Privacy policy

Last updated 2026-07-21

Beautiful Brain is an instance of Beautiful Brain, an open-source (MIT) memory-graph server for AI agents. "The operator" below means whoever runs this instance. This page describes what the instance stores and why. The short version: your memories are the product you use, not a product we sell. Nothing is sold, shared for advertising, or used to train models.

What is stored

• Account data — name and email from the sign-in provider (Clerk on the reference instance), used only to identify your account and scope your data to you.
• Memories you explicitly store — the notes, tasks, decisions, lessons, documents, and media that you or your agents capture, plus the tags and relationships between them.
• Embeddings — numeric vectors derived from your memories to power semantic search.
• Retrieval logs — which of your memories were touched by which tool and when, used to show you activity and analytics in your own dashboard.
• Provider API keys you add — stored encrypted (AES-256-GCM) under a server-side master key; only the last four characters are ever displayed.
• Collaboration data you initiate — invites, shares, task assignments, and project-space envelopes, delivered only to the contacts you choose.

How it is used

Solely to provide the service to you: storing, linking, searching, and recalling your memories, and showing you your own analytics. Your data is never sold, never used for advertising, and never used to train AI models.

Third parties

• Embedding provider — when embeddings are enabled, memory text (and attached media) is sent to the configured provider (e.g. Google Gemini) to compute vectors, subject to that provider's terms. A fully local embedding model is also supported, in which case nothing leaves the server.
• Sign-in provider — authentication is handled by the configured identity provider (Clerk on the reference instance).
• Federation peers — only when you explicitly share a memory, assign a task, or join a project space with a contact on another instance; project-space content is end-to-end encrypted and unreadable to intermediaries.
• No other third parties receive your data.

Retention and your controls

Memories are kept until you archive or delete them; you can view, edit, and archive everything through the dashboard and the MCP tools. AI clients connected via OAuth can be disconnected at any time from your client's settings, which revokes their access. You can permanently delete your account and all of its data yourself from the dashboard's Settings page: this immediately and irreversibly removes your memories and attached media, retrieval history, collaboration records, stored provider keys, and your sign-in identity. One caveat: memories you explicitly shared with contacts were copied to them when you shared, and those copies now belong to the recipient — deleting your account does not delete them. For copies held on another instance, contact that instance's operator.

Security

Transport is TLS-only. Stored secrets are encrypted at rest. Access is scoped per account: OAuth tokens act only on the signing user's memories. Project-space content is end-to-end encrypted (X25519 + AES-256-GCM) so hosts in the middle see only ciphertext.

Self-hosting

Beautiful Brain is open source. If you prefer that no third party holds your memories at all, run your own instance — the software is identical.

Changes and contact

Material changes to this policy will be reflected on this page with an updated date. Questions, data requests, or deletion requests: https://gitlab.com/sparkletree/beautiful-brain/-/issues.