Privacy Policy

Effective and last updated: 14 October 2026

This policy covers the Supabrain website, cloud sync and hosted MCP connection at supabrain.io/mcp. The data controller is Adam Duchemann. Contact adam@supabrain.io for privacy questions or requests.

Data we process

• Account and access data: account identity, email address, workspace membership, project permissions, and authentication/session records.
• Knowledge you choose to sync: projects, memory bodies, summaries, tags, attachments, documents, tasks, PRDs, saved instructions where enabled, and related links, versions and recovery history. These may contain personal information you supply.
• Connected-client data: client registration, account authorization, read/write permissions, token/session records and revocation state.
• Requests and diagnostics: tool arguments and results needed to carry out your request, request metadata, network addresses, timestamps, errors and operational/security logs.
• Website and support data: information you submit through early-access forms or support email, and optional website analytics described below.

The remote connection accesses synced cloud data available to your account. It does not read your device's filesystem or unsynced local memories. It does not require the full conversation history; content you choose to save may include excerpts from a conversation.

Why we process it

We process data to provide authentication, cloud storage and sync, retrieve accessible knowledge, perform authorized changes, manage connections, provide support and maintain service security. We use optional website analytics to understand and improve the website.

Where a legal basis is required, requested service processing supports providing the service to you; security and necessary diagnostics support our legitimate interest in operating a secure service; optional analytics relies on consent. We also process information when required by applicable law. We do not sell your saved knowledge or use it to train Supabrain's own AI models.

Who can receive data

• Supabase provides cloud database, authentication and hosted MCP infrastructure. The production database is currently in the EU West region (Ireland).
• Vercel serves the website and routes the public connection endpoint.
• Your connected AI client receives the requested tool results and sends tool inputs. Using the OpenAI integration exchanges this information with OpenAI. Other clients operate under their own terms, privacy policies and settings, including any policies about model training.
• Your collaborators can access knowledge through the sharing, workspace and project permissions you choose. Private-project and author restrictions still apply.
• Support and service operation may involve authorized access needed to handle a request, diagnose an incident or comply with legal obligations.

Providers can process network and service metadata in their infrastructure. Provider locations and processing are separate from the production database region; this policy does not promise that every copy or diagnostic record stays in one country. Connected clients may retain returned content under their own policies. Revoking their access cannot recall information already received.

Retention and deletion

Active memories remain until you delete them. Supabrain does not automatically expire saved memories after 30 days.

Ordinary deletion is currently soft deletion. It hides an item from normal retrieval but can retain its body, deletion marker and recovery/version history for sync and recovery. These records can remain stored indefinitely unless separately removed. Deleting a memory is therefore not a guarantee of immediate permanent erasure from all copies.

Revoking a client stops its future authorized access; it does not delete your saved knowledge or data already returned to that client. Copies on your devices and in connected clients require separate handling.

Provider retention is separate: Supabase currently reports seven-day default retention for service logs and daily database backups; point-in-time recovery is not enabled for this production project. The Vercel project's native runtime log retention depends on its observability configuration, with Pro limits of one day or up to 30 days. Separately retained support records, diagnostic exports and copies outside these provider windows can remain until removed or no longer needed for their purpose; there is no blanket 30-day erasure guarantee.

Website consent preferences remain in your browser until cleared. Early-access/support information and website analytics can remain until removed or expired under their separate storage settings. Website replay or analytics retention is not the retention of saved Supabrain memories.

Your choices and requests

You can choose what to sync, change supported content and sharing permissions, approve read-only or write-enabled client access, delete items from ordinary retrieval and revoke clients through Manage connections.

For access, correction, export, objection, restriction, account closure or permanent-removal requests, contact adam@supabrain.io. Tell us the account and scope, without sending passwords or access tokens. We may need to verify your identity and clarify shared content, recovery records, backups and device/client copies. Permanent removal is handled separately from ordinary soft deletion. We respond under the rights and deadlines applicable to your request; this policy does not invent a fixed technical purge schedule. You may also complain to your applicable data-protection authority.

Website analytics and browser storage

Some legacy landing pages offer optional PostHog analytics and session replay using its EU endpoint. Capture and recording are disabled until you accept; input fields are configured to be masked. These pages use sb_consent to remember your choice and sb_hero to keep a page variant consistent. The legacy analytics client is configured for cookieless operation. Necessary sign-in and connection pages may store authentication/session information required to maintain your login.

On pages that offer optional analytics, you can decline or change the choice in their cookie controls. You can also clear the stored consent below or clear your browser storage. Clearing browser preferences does not erase previously stored cloud memories.

Changes and contact

We update this page when our practices change. A materially different collection or use will be disclosed and consent requested where required. Privacy contact: adam@supabrain.io.