Your plans belong to you.

Current local workspace

The current planning workspace stores cards, notes, board status, planned days and deadlines in your browser’s local IndexedDB storage. This information stays on that browser unless you export it or explicitly enable account synchronization when that feature becomes available.

Account information

When Google sign-in is enabled and you choose to use it, Google will provide Back My Brain with your Google account identifier, verified email address, name and profile image. We use that information only to create and operate your Back My Brain account. Back My Brain does not request access to Gmail, Google Drive, Google Calendar or your Google password.

Encrypted synchronization

When optional synchronization is enabled, card content is encrypted on your device before it is sent to Cloudflare. The service is designed so the server receives encrypted card content rather than readable titles, notes, workflow status, planned dates or deadlines.

The server may retain information needed to operate synchronization, including your account identity, random card identifiers, encrypted payloads, encryption-key versions, change versions and mutation times. A recovery key is intended to remain with you and is not uploaded in readable form. If every initialized device and the recovery key are lost, encrypted workspace data may be unrecoverable.

Service providers

Cloudflare provides hosting, database and network services. Google provides optional identity authentication. These providers process limited technical and account information according to their own terms and privacy policies.

Analytics and advertising

Back My Brain does not currently use advertising, cross-site tracking or third-party analytics in the planning workspace. Standard infrastructure logs may temporarily contain information such as request time, route, IP address and browser details for security and reliability.

Exports, retention and deletion

You can export local cards as JSON. You can remove local data by deleting cards or clearing the site or extension storage. Account deletion and synchronized-data deletion will be provided before public account synchronization is launched. Until then, account synchronization is not offered as a public feature.

Security

We use HTTPS, restricted authentication callbacks, hashed session and sign-in values, and device-side encryption for the synchronization design. No system can guarantee absolute security, so exports and recovery keys should be stored somewhere you trust.

Children

Back My Brain is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Changes and contact

Material changes will be posted on this page with a revised effective date. Privacy questions can be sent to support@backmybrain.com.