yourself, at any time:

edit or delete your content directly in the app;
download your notes, tasks and daily notes with Export Data in your account settings;
delete your account and all its data in your account settings (see how to delete your account).

For anything else, email gian@secondbrain.ltd from the address of your account, so we can confirm it's you. We answer within 15 days. You can also complain to Brazil's data protection authority, the ANPD (Autoridade Nacional de Proteção de Dados).

10. Teenagers and children

You must be at least 13 years old to use Second Brain, and we check your birthday when you sign up. For users aged 13 to 17, we collect only what the service needs, show no ads and do no profiling, in the best interest of the teenager (LGPD art. 14). A parent or legal guardian can contact us at gian@secondbrain.ltd to access or delete their teenager's data.

If we learn that someone under 13 has created an account, we will delete it.

11. Changes to this policy

When we change this policy, we update the date at the bottom of this page. If a change significantly affects how we use your data, we will tell you by email or in the app before it takes effect.

12. Contact

Questions, requests or complaints about your data: gian@secondbrain.ltd.