Privacy

Brain Print is a personal vault made by Birch Tree Studio. The short version: your entries are yours, we store as little as we can, and the things you lock we genuinely cannot read. This page says exactly what is kept and who can see it, including the parts that are less flattering.

What we store

Your email address, so you can sign in. Your entries — the text, any tags, and the time you wrote them. A sign-in session token and its expiry. A short-lived token when you request a sign-in link. A counter used to rate-limit sign-in requests. An index holding, for each entry, its date, its size in bytes, and enough detail for the views to draw themselves.

We do not run an analytics tracker, an advertising pixel, or any third-party script that watches you type. There are none in the page.

Locked entries

A locked entry is encrypted in your browser before it is sent anywhere. We store the ciphertext, an initialisation vector, a salt, and the parameters needed to derive a key from your passphrase — and nothing else about it. Your passphrase is never sent to us and never stored, by us or by anyone.

We cannot read a locked entry, we cannot recover one, and if you forget your passphrase its contents are gone permanently. There is no reset link and no support request that can undo that. It is the design rather than a shortcoming of it.

What a locked entry does still reveal, stated plainly: that it exists, the date and time you wrote it, and roughly how long it is — because the index records each entry’s size in bytes and locked entries are no exception. It does not reveal what kind of thing it is, any tags, or any part of the content.

Where it lives, and who is behind it

Entries are stored on onejsonfile.com. That is also a Birch Tree Studio service, which is worth saying out loud: it is not an arm’s-length third party, it is us. It stores data in Cloudflare R2 with metadata in Neon Postgres. The site runs on Vercel. Sign-in and support email is sent through Resend. DNS is handled by Cloudflare.

Vercel keeps ordinary server logs for our deployment, which include IP addresses, request paths and timestamps. We do not use those logs to build a profile of you, but they exist and we can see them.

What we never do

We do not sell your data. We do not train machine-learning models on it. We do not read your entries for product research. We do not send marketing email — the only mail Brain Print sends is a sign-in link you asked for, and a reply to a support message you sent us.

Deleting it

Delete an entry from the feed and it is removed from storage. Ask us to delete your account and we will remove your record and your entries, including the ciphertext of locked ones; that is done by hand, so allow a few days.

What we cannot promise is instant erasure everywhere. Storage providers keep their own backups and logs on their own schedules, and deleted data may persist in those for a period outside our control. Anyone who tells you otherwise about any service is guessing.

Children

Brain Print is not intended for children and is not designed for use by anyone under 16.

Changes

If this page changes in a way that matters, the date at the top changes and we will say what moved. We will not quietly rewrite it.

Contact

Questions go to the support page, which reaches a human.