Privacy

Who is responsible

The data controller is the operator named at the top of this page. For payments, Stripe is the merchant of record and an independent controller of the payment data it collects (card, billing country and address, tax details): we never see your card.

What we store and why

• Memories you buy: the sponsor name, text, link, emoji or logo and, if you give it, your X handle. They are public by design and kept permanently, because that is the product (performance of the contract). With each purchase we keep the amount, the Stripe session and payment ids and the time you ticked the consent box.
• Your email (optional): used for your receipt and your private “My memories” link (contract). Never shown publicly. A gift recipient's email is used once, to tell them, and kept with the memory; by giving it you confirm you may share it.
• Chat: messages are sent to our AI provider to generate a reply. We do not store your conversations. When the Brain admits it knows nothing about a topic, only the topic is recorded on the Gaps list, never the message or who asked. We count messages per IP address for a few minutes to limit abuse (legitimate interest).
• Votes: to allow one vote per person we store a hashed key derived from your IP address, or the id of your memory if you are a sponsor. No raw IP is stored with a vote.
• Cookies and local storage: after a purchase, a signed cookie marks your browser as a sponsor so the shared daily chat cap does not apply; it contains only a memory id, an expiry and a signature. If you arrive through an invitation link, a cookie remembers who invited you for 30 days. Your light or dark theme is remembered in your browser's local storage. All of these are strictly necessary or purely functional, so there is no cookie banner.
• Letters: if you subscribe, your email, until you unsubscribe (every letter has a link) or ask us to remove it (consent).
• Support and grant applications: what you type in the form, your email and, for support, your IP address for an hour to limit abuse. Support messages are kept until the matter is closed or you ask us to delete them. Grant applications we accept are published with the project name, country, summary and plan; your email stays private.
• Counters: each memory counts how often the Brain recalls it, mentions its sponsor and how many people click its link. Share buttons and invitation links are counted per day and deleted after 90 days. None of these counters hold data about the visitor.
• Usage totals and analytics: daily counts of messages and AI tokens, without personal data, published on the Transparency page. Page views are measured with Cloudflare Web Analytics, which uses no cookies and does not profile visitors.

Who helps us handle it

• Stripe: payments, tax and invoices, as merchant of record.
• Railway: hosting and the database.
• Cloudflare: network protection, email routing for our addresses, cookieless analytics and encrypted backups.
• Resend: sending emails: your private link, gift notices, letters and support replies.
• Anthropic: the AI model that writes the Brain's answers and moderates memories; chat messages and submitted texts are sent to it for that purpose.
• X and GitHub: where the Brain publishes memories (with the X handle you gave) and the open dataset. What is published there is public.

Some of these providers are in the United States. Transfers rely on the EU–US Data Privacy Framework or on standard contractual clauses.

What we do not do

No advertising trackers, no selling of data, no newsletters unless you ask for one. Links in memories are published as submitted, with tracking parameters removed. Buying is for people aged 18 or older, and we do not knowingly collect data from minors.

Your rights

You can ask us for access to your data, to correct it, delete it, restrict or object to its use, or to receive it in a portable format. Memories are permanent by contract, but you can ask us to anonymise the sponsor name, remove a link or a logo, or retire the memory from the Brain, the Wall and the rankings; copies already published in the history of the open dataset on GitHub or on X cannot be recalled. You can also ask us to delete your email or unsubscribe you from the letters.

Write to us through the Support page or at the contact address above; we answer within a month. If you are in the EU you can also complain to your data protection authority; in Spain, the Agencia Española de Protección de Datos (aepd.es).