Privacy Policy

Last updated: February 16, 2026

Brainstem ("we", "us", "our") is a service that connects your private GitHub repositories to AI chat clients as a searchable knowledge base. This policy describes how we collect, use, and protect your information.

Information We Collect

Account Information

When you connect via GitHub OAuth, we collect:

• GitHub username and user ID — to identify your account
• GitHub OAuth access token — to access your authorized repositories

Repository Content

When you install the Brainstem GitHub App on a repository, we sync and store text files from that repository. Supported file types include .md, .txt, .json, .yaml, .yml, .toml, .rst, and .adoc. Binary files, code files, and sensitive files (e.g., .env, credentials) are excluded.

Session Data

We create session tokens when you authenticate. Sessions contain a unique ID, your user ID, and an expiration date.

Email Data

If you set up email forwarding, we store:

• Your verified sender email addresses
• Your brainstem email aliases
• A log of received emails (sender, recipient, subject, status) retained for 7 days

Web Clips

When you use the bookmarklet or iOS Shortcut, we store the article URL, title, and extracted content as a note in your brain.

Usage Logs

We log GitHub webhook events (event type, installation ID, status) for debugging. Webhook logs are retained briefly and do not contain repository content.

How We Use Your Information

• Providing the service — syncing files, indexing for search, serving MCP tool responses
• Authentication — verifying your identity and authorizing access to your data
• Email processing — routing and storing forwarded emails as inbox notes
• Debugging — diagnosing sync failures or webhook delivery issues

We do not use your data for advertising, analytics, model training, or any purpose beyond operating the Brainstem service.

Infrastructure and Data Storage

Your data is stored on Cloudflare infrastructure:

• Cloudflare R2 — file storage (encrypted at rest with AES-256-GCM, Cloudflare-managed keys)
• Cloudflare D1 — account records, sessions, email configuration
• Cloudflare AI Search — semantic search index over your files

All data is encrypted in transit (TLS) and at rest. The platform operator has technical access to stored content for operational purposes.

Data Sharing

We do not sell, rent, or share your data with third parties. Your data is only accessed by:

• You — via MCP tools in your AI client
• Cloudflare — as our infrastructure provider (subject to Cloudflare's privacy policy)
• GitHub — we use GitHub's API to read your repository content (subject to GitHub's privacy statement)

Data Retention and Deletion

Your data is retained as long as you have the Brainstem GitHub App installed. When you uninstall the GitHub App:

• All synced files are deleted from R2
• Your installation record is deleted from D1
• All active sessions are revoked
• Email aliases, verified senders, and email logs are deleted
• AI Search vectors are removed on the next reindex

Deletion is automatic and triggered by the GitHub App uninstall webhook.

Your Controls

• Disconnect anytime — uninstall the GitHub App from your GitHub settings to trigger full data deletion
• Choose what to sync — only the repository you connect is synced; you control what files are in that repo
• Revoke access — revoke the GitHub OAuth authorization from your GitHub settings

Security

We use industry-standard security measures including encrypted storage, HMAC-verified webhooks, OAuth 2.1 with PKCE, and bearer token authentication. Session tokens expire after one year.

Children's Privacy

Brainstem is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13.

Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated "Last updated" date.

Contact

For questions about this privacy policy or your data, contact us at privacy@brainstem.cc.

---