How Brainprint collects, uses, stores, and shares the data you give us. Written in plain English first, with the legal specifics that follow.
Brainprint reads your saved bookmarks, articles, and similar artefacts to produce a portrait of you as a reader. The data we hold is the data you choose to send us — uploaded export files or items pulled via OAuth from sources you connect. We process it, derive a portrait, and keep both. We do not sell your data, do not run advertising, and do not share inferences about you with third parties for their own purposes. You can ask us to delete everything at any time.
Brainprint (“Brainprint”, “we”, “us”) operates the website at brainprint.net and is the data controller for personal data described in this policy. Contact: hello@brainprint.net.
If you are based in the European Economic Area (EEA), the United Kingdom, or Switzerland, this policy describes how we comply with the General Data Protection Regulation (GDPR) and the UK GDPR. If you are based in California, the sections marked CCPA apply to you.
We collect three categories of personal data:
your-name) used as the URL slug for your portrait at brainprint.net/your-name. We do not require an email or password.We use the data described in §2 only to:
brainprint.net/your-handle.We do not use your data to train foundation models, do not share it with brokers, and do not run profiling for advertising purposes.
We share data with the following processors, each of whom acts on our instructions under written data processing terms:
| Processor | Purpose | Region |
|---|---|---|
| Render | Application hosting and request serving | United States |
| Supabase | Primary database and file storage | United States (EU region available on request) |
| Stripe | Payment processing for the Analysis unlock | United States, Ireland |
| OpenAI | Generating text embeddings used for clustering | United States |
| Anthropic | Generating editorial copy and trait inferences | United States |
| Inngest | Background job orchestration for the pipeline | United States |
| Cloudflare | DNS resolution for brainprint.net | Global edge network |
We have data processing agreements with each. Where a processor is in the United States, transfers rely on the EU–U.S. Data Privacy Framework or Standard Contractual Clauses.
Your data is processed primarily in the United States. By using Brainprint, you acknowledge that your data may be transferred to and processed in countries whose data protection laws differ from your own. We use Standard Contractual Clauses or successor mechanisms approved by the European Commission and the UK Information Commissioner’s Office to lawfully transfer EEA / UK personal data outside those territories.
Brainprint uses one short-lived signed state cookie during OAuth flows to prevent CSRF attacks. The cookie is essential, expires within ten minutes of issue, and requires no consent banner under ePrivacy because it is strictly necessary to provide the service you requested. We do not use cookies for analytics, advertising, or cross-site tracking.
Under the GDPR, the UK GDPR, and similar laws, you have the right to:
To exercise any of these rights, email privacy@brainprint.net from the address you used at checkout (or include enough information for us to identify you, such as your handle and approximate signup date). We respond within one month, extendable to three for complex requests.
California residents have the right to know what personal information we collect, the right to delete it, and the right to opt out of any sale of personal information. We do not sell or share personal information for cross-context behavioural advertising. To exercise your CCPA rights, email privacy@brainprint.net.
Your portrait includes scores and observations generated by language models (Big Five, Schwartz values, etc.). These are descriptive — they describe patterns in what you have read — and are not used to make decisions that produce legal or similarly significant effects on you within the meaning of GDPR Art. 22. We provide them as editorial commentary and recommend you treat them as such.
Brainprint is not directed at people under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, email privacy@brainprint.net and we will delete the data.
We use TLS for every request, encrypted-at-rest storage via our database provider, scoped service credentials, row-level security on user tables, signed state on OAuth roundtrips, and least-privilege API keys for third-party services. No system is perfectly secure; if a breach affects you, we will notify you and the relevant supervisory authority within 72 hours where required by Art. 33 GDPR.
We may update this policy as the service evolves. Material changes are reflected in the “Last updated” date at the top and announced on the site for 30 days before they take effect. Continued use after the effective date constitutes acceptance.
For privacy enquiries, data subject requests, or questions about this policy:
Last updated 29 April 2026. Effective from 29 April 2026.