CitedBrain
Privacy policy
This is the formal version. The plain-English account of every company that touches your data lives at where your data lives, and the binding commitments are in the terms. Where any of the three disagree, that is a bug and we want to hear about it.
Effective 2026-08-16
Collection
What we collect
Account informationYour name and email address, provided when you sign in directly or through Google. Our sign-in provider also holds standard authentication records such as sign-in times and devices.
Your contentWhat you put in: text captures, voice recordings and their transcripts, imported notes and documents, photos and the text read out of them, projects and focus sessions, and the claims you approve into your brain. This is the product; all of it is collected because you chose to store it.
Operational recordsThe audit ledger: which extractions ran, what was proposed, what you approved or rejected, and what each answer cited. It exists so nothing the AI does is invisible to you.
A device token, if you turn notifications onTo send a notification to your phone we store a token the operating system issues for that installation. It identifies the device, not you, and it is the only thing we keep that exists purely to reach you. It is removed when you sign out on that device, and with everything else if you delete your account.
What we do not collectNo advertising identifiers, no analytics trackers, no location data, no contact lists. The web app sets only the cookies required for sign-in.
Use
How we use it
To run the service, and for nothing elseStoring your sources, proposing claims for your review, answering your questions with citations, and syncing between your devices.
AI processing stays inside a perimeter we controlExtraction, answering, search, voice transcription, and reading text off the photos you capture all run in a single cloud account we operate. No model vendor receives your data as its own customer, and we keep provider-side request logging off.
Never for advertising, never for trainingWe do not sell your data, use it for advertising, or use it to train machine-learning models — and we contract the same restriction with every processor. These are binding commitments in the terms.
Processors
Who processes it
A short, named listSign-in, database and file storage, web hosting, AI processing, and — only if you turn notifications on — delivering those notifications to your phone each run on one named provider, acting on our instructions to operate the service and nothing more. The current list, with what each one holds and why, is maintained at where your data lives — if a provider ever changes, that page and this one change with it.
Disclosure outside that listOnly if we are compelled by law. There is no other category: no data partners, no brokers, no advertisers.
Retention
How long we keep it
While your account is openYour sources and approved claims are deliberately durable — a memory system that quietly forgets would be worse than none. Retraction keeps history visible rather than erasing it, so your record stays honest.
Working copies are short-livedAudio staged for transcription is deleted as soon as the transcript is read, with an automatic one-day expiry as the backstop. The stored original in your account remains the only archive.
When you delete your accountEvery record holding your content is drained — sources, audio, documents, claims, the audit ledger, and the derived search index. This runs automatically on account deletion; it is not a request queue.
Control
Your choices
Approve everythingNothing becomes memory without your explicit approval, and every approval is recorded against its source.
Exclude whole subject areasPrivacy settings can exclude categories — health, money, personal relationships, beliefs, location. Excluded items are discarded the moment they are proposed: never shown, never stored, never indexed.
Export or delete at any timeTake your sources and claims with you whenever you want, or delete your account from account settings and trigger the full drain described above.
The rest
Children, changes, and contact
ChildrenCitedBrain is not directed at children and is intended for users 18 and over. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.
Changes to this policyWhen this policy changes, the effective date above changes with it, and material changes are announced in the app before they take effect. The history is public in our source repository.
ContactQuestions, export requests, or anything that looks like a discrepancy between this page and how the product behaves: steve@crewchiefsteve.ai.