Privacy policy

Effective 3 November 2026

Second Brain is a personal assistant that Moses Adebayo builds and runs for his own use. It runs on his own computer. It is not offered to the public, and the only Google accounts connected to it are his own. This policy says what it does with the data it can reach.

What it accesses

When an account is connected, Second Brain asks Google for these permissions:

• Read Gmail (gmail.readonly): to sync recent mail, sort it, flag what needs attention and answer questions about it.
• Create Gmail drafts (gmail.compose, optional): when the owner approves a suggested reply, it is saved as a draft in that Gmail account. Second Brain never sends email. The owner reviews and sends drafts himself in Gmail.
• Read Google Calendar (calendar.readonly, optional): to include the day's events in the morning brief and answer questions about the schedule. It never creates, changes or deletes events.
• Basic profile (openid, email): to know which account was connected.

Where data is kept

• Synced mail, calendar results, notes and conversation history are stored in a database on the owner's computer. They are not uploaded to any server run by Second Brain, because there isn't one.
• The Google sign-in token is kept in the macOS Keychain on that computer.
• Text is turned into search vectors by a model that runs on the same computer.
• Activity logs used to debug the assistant are kept by a Langfuse instance running on the same computer.

Who else sees it

To read, sort and reply to mail, Second Brain sends the relevant text (for example an email's sender, subject and body) to an AI model provider to be processed. Depending on the task and on which provider is available, that is one of:

• Anthropic (Claude models)
• Groq
• OpenRouter, with its data-collection setting turned to "deny", so the request only goes to providers that don't store or train on prompts
• A model running on the owner's own computer (Ollama), in which case nothing leaves it

Each provider handles that text under its own API terms. Alerts and the morning brief are sent to the owner through a Telegram bot, so Telegram receives the text of those messages, which can include short summaries of mail.

Google user data is not sold, not shared for advertising, not used to build profiles for anyone else, and not used to train general AI models. No one other than the owner reads it.

Google API Services User Data Policy

Second Brain's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Keeping and deleting data

• When an account is first connected, the inbox is synced for the most recent 14 days, then kept up to date. Older mail, such as sent mail used to learn how the owner writes, is only pulled in when the owner starts that himself.
• Disconnecting an account (make disconnect) deletes its Google token from the Keychain and deletes that account's stored messages. Notes or summaries made from those messages are kept until the owner deletes them.
• Access can also be withdrawn at any time from Google Account → Third-party apps. After that Second Brain can no longer read anything new.

Security

The services listen only on the owner's computer, apart from the Apple Shortcuts endpoint, which needs a secret token. The web browser Second Brain uses for job searches runs with Chrome's sandbox turned on and its own profile, separate from the owner's personal browser.

Changes and contact

If what Second Brain does with data changes, this page will be updated and the date above changed. Questions: adebayomoses597@gmail.com.