This policy explains what personal data BrainOS handles, why, and what you can do about it. BrainOS has three parts, and they handle data very differently, so we describe each one separately.
How your data is handled, at a glance
A short summary of the three parts. The sections below give the full detail.
Comparison of the local package, BrainOS Cloud and this website
Question
Local MCP package (npx brain-os)
BrainOS Cloud (app.brainos-hq.com)
This website (brainos-hq.com)
Where your data is stored
In the .brain/ folder on your machine.
In Cloudflare (D1 database and Vectorize index) on our account, isolated per user.
No account. If you join the beta or request early access for your organization, your form answers are stored in a Cloudflare D1 database.
Who can access it
Only you and the MCP clients you configure.
You; the AI apps you connect (ChatGPT, Claude, other MCP clients) using your keys and connections; and the operator only for support, security or legal reasons.
The operator, to run the beta and reply to early-access requests. Analytics are aggregate.
What we receive
Nothing.
Your account details and the workspace content you and your agents write.
Aggregate, cookieless analytics. Microsoft Clarity data only if you allow it. Form answers if you join the beta or request early access.
What the AI apps you connect can see
Your MCP clients (Claude Code, Cursor and others) read and write it locally. Whatever those tools send to their own AI provider is governed by that tool.
Connected apps read and write your workspace at your direction, under their own policies.
BrainOS is operated by BrainOS HQ, a project run by its founder in Indonesia. We are in the process of registering a legal entity; until then, the founder is responsible for the service and acts as the data controller for the personal data described here.
For anything about this policy, including privacy requests, contact hello@brainos-hq.com.
This policy is written to meet the EU and UK General Data Protection Regulation (GDPR) and Indonesia's Personal Data Protection Law (Undang-Undang Pelindungan Data Pribadi, Law No. 27 of 2022, "UU PDP").
2. The open-source package (npx brain-os init)
The BrainOS npm package is open source under the MIT license. It runs entirely on your machine and stores its data in a local .brain/ folder in your project.
It has no telemetry. We receive nothing from it: no usage data, no content, no identifiers.
The data in .brain/ is yours. You decide whether to commit it, ignore it or sync it.
Optional semantic recall can use a model that runs on your device. If you set BRAIN_EMBEDDINGS=openai, text is sent directly from your machine to OpenAI under your own OpenAI account. It does not pass through us, and OpenAI's terms and privacy policy apply.
The MCP clients you connect (for example Claude Code or Cursor) read and write .brain/ locally. What those tools send to their own AI providers is governed by those tools.
Because we do not receive any personal data from the package, most of this policy does not apply to it.
3. BrainOS Cloud (app.brainos-hq.com)
BrainOS Cloud is a hosted version of BrainOS. It is currently a private beta.
What we process
Account data: your email address; your password, stored only as a salted PBKDF2 hash (we never store the password itself); whether your email is verified; when your account was created; your beta access status; and a record of which version of the Terms and this Privacy Policy you accepted, and when.
Session cookie: one strictly necessary, httpOnly cookie that keeps you signed in.
Workspace content: what you and your connected AI agents write, such as projects and entities, decisions, plans, patterns, session notes, memories, and an audit log of changes.
Derived data: search indexes and vector embeddings created from your workspace content so it can be searched.
API keys: stored only as hashes.
Connected apps: records of the OAuth connections you set up for ChatGPT, Claude and other MCP clients, and connection events.
Usage metering: records of how much of the service you use.
Rate-limit counters: used to prevent abuse.
Why we process it, and on what legal basis
Providing the service (your account, your workspace, search, connected apps): necessary to perform our contract with you.
Security and abuse prevention (rate limits, audit records, connection events): our legitimate interest in keeping the service and its users safe.
Improving reliability (usage metering): our legitimate interest in running a stable service.
Service emails (verification, beta access, important notices): necessary to perform our contract with you.
Anything optional we ask you to agree to: your consent, which you can withdraw at any time.
Under UU PDP, these correspond to the bases of contract performance, legitimate interest and explicit consent.
What we do not do
We do not sell personal data.
We do not use your workspace content for advertising.
We do not use your workspace content to train AI models.
Connected AI apps
When you connect an AI app (ChatGPT from OpenAI, Claude from Anthropic, or another MCP client), that app reads and writes your workspace at your direction. Those providers handle the data they receive under their own terms and privacy policies, as independent controllers. You can remove a connection at any time from your dashboard.
4. This website (brainos-hq.com)
Cloudflare Web Analytics: cookieless, aggregate statistics such as page views. It does not set cookies or build a profile of you.
Microsoft Clarity: heatmaps and session recordings that show how people use the site. Clarity uses cookies, so it loads only after you click "Allow" in the cookie banner. Recordings mask form inputs. See Cookies and your choices.
Beta and tester forms: your email address, your name if you give it, and your answers. These are stored in a Cloudflare D1 database and used to run the beta and send related emails through Resend. Some forms may be hosted by Tally, in which case Tally's privacy policy also applies. The legal basis is your request to join (steps before a contract) and our legitimate interest in running the beta.
Early-access requests (/vision): your work email, your company, its team size, and anything you choose to tell us about the AI tools your team uses and what gets lost today, plus which event or page you came from. These are stored in a Cloudflare D1 database and sent to us as an email notification through Resend. We use them only to contact you about BrainOS for your organization; we do not add you to a mailing list. The legal basis is our legitimate interest in replying to a request you sent us.
Blog comments: comments use giscus, which works through GitHub accounts. GitHub's terms and privacy policy apply to anything you post there.
Fonts: fonts load from Google Fonts, so Google receives your IP address when you visit.
5. Cookies and your choices
This website uses cookies only for Microsoft Clarity, and only if you allow it. Your choice is saved in your browser's local storage (key bos-consent) so we do not ask again. If you decline, Clarity is never loaded. If you allowed it and then withdraw, we tell Clarity you withdrew, ask it to delete its cookies, and reload the page so that Clarity stops running; it does not load again unless you allow it. BrainOS Cloud uses one strictly necessary session cookie to keep you signed in, which does not need consent.
You can change your choice at any time:
6. Who we share data with
We use these service providers (processors) to run BrainOS. They process data on our behalf and under our instructions:
Cloudflare: hosting (Workers), database (D1), vector search (Vectorize), embeddings generated with Cloudflare Workers AI (model bge-base-en-v1.5, running on Cloudflare), and website analytics.
Resend: sending verification and service emails.
Microsoft (Clarity): website heatmaps and session recordings, only with your consent.
Tally: some beta forms may be hosted by Tally.
Separately, Google (Fonts), GitHub (giscus comments) and the AI apps you connect receive data as independent controllers under their own policies.
We may also disclose data where the law requires it, or to protect the rights, safety and security of our users, the service or others.
7. International transfers
Our providers may process data outside Indonesia and outside the EU and UK, for example in the United States. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses in our providers' data processing terms, and we take the steps UU PDP requires for transfers outside Indonesia.
8. How long we keep data
BrainOS Cloud account and workspace data: kept until you delete your account. When you delete your account, you choose how: Delete permanently now removes it from the live database and vector index immediately; Delete in 14 days is an optional recovery period, during which your data is kept, your account's access, API keys and app connections are switched off, and you can sign in to download your data or cancel the deletion ("Keep my account"). Signing in alone does not cancel it. At the end of the period we delete the account and its data. Cloudflare database backups roll off within 30 days.
Beta form submissions: kept while the beta runs, or until you ask us to delete them.
Early-access requests: kept for up to 24 months after your last request, or until you ask us to delete them.
The open-source package: we hold nothing. Your .brain/ folder stays on your machine until you delete it.
9. Security
HTTPS on every connection.
Passwords, API keys and tokens are stored only as hashes.
Each user's data is isolated from every other user's.
No system is perfectly secure. If a personal data breach affects you, we will notify you and the relevant authorities as the applicable law requires.
10. Your rights
Depending on where you live, GDPR and UU PDP give you these rights over your personal data:
Access: ask what we hold about you and get a copy.
Export and portability: in BrainOS Cloud, use "Download my data" in the Dashboard for a JSON export.
Rectification: ask us to correct inaccurate data.
Erasure: in BrainOS Cloud, use "Delete account" in the Dashboard. "Delete permanently now" immediately deletes your account and all workspace data from the live database and vector index. If you prefer, you can choose "Delete in 14 days" instead, which gives you time to change your mind; you can switch to deleting immediately at any point during that period. Cloudflare database backups roll off within 30 days.
Restriction: ask us to limit how we use your data.
Objection: object to processing based on our legitimate interests.
Withdraw consent: at any time, for anything based on consent, such as Clarity on this website.
Complaint: complain to a supervisory authority, such as the data protection authority in your EU country, the UK Information Commissioner's Office, or the Indonesian personal data protection authority.
You can also make any request by emailing hello@brainos-hq.com. We respond within 30 days, or sooner where the law requires. We may need to confirm your identity before acting on a request.
11. Age limit
BrainOS Cloud is for people 18 or older. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has given us data, contact us and we will delete it.
12. Changes to this policy
We may update this policy. Each version has a date and a version id at the top of this page. If we make a material change, we will tell you by email or in the app before it takes effect. An update to this policy explains how we handle data; it never counts as your consent to anything. If a change needs your consent, for example a new optional use of your data, we will ask you separately and it stays off unless you agree. We record which version each BrainOS Cloud user was shown.