Privacy policy — instibrain

1. Scope

This policy covers instibrain.ai, this marketing website, and the account plane at my.instibrain.ai that serves an account. instibrain is operated by WebWork AI, Inc., a Delaware corporation, which runs other products under their own policies.

Two different things are described below and they collect very different amounts. Reading this site collects essentially nothing. Holding an account collects what an account needs.

2. What this website collects

No cookies. No analytics. No trackers. No access log.

Cookies: this site sets none at all.
Server logs: our web layer is configured not to write an access log for instibrain.ai. Reading these pages does not put your address in a log file of ours.
Local storage: one key, theme, and only if you use the light and dark toggle. It records that choice, it stays in your browser, and it never reaches us. Clearing site data removes it.
Fonts: served from this origin. The two typefaces are downloaded from instibrain.ai and from nowhere else, so no font host learns that you visited.
Third-party requests: none. No content delivery network, no analytics tag, no embedded video, no social widget, no hosted font. The site's Content Security Policy starts at default-src 'none' and permits subresources only from this origin, so the browser would refuse a third-party request even if one were added by mistake.

The one link that leaves this origin is the Sign in button, which goes to my.instibrain.ai. It is a link you choose to follow, not a request the page makes on its own.

3. What an account collects

There is no signup form and no invitation link. An account exists because one of us created it for a named person, by hand, after agreeing to do so. The account plane stores:

Your email address, which identifies the account.
A password verifier, never the password. We store a scrypt hash with a random per-user salt, using the implementation that ships with Node.
A display name, and an avatar image if you upload one.
Your sessions. For each one: the time it was created, when it was last seen, when it expires, and the IP address and browser user-agent it came from. Those last two exist so you can look at your own session list and recognise which device is which, and sign the others out. We store the SHA-256 of the session token, never the token, so a copy of our database cannot be replayed as a live session.
Password reset records, when a reset is requested: the SHA-256 of the reset token, when it was made, when it expires, and whether it was used. A reset token is valid for thirty minutes.
Your scopes: the name, label, and note you give a scope, and the name of the key that encrypts it. Never the key.

There is no billing information, because nothing is sold. There is no waiting list, and no form on this site collects an address.

4. What your brain holds, and which area we can read

This is the part that matters most, and it is a choice you make per page. The two areas are described on the landing page and the mechanism is on the security page.

Open area. We store the path and the body as markdown and our server reads them. It indexes the body so an agent can search it, and it keeps previous versions of a page. That is deliberate: it is what lets an agent holding no key reach a brain from a phone or a hosted surface.
Secure area. Your device encrypts the body and the path before they reach us, under a key we never receive. We hold ciphertext and cannot read it. What remains visible to us there is scope names, node identifiers, counts, approximate sizes, and timing. The limits section lists that residue rather than hiding it.

In both areas the brain records which credential made each write — an OAuth client id or a token subject — as an opaque identifier in the node's version vector and, for open-area writes, in its history. It never records which person or which agent sat behind the credential. The brain's database holds no email address, no IP address, and no user-agent; the brain host's access log does, and section 8 describes it.

We do not use your content to train models. We do not sell it, rent it, or trade it, and we do not build advertising profiles.

5. How we use what we collect

To run the Service: authenticate you, keep a session, store and sync your content, and serve it to the agents you connect.
To keep the Service safe: rate limiting, and investigating abuse or an incident.
To answer you when you write to one of our addresses.

That is the whole list. We do not profile you, we do not score you, and we run no automated decision-making about you.

6. Cookies and browser storage

This website sets no cookies. The account plane sets two, and both are functional:

ib_session: strictly necessary, set by our server. It holds a random session token and nothing else. HttpOnly so scripts cannot read it, Secure so it travels only over HTTPS, SameSite=Lax, path /, domain .instibrain.ai so the same sign-in works across our subdomains, and it expires thirty days after you sign in. Signing out deletes it.
sidebar_state: set by the page itself, remembering whether you collapsed the sidebar. It holds true or false, lasts seven days, and your browser sends it to my.instibrain.ai with each request; nothing on our side reads it.

The account plane also keeps two keys in your browser's local storage, brain.lastPage and brain.openFolders, so it reopens where you left off. They stay in your browser.

There are no analytics, advertising, or preference cookies to consent to, which is why you see no cookie banner. There is nothing a banner could meaningfully ask.

7. Third parties

One third party holds your data: the provider whose servers we rent holds the disks it sits on, and for the secure area those disks hold ciphertext. No other third party processes it for us. Checked against our dependencies, not against intent:

No analytics or product telemetry of any kind, on either the website or the account plane.
No error or crash reporting service.
No payment processor, because nothing is sold.
No email delivery service. The account plane sends no email at all today. It makes no outbound network calls whatsoever. A password reset link is produced by an operator and handed to you directly. If we add a mailer, this section changes before it ships.

Two third parties do load in the account plane, and they should not. We would rather write this down than let you find it in a network tab. When you use my.instibrain.ai, your browser fetches:

Google Fonts, from fonts.googleapis.com and fonts.gstatic.com, for one typeface.
Iconify, from api.iconify.design, for interface icons.

Each request tells that service your IP address, your user-agent, and that you loaded a page on our account plane. Neither receives your content, your email, or your session, and neither is used to analyse you. They are there because the account plane was built from a template that loaded them, and they are on our list to remove by self-hosting both. Until this paragraph says otherwise, assume both still load.

The marketing site you are reading has neither, and is bound by a rule that forbids adding them.

8. Data security

In transit: HTTPS everywhere, with HSTS. Plain HTTP redirects.
Secure-area content: encrypted on your device with ChaCha20-Poly1305 under a key derived per node. Scope keys are wrapped with X25519 and ML-KEM-768 together, so a recording made today does not become readable when one of the two falls. The key never reaches us.
Open-area content: encrypted in transit and protected by access control, but readable by our server by design. Do not put something in the open area that you would not want us to be able to read.
Passwords: scrypt hashes with per-user salts, compared in constant time.
Session and reset tokens: stored as SHA-256 digests, never in the clear.
Application logs: our logger accepts a fixed set of fields and has no free-form escape hatch. It records an event name, a request id, the matched route pattern rather than the URL, a status, timing, and opaque identifiers including your user id. It cannot record an email address, an IP address, a token, a password, a node path, or your content. Database driver messages are reduced to an error code first, because a driver message can carry the value that caused the error.
The brain host writes an access log, and it is the most sensitive file we keep. Requests to brain.instibrain.ai are logged with the caller's IP address, user-agent, method, status, and the full request URI. Because an open-area read names the page in its query string, open-area node paths appear in that log in the clear. Secure-area paths are ciphertext everywhere, including here. This is the one place at our web layer where an address is written down, and we would rather name it than have you find it.
Network boundaries: the internal management surface and the account plane's brain path are restricted to known addresses.

No system is perfectly secure, and we make no claim that ours is. The security page states what the design covers and what it does not, including that a write is authorised by a bearer credential rather than a signature.

9. Retention

Stated as it actually works, which means some of it is manual:

Sessions: expire after thirty days, and expired rows are swept automatically.
Password resets: expire after thirty minutes.
OAuth grants: authorisation codes, expired access tokens, and clients registered but never used are swept on a timer.
Your content: kept until you delete it. Two caveats worth knowing. A page edited through the open door — by an agent, or at my.instibrain.ai — keeps every previous version indefinitely, so replacing its text does not remove what it said before. A page written by the sync client does not record history that way, so this is version history for one door, not an audit trail of every change. And deleting a node writes a tombstone rather than removing the row, so the fact that a node existed outlives its content.
Account data: kept while the account exists. There is no automated retention schedule, and no delete button in the product. Ask us at privacy@webwork.ai and we will delete the account and its data by hand. Removing a user takes that user's sessions and reset records with it.
Backups: the databases are dumped nightly and the most recent fourteen are kept, encrypted in transit to storage we control. No third party holds them. A deletion therefore takes up to about two weeks to age out of backups, and we will not restore a deleted account from one.
Logs: application logs go to the system journal and the brain access log to a file on the server, both rotated by the operating system at its defaults. We have not set a fixed retention period for either, and claiming a number here would be untrue. Setting one is on our list.
Email you send us: kept as long as needed to deal with it.

10. Your rights

Depending on where you live, you may have rights under the GDPR, the UK GDPR, or the CCPA and CPRA: to know what we hold, to get a copy, to correct it, to delete it, to restrict or object to processing, and to be free from discrimination for exercising any of them. We have no personal information to sell, so there is nothing to opt out of selling.

Write to privacy@webwork.ai and we will act on it. We aim to reply within thirty days. We may need to confirm you control the account before we act on a request about it.

One practical limit, stated because it is real: for secure-area content we hold ciphertext and no key. We can delete it, and we cannot produce it in readable form for an access request. The readable copy is the one on your device.

11. International transfers

Our servers are in Europe and the company is in the United States, so data is accessed from both. We have signed no Standard Contractual Clauses or other transfer agreement. If you need one before you use the Service, write to privacy@webwork.ai.

12. Children

The Service is for organisations and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, write to privacy@webwork.ai and we will delete it.

13. Do Not Track

Some browsers send a Do Not Track signal. There is no agreed standard for responding to it, so we do not act on it specifically. It makes no practical difference here: this site runs no tracking to switch off.

14. Changes to this policy

We will update this page when what we do changes, and change the effective date at the top. For a material change affecting account holders we will tell them directly. The rule we hold ourselves to is that this page changes before the practice does, not after.

15. Contact

WebWork AI, Inc.
1207 Delaware Avenue, Suite 513
Wilmington, DE 19806, United States

Privacy: privacy@webwork.ai
Security: security@webwork.ai
Legal: legal@webwork.ai
Anything else: hello@webwork.ai

What we collect, what we store, and what we cannot read.