Privacy

The waitlist form stores the email you submit so we can write when hosted attach is ready.

We do not sell the list. We do not use it for other products.

Netlify stores the submissions for this site. Ask to be removed and we delete the row.

The private pilot stores project briefs, private onboarding drafts, proposals, revision history, and Google account identifiers on Railway. Google sign-in identifies the owner; it does not request Gmail or Drive access.

Onboarding drafts expire after 30 days without a save. The cleanup job removes expired draft records; prepared projects and proposals keep their normal review history.

When connector OAuth is enabled, Hindbrain also stores registered-client metadata, selected-project grants, encrypted client secrets when issued, token verifier hashes, and access audit records. Consent selects which projects and read or proposal permissions a client receives.

Connected assistants receive context within the access you grant. Proposals require separate owner confirmation before becoming project context. You can revoke a connection to stop future access; revocation does not remove copies an assistant already received or historical audit records.

Project deletion removes its hosted briefs, revisions, proposals, selected imports, session evidence, matching wizard drafts, credentials, and connector project grants. A connection covering other projects keeps those grants. Connections with no remaining project are revoked.

Revision and proposal content remains until project deletion. Content-free audit and deletion-journal records, including owner IDs, project IDs, generation timestamps, and deletion-intent times, have no automatic expiry yet. The private pilot stores signed deletion intents in a private journal outside the project database. Request-budget counters contain hashed identifiers, counts, and window times; daily cleanup removes expired counters.

Deleted content can remain in backups until backup retention removes it. The staging PITR policy is configured for weekly full and daily differential backups, retaining four full and fourteen differential backups. This is count-based retention, not a guaranteed number of days.

Recovery is currently manual. Operators must stop source mutations, keep restores private, and reapply deletions from a fresh, signed journal inventory before reopening access. If the journal or a valid inventory is unavailable, the restore must not reopen. Hindbrain cannot remove copies already held in an assistant's chat or downloaded to a local project.