CitedBrain
Where your data lives
You are trusting us with the contents of your working life. Here is every company that touches it, what each one does, and what we will not do with it. No hedging, and nothing here that you could not check.
The short version
Nothing becomes memory without youExtracted claims are proposals. You approve each one, or it never becomes something the app will recall.
No model vendor gets you as a customerAI processing runs in an AWS account we control, not by sending your text to a model company as its user.
You can take it all backExport any time. Delete your account and every table holding your data is drained.
Vendors
Who touches your data, and why
Convex — database and file storageHolds your sources, the fragments they break into, your approved claims, and the audit ledger. Encrypted in transit and at rest. This is the system of record.
Clerk — sign-inHolds your email and login credentials. It never sees the contents of your brain.
Vercel — web hostingServes citedbrain.com. Your data passes through it in transit; it is not stored there.
AWS Bedrock — all AI processingEvery model call the product makes — extraction, answering, search, the onboarding interview — runs through Bedrock in an AWS account we control, in one region. The model vendor never receives your data as its own customer. We have request and response logging turned off, so your text is not copied into any log: the product's own audit ledger already records what was extracted and what was answered, and a second copy would have no purpose but risk.
Amazon Transcribe — voice transcriptionVoice notes, spoken interview turns, and dictation into any text field are transcribed by Amazon Transcribe inside the same AWS account that runs Bedrock. The audio is copied to a private bucket only while the job runs; the copy and the job output are deleted as soon as the transcript is read, and anything a failed run leaves behind expires within a day. Dictation and interview audio is a way of typing, not evidence: the recording itself is deleted once the text is back, and only a voice note keeps its audio. Transcription previously ran on OpenAI's API; it no longer does.
Amazon Textract — reading text off photosA photo you capture — a page, a whiteboard, a receipt — is read by Amazon Textract inside the same AWS account that runs Bedrock and Transcribe. The image is sent inline with the request and is not copied into any bucket, so there is nothing left behind to clean up. The photo itself stays in your ledger as the evidence a claim is cited back to, and the text read out of it becomes a separate, derived source you can see beside the original.
Push notification services — only if you turn notifications onA phone notification cannot reach your device without passing through the notification service the operating system runs: Apple's on an iPhone, Google's on an Android phone. There is no way around that, and it is the one part of the product that leaves the cloud account we control. We relay through Expo's push service, which forwards the message to whichever of those two applies. What travels is the wording of the notification itself — something like “7 memories are waiting for your review” — plus an anonymous device identifier. Your captures, your claims, and the answers to your questions are never part of a notification. Notifications are off until you turn them on, and turning them off stops this entirely.
Commitments
What we will not do
We do not sell or share your content.Not to advertisers, not to data brokers, not to partners.
We do not use your content for advertising.There is no ad product here to feed.
We do not train models on your content.Not us, and not the processors above — that is a term of how we buy from them, not a preference.
These survive a change of ownership.If CitedBrain is ever acquired, you are told before your data moves, and these commitments come with it. They are in the terms, not in a blog post.
Control
What you can do about it
Draw your own perimeterPrivacy settings let you exclude whole subject areas — health, money, personal relationships, beliefs, location. An excluded category is discarded the moment it is proposed: never shown to you for review, never stored, never indexed. You are told how many items were discarded, never what they said.
See every AI runThe audit ledger records every extraction and every answer, including what went in and what came back. Nothing the model does is invisible to you.
Export or deleteTake your sources and claims with you at any time. Deleting your account drains every table that holds your data, including the stored audio and documents.