Skip to content
Second Brain

Privacy Policy

Last updated:

Second Brain is a self-hosted open-source app (MIT license). This policy explains what data a Second Brain instance processes, why, and your rights. “Operator” means the person or organization running the instance you use; for 2ndbrain.ilramdhan.dev the operator is Ilham Ramadhan.

1. Data we store

App data is stored in the operator's Postgres database on Supabase (Auth, Database, Realtime). It includes:

  • Account: email address, password hash (managed by Supabase Auth), display name, and creation and last sign-in times.
  • Your content: Inbox items, tasks, block notes, projects, milestones, comments, templates, canvases, automation rules and focus sessions.
  • Collaboration: project memberships and invites (the invited email address).
  • Activity log: changes to your data (what, when) for the Activity page and auditing.
  • Connections: the Telegram chat ID you link, and a Google Calendar refresh token encrypted (AES-GCM) on the server.
  • Technical data: per-user rate limits and n8n idempotency keys, which are deleted automatically.

Row Level Security limits access: you only see your own data and the data of projects you are a member of.

2. Third-party services

These features are only active when the operator configures them, and some only when you connect them yourself:

  • Supabase: database hosting, authentication and realtime for the whole app.
  • Vercel (or another host chosen by the operator): runs the web app and keeps standard request logs (IP address, URL, user agent).
  • Google Calendar: when you connect it, dated tasks are sent as events to your calendar (calendar.events scope).
  • Google Drive: when the operator enables automatic backups via n8n, copies of the data are stored in the operator's Drive.
  • Telegram: when you link the bot, the messages you send to it and its replies are processed by Telegram and the app.
  • AI provider (for example OpenAI or Google Gemini through a compatible API): text, images or audio you submit to an AI feature are forwarded to the provider for processing. Nothing is sent to AI without your action.
  • Resend: backup summaries and alerts are emailed to the operator through Resend.
  • Sentry (optional): error reports and performance metrics containing only a user ID, never email, note content, bodies, headers or query strings.
  • n8n (optional): the operator's automation server, which calls the app's endpoints for reminders, digests, maintenance and backups.

Each service is subject to its own privacy policy. The operator chooses their regions and plans.

3. Cookies and local storage

Second Brain uses no advertising cookies or third-party trackers. Your browser stores:

  • The Supabase sign-in session (access and refresh tokens) in localStorage.
  • Theme, language and idle-logout preferences in localStorage.
  • Your quick-capture draft and the latest-version check cache in localStorage.
  • The service worker (PWA) cache with app assets and recently visited pages for offline use.

You can remove all of it by signing out and clearing the site data in your browser.

4. Data retention

  • Deleted tasks, notes and projects go to the Trash and are permanently purged after 30 days.
  • Archived items are kept until you restore or delete them.
  • Telegram link codes expire within minutes; rate-limit rows are deleted after 24 hours and n8n idempotency keys after a few days.
  • Automatic backups (when enabled) rotate according to the number of copies set by the operator; deleted data can remain in older backups until they rotate out.
  • Account data is kept while the account is active.

5. Your rights and account deletion

You have the right to access, correct, export and delete your personal data, as provided by applicable law (for example Indonesia's Personal Data Protection Law No. 27/2022 and the GDPR).

  • Access and correction: view and edit your data directly in the app.
  • Export: Settings → Backup → download a JSON copy of your data.
  • Deletion: contact the operator to delete your account. Deleting an account removes all data it owns (tasks, notes, projects, activity log, connections) through cascading deletes in the database.
  • Revoking connections: disconnect Google Calendar and Telegram at any time in Settings.

6. Security

Connections use HTTPS. Service credentials and tokens stay on the server and never reach the browser. The security architecture is described in SECURITY.md in the repository. No system is perfectly secure; please report vulnerabilities privately through GitHub Security Advisories.

7. Contact and changes

Privacy questions and deletion requests go to the operator of the instance. For the official instance, open an issue or discussion in the ilramdhan/second-brain GitHub repository, or use GitHub Security Advisories for sensitive matters.

This policy may change. The date above shows the last update; significant changes are also recorded in the CHANGELOG.