How this fits with Privacy
The Privacy page lists what is collected and why. This page describes the safeguards around that data and the controls available to you.
Access to your vault
- The vault, archive, profile, and settings require a signed-in account.
- Ideas are stored per account. Database rules restrict each account to its own rows, so one signed-in user cannot read another user's ideas through the app.
- Voice notes, photos, and PDFs are stored in a private file bucket. They are not published on a public URL.
How processing is set up
- The site is served over HTTPS.
- Transcription, text extraction, and research run on the server. The AI provider keys are not shipped to the browser.
- Subscription checkout and the billing portal run on Stripe. Card details are collected there.
Services that process data for the product
Supabase hosts accounts, the database, and private files. Stripe hosts payments. OpenAI drafts research and can run web search. Each one processes data in order to provide that part of the service.
Their processing locations can include countries other than yours. Details of what is sent are on the Privacy page.
Controls in the product
- Name. Update your first and last name on Profile.
- A single idea. Delete it from the idea page. That deletes the idea record and its stored recording or file.
- Archive. Archiving hides an idea from the active vault and keeps the record. It does not delete it, and it still counts toward the free-plan limit.
- Subscription. Open the Stripe billing portal from Settings to change or cancel Pro.
- Session. Sign out from the account menu on this device.
- Account. Delete it from Profile. That removes the login, ideas, and stored files, and cancels Pro if you have it.
You can also email codegraines@gmail.com or use the contact form.
What to keep out of an idea
Idea text and files are processed by the AI provider and stored in your vault. Use them for the idea itself. Do not put passwords, access keys, payment cards, government ID numbers, health details, or someone else's private information into a capture.
Limits
These measures reduce the chance of unwanted access. They do not make storage or transmission immune to failure, misuse of a stolen login, or a problem at a provider. Protect the email and password on the account the same way you protect other logins.