Data Policy

Introduction

This Data Policy provides detailed information about how 2ndBrain collects, processes, stores, and manages your data. We believe in complete transparency about our data practices, giving you full understanding and control over your information.

Your data is the foundation of your second brain. We treat it with the utmost respect and implement industry-leading practices to ensure its security, integrity, and availability.

Data Collection Practices

Content You Create and Save

Metadata We Generate

Technical Data

• Device information and browser type for compatibility
• IP address for security and regional compliance
• Session data for maintaining your login state
• Performance metrics to optimize the service

Data Storage Architecture

Primary Storage

Your data is stored using enterprise-grade infrastructure:

• Database: PostgreSQL on AWS RDS with automatic failover
• Files: Amazon S3 with server-side encryption (AES-256)
• Search Index: Elasticsearch for fast full-text search
• Cache: Redis for improved performance

Geographic Distribution

Data is stored in multiple regions for performance and reliability:

• Primary: US East (Virginia)
• Secondary: EU West (Ireland)
• Backup: US West (Oregon)

Backup and Recovery

• Automated daily backups retained for 30 days
• Point-in-time recovery available for the last 7 days
• Disaster recovery plan with 4-hour RTO (Recovery Time Objective)
• 99.9% uptime SLA for data availability

Data Processing Activities

Intelligent Processing

We process your data to provide smart features while respecting your privacy:

Data Minimization

We follow the principle of data minimization:

• Collect only data necessary for service functionality
• Automatically delete temporary data after processing
• Provide granular controls over data collection
• Regular audits to identify and remove unnecessary data

Data Sharing and Third Parties

Our Commitment

Limited Sharing Scenarios

Service Providers

We work with carefully selected partners who sign strict data protection agreements:

• AWS: Cloud infrastructure (SOC 2 Type II certified)
• Stripe: Payment processing (PCI DSS compliant)
• SendGrid: Transactional emails (GDPR compliant)
• Sentry: Error monitoring (anonymized data only)

Legal Obligations

We may disclose data when legally required:

• Valid court orders or subpoenas
• Government requests with proper legal authority
• To protect rights, property, or safety
• To investigate fraud or security issues

With Your Consent

• When you explicitly share content publicly
• When you connect third-party integrations
• For features that require collaboration

Data Retention Schedule

Data Portability and Export

Your Data, Your Control

We provide comprehensive data export options:

AI and Machine Learning

How We Use AI

Our AI enhances your second brain while protecting your privacy:

Personal AI Model

• Each user has a separate, isolated AI model
• Trained only on your own content
• Never shared with other users
• Deleted when you delete your account

Privacy-Preserving Techniques

• Federated Learning: Models improve without accessing raw data
• Differential Privacy: Statistical noise prevents individual identification
• On-Device Processing: Sensitive operations happen locally when possible
• Encrypted Computation: Process data without decrypting it

Opt-Out Options

You can disable AI features:

• Turn off AI-powered suggestions
• Disable automatic tagging
• Prevent content analysis
• Use 2ndBrain as a simple storage system

Compliance and Certifications

Regulatory Compliance

Security Standards

• SOC 2 Type II (in progress)
• ISO 27001 (planned 2025)
• Regular penetration testing
• Bug bounty program

Data Breach Response

In the unlikely event of a data breach, we commit to:

Immediate Response

• Contain and assess the breach within 24 hours
• Notify affected users within 72 hours
• Report to relevant authorities as required by law
• Provide clear information about what happened and what data was affected

Support and Remediation

• Offer credit monitoring if financial data was compromised
• Provide detailed guidance on protective steps
• Implement additional security measures
• Conduct thorough post-incident review

Contact Our Data Team

For any questions or concerns about our data practices: