Privacy

What brunn.ai collects, and what happens to it.

Last updated 2 October 2026. This notice covers the website, verified waitlist, hosted customer workspaces, and selected-record connections.

If you visit the site

We use Plausible for aggregate pageview analytics on the public site and in the signed-in web app. We send page categories, referring sites and whether a visit is signed in or signed out—not account identifiers, task or document names, workspace content, search text, or URL query parameters. Plausible derives approximate location and browser/device statistics from requests without tracking cookies. We do not track form contents, downloads or individual link clicks.

Your own browser can be excluded from Plausible analytics: turn Plausible analytics off for this browser. This stores a local opt-out preference, not a tracking identifier. It applies after signing out too; repeat it in each browser or after clearing site data.

Cloudflare Web Analytics also measures page visits and browser performance through an automatically injected beacon. Cloudflare's published guidance says it retains unsampled beacon data for seven days and makes history available for six months; it does not log query strings. The Plausible opt-out above does not disable this beacon.

We also measure first-party account and product usage, including successful agent queries (scheduled queries included), feature-level operation counts, and the amount of information saved and retained. These measurements do not record query text, document contents, secret names or values, or individual browsing trails. Account-linked measurements remain inside Brunn and are removed when an account is deleted. A private platform-owner overview shows aggregate counts, not customer content. Datadog receives aggregate operational and product metrics, and separate operational logs from the API and background worker. Those logs can contain diagnostic details and are distinct from the product measurements described here. The Datadog log index is set to retain logs for 15 days. Logs also go to our S3 archive; its expiry policy is still being verified, and archived copies can outlast the index.

New product-analytics retention targets are 30 days for detailed minute counts, 13 months for account-day totals, and 25 months for non-identifying aggregate trends. Historical measurements may be incomplete; automated cleanup of existing history is not enabled until rollup and deletion checks are verified. Website pageview opt-out does not turn off essential service operations or first-party account usage counters.

Our hosting provider (Railway) and our edge network (Cloudflare) keep ordinary request and security logs, including IP address, user agent and the pages requested. Request logs can include URL query parameters, including search terms used on a connection's record picker. Operational logs include request timing, method, tool name, status and size. These logs are used to run the service, diagnose failures and investigate abuse; they are separate from pageview analytics. Our current Railway Pro plan makes 30 days of log history available; that access window is not a promise of physical deletion, because plan changes can make older logs available. Cloudflare Security Analytics makes up to 31 days of history available on our Free Website plan. We have no Cloudflare log-delivery jobs configured. Signing in uses an essential session cookie; analytics does not add any cookies.

If you register or join the waitlist

We store your name, email, verification status, waitlist position, and the version of the terms you accept in our account database. A verification request expires after 30 minutes; expired requests are removed by background maintenance. Verifying your address creates your account. Free places have a hard capacity limit and are released in order. A confirmed paid subscription bypasses the free queue.

Resend delivers account verification and password-recovery messages. These messages contain short-lived links. We do not put your notes or secret values in account emails. Earlier interest-list submissions remain in our private Cloudflare Workers KV store until removed; contact hello@brunn.ai to remove one.

Your workspace and connected agents

You choose what to save and which agents may access it. Notes, skills, files, tasks, checkpoints, and related metadata are stored in your workspace on Railway and S3-compatible object storage. Customer permissions are separate from platform administration. Authorized service operators can access stored account data for operation and support; workspace storage is not end-to-end encrypted.

Secret values are encrypted separately. They are excluded from memory search, semantic indexing, Dreamer inputs, and ordinary exports. An agent with secret access receives a requested value, so its environment and provider also handle it. Never give a client permissions you do not want it to use.

Semantic search sends workspace text to the configured OpenAI embedding service. Your connected agents may send the evidence they read to their own model providers. Hosted Dreamer and subscription-backed background reasoning are currently limited to the private maker workspace; they are not included in customer plans.

Selected-record connections

A selected-record connection lets an app search and read only the record versions you choose. Brunn processes the focused search terms and exact record references needed to answer your requests. The app receives selected titles, paths, versions, source references and content hashes, plus the requested text. These requests do not create saved notes or a separate Brunn search-history record. Search and retrieval still produce ordinary usage, connection-activity and operational records as described above.

Choose only work records you have reviewed. Do not include passwords, access keys, payment card details, medical or health records, government identifiers, or regulated sensitive information in record contents, titles, paths or search terms. If content, a title or a path changes, the app needs a new selection before it can read that version.

Brunn may retain selection and review metadata, connection activity and usage counters until account deletion. Disconnecting in Connections stops future reads; it does not erase these records or copies already sent to the app or its model provider. The recipient's own data policy governs those copies. Use Brunn's account export and deletion controls for your workspace data.

Billing and service measurements

When paid activation is enabled, Stripe handles checkout, card details, invoices and subscriptions. Brunn stores provider reference IDs, subscription status and billing dates, but not your full card number. We count account reads, saves, provider input, transferred bytes and stored data to enforce plan allowances and understand service costs. Authentication and security records support access control and abuse investigation.

Retention, export and deletion

Free keeps current content only. Replaced note and skill payloads are removed; small version/hash receipts remain so retries and citations can be handled honestly. Paid plans retain older content within their storage allowance. Deleted data is not a supported recovery archive. Keep a separate copy of material you cannot afford to lose.

Account controls provide two export jobs per calendar month and up to three downloads per export, independently of ordinary read/save limits. Exports exclude credential and secret values. You can request account deletion there, including while waitlisted. Deletion revokes access, stops linked billing and queues removal of database and object data. The account-deletion workflow uses a 30-day backup-retention target from the request and displays the backup-erasure deadline in deletion status. Completion requires verified erasure of backup copies as well as removal of the active data; elapsed time alone does not complete deletion, and pending verification can extend the process. Deleted-account fences prevent recovery copies from restoring an active account.

If paid service ends, the account displays its recovery and retention deadline. New saves may be paused while reads and export remain available. Data may enter deletion after the stated 30-day retention period if payment has not been restored and the billing state has been confirmed. This rule does not expire ordinary active Free accounts. See the service terms for plan and cancellation details.

Contact

brunn is made by Kallon Labs. Questions about this notice: hello@brunn.ai.