Brainstormd (“we”, “our”) is an online whiteboard. This policy explains what we store when you use the website and app at brainstormd.app (the “Service”), what we never receive, and the choices you have. We collect only what we need to run the Service.
1. What we store
- Your account: your email address, a salted hash of your password (never the password itself), your plan and when you joined.
- Your boards: titles, the content you put on them (text, shapes, drawings, connections), the images you add, and a small outline used for board thumbnails.
- Version history (Pro): snapshots of boards taken while they are edited, kept for 30 days.
- Sharing: who is a member of which board and their role. Invite links are stored only as a one-way hash.
- Billing: if you subscribe, our payment provider, Stripe, processes your payment. We store your Stripe customer and subscription identifiers and your plan status, never your card details.
- Operational data: standard server logs (such as IP address, time and the request made) and short-lived rate-limit counters, used to keep the Service secure and reliable.
2. What we never receive: your AI keys and prompts
The board assistant runs on an API key you provide, for an OpenAI- or Anthropic-compatible endpoint you choose. Your key is encrypted and stored only in your browser. When you use the assistant, your browser sends your request (your message and the parts of the board it needs) directly to that endpoint. It does not pass through our servers, and we cannot see it. That provider's own terms and privacy policy apply to what you send them.
If you attach a document for the assistant (a Pro feature), it is uploaded to our server only to turn it into text. The conversion runs in an isolated service with no internet access; the file and its text are discarded as soon as the text is returned to your browser, and are never stored or logged. Your browser then sends that text, with your message, to your own AI endpoint as above.
3. When you share a board
People on a board can see its content and each other's email address. While you have a shared board open, the others on it can see that you are present and where your cursor is. If you leave or are removed from a board, what you added stays on it, because the board belongs to its owner.
4. Cookies and storage in your browser
We use one essential, HttpOnly cookie to keep you signed in (it lasts up to 7 days). Your browser also stores your preferences: board theme, where you were looking on each board, and your AI settings. It stores your encrypted AI keys too, and a copy of each board you open so edits survive a lost connection (deleted when you sign out). If you use a board without an account, it is stored only in your browser and never sent to us unless you save it to an account. We don't use advertising or analytics cookies, and there are no third-party trackers.
5. How we use information
Only to provide the Service: saving and syncing your boards, sharing them with the people you invite, billing, account emails, security and fixing problems. We do not sell personal information, show ads, or use your boards to train AI models.
6. Who else is involved
We rely on a small number of service providers to operate: infrastructure hosting and Stripe for payments. Each gets only what it needs to do its job. We may disclose information if the law requires it.
7. Security
Connections are encrypted in transit, passwords are hashed, and access to boards is checked on every request. No system is perfectly secure. Use a strong, unique password, and tell us if you suspect someone else has access to your account.
8. Keeping and deleting your data
We keep your account and boards while your account is open. You can download all of your boards (with their images) from Settings → Your data. Deleting your account in Settings → Delete account cancels any subscription and permanently removes your account, the boards you own (with their images, history and sharing) and your memberships of other people's boards. Backups and logs age out on their normal schedule.
9. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to certain processing. Most of this you can do yourself in Settings. For anything else, contact us.
10. Children
Brainstormd is not directed to children under the minimum age of digital consent where they live, and we do not knowingly collect their personal information.
11. Changes
If we make material changes to this policy, we will tell you through the Service or by email before they take effect.
12. Contact
Questions about privacy? Email us at [email protected].