Privacy

The short version

We collect the least we can get away with: an email address so you have an account, a phone number if you want to text things in, and whatever you put on your board. We do not sell it, we do not share it for advertising, and there are no trackers on this website at all. Card details never touch our servers — Stripe handles those.

The rest of this page is the detail behind that paragraph.

Who we are

BrainSack is operated by RW Business Solutions LLC. For anything on this page, including a request to see or delete your data, email [email protected] or write to Chapin, South Carolina.

What we collect

Your account

• Email address. It identifies your account and it is where password resets and confirmation links go.
• A password, or a Google sign-in. Passwords are stored only as a salted hash — we cannot read yours, and neither can anyone who steals the database. If you sign in with Google we store the identifier Google gives us for you, never your Google password.
• A display name, if you set one.

Your phone number, if you give us one

Texting things in only works if we know which number is yours, so a number you register is stored against your account and used to route your messages to your board. Giving us a number is optional — everything else in BrainSack works without one.

We also store your opt-in. Before a number is saved you tick a box agreeing to receive text messages at it, and we keep a record of that: the date, and the exact wording you agreed to. That record is what lets us show a mobile carrier that the number consented, and it is kept for as long as the number is registered to your account. Changing your number asks for the agreement again, because the old one was about the old number.

What you put on your board

Notes, checklists, links, tags and any files you attach. This is your content. We store it so we can show it back to you; we do not read it, mine it, or train anything on it.

Encrypted notes are handled differently. The body of an encrypted note is encrypted with a key belonging to your account, which is itself wrapped by Azure Key Vault. It is left out when your board loads and left out when you search, and is decrypted only at the moment you open that one note. Be clear about what this is and is not: it protects the note if our database is exposed. It is not end-to-end encryption — the key is held in our infrastructure, so it does not protect against us, and we could in principle be compelled by a lawful order to decrypt. If you need a secret that nobody can be compelled to reveal, this is the wrong place to keep it.

Text messages you send in

The content of a message you text in becomes an item on your board, exactly as if you had typed it. Separately we keep a short record of each inbound message — the carrier’s message ID, when it arrived and what we did with it — so that a message the network delivers twice does not land on your board twice. That record never contains the message body, and it is deleted automatically after 30 days. We also count how many messages you have sent in, so we can show you the total on your account.

Text messages we send you

We text you a one-time code to confirm a number when you add it, and we may text you about notes you send in. That is the whole of it: we never send marketing texts, and we never text a number that has not agreed to hear from us.

Message frequency varies — it depends on how much you text in. Message and data rates may apply, from your carrier rather than from us.

Reply STOP to any message to opt out, and we will stop texting that number. Reply HELP for help, or email [email protected]. You can also remove the number from the Phone page in the app at any time, which stops both directions.

The text messaging page describes the whole program in one place: what the messages are, the opt-in wording you tick against, and what the form looks like.

We do not sell or share mobile phone numbers or SMS consent with anyone for marketing purposes, and we never pass them to third parties or affiliates for their own marketing. The only company that sees your number is Twilio, which carries the messages for us and may not use them for anything else.

Billing

Stripe processes payments. We never see or store your card number — it goes from your browser to Stripe and not through us. What we store is Stripe’s identifier for your customer and subscription, whether that subscription is active, and when the current period ends. We also keep a record of each billing event Stripe sends us for 90 days, so that a question about a charge months later can still be answered.

Logs

Our servers keep ordinary operational logs — timestamps, error traces, which requests were served. These exist to keep the thing running and are not used to build a profile of you.

This website

The page you are reading sets no cookies, runs no analytics, and loads nothing from a third party. Nothing about your visit here is recorded beyond the standard server logs of our host.

Who else sees it

We do not sell your data and we do not share it for advertising. We use a small number of service providers to make the product work, and each one sees only what it needs to:

• Microsoft Azure — hosting, databases and file storage. Your board lives here.
• Stripe — payments and subscriptions. Sees your card details and your email address; never sees your board.
• Twilio — sending and receiving text messages, and delivering account emails such as password resets. Sees your phone number, your email address, and the content of messages you text in.
• Google — only if you choose to sign in with Google, and only to confirm that the account is yours.

We will also disclose data where we are legally required to. If that happens and we are permitted to tell you, we will.

Share links

If you share a note or a checklist you get a link that shows that one item, read-only, and stops working after 24 hours. Anyone holding the link can see that item while it is live, so treat it as public for that window. Encrypted notes and files cannot be shared this way at all.

How long we keep it

• Your board — for as long as your account exists. Cancelling does not delete it: if you come back later it is all still there.
• Inbound message records — 30 days, then deleted automatically.
• Your SMS opt-in record — for as long as the number is registered to your account. Removing the number removes it.
• Billing event records — 90 days, then deleted automatically.
• All of it — deleted on request. See below.

Your choices

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and everything on it. Depending on where you live you may have these rights by law; we will honour the requests either way.

Deletion is currently a manual process rather than a button in the app — email [email protected] from the address on the account and we will do it. We aim to complete requests within 30 days. Records we are required to keep for accounting purposes will survive the deletion of your board; the automatic expiries above apply to the rest.

Security

Traffic is encrypted in transit with TLS, data is encrypted at rest by our hosting provider, passwords are hashed, and encrypted notes get the additional treatment described above. No system is perfect and anyone claiming otherwise is selling something — but if we ever discover a breach affecting your data, we will tell you.

Children

BrainSack is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us information, email us and we will remove it.

Where your data lives

Our infrastructure and our providers are based in the United States, so that is where your data is stored and processed. If you are using BrainSack from elsewhere, that is where it is going.

Changes

If we change this policy in a way that matters, we will email the address on your account before it takes effect. The date at the top of this page always reflects the current version.

See also the Terms of Service.