ModelBrain is operated by NexSpark LLC, a Georgia limited liability company based in Buford, Georgia, USA ("we", "us"). For any personal data we hold, NexSpark LLC is the data controller. This policy is written to match how the product actually works, which for most people means we hold nothing at all. The paid services are described here as they work.
This policy covers the ModelBrain website, the ModelBrain software you install, the free ChatGPT connection, and the optional paid services: sync between your own computers (which includes managed backup) and Teams. Which parts apply to you depends on which of those you use. Most people use the software only, and section 2 is the whole story for them.
We collect nothing. There is no account, no licence check, no telemetry, no crash reporting and no update ping. Your memories, and the documents you let it read, stay in a folder on your computer. We have no copy, no index, and no way to identify you, so there is nothing for us to hand over, sell, lose or use for training. Your memories are never used to train any model, ours or anyone else's, in any mode.
An account exists only if you sign in from the app or the account page. You need one for the ChatGPT connection (free), for sync and backup, or for Teams. Signing in works by a code or link we email you, or, if you choose, through your Google, Microsoft or Apple account; we never store a password. For an account we process:
If you pay, Stripe handles your card and billing address, and Link, a Stripe service, is the merchant of record for the purchase and handles sales tax, VAT and GST. We keep the subscription and billing records Stripe sends us and never see card numbers. If your Teams organization uses single sign-on, your organization's identity provider confirms your email address to us; that changes how you prove who you are and nothing else.
ChatGPT can only reach outside tools over the internet, so its requests pass through a relay we run, which forwards each one to your computer and the answer back. The relay has to read each message to route it, but it does not store the content: it logs only the method name and the size of each message, and keeps no memory content once a response is forwarded. You sign in to your account and choose which of your computers a connection reaches, and we email you each time ChatGPT is connected to one. We keep, so you can see and disconnect connections from your account page: the name of each app you connected, which computer it reaches, when it was connected, and a count of calls per app, per computer and per hour (never the arguments or results). So that ChatGPT still gets a sensible answer while your computer is offline, the relay keeps your computer's last answer to its "what tools do you have" question, which is a list of tool names and descriptions, not memories. ChatGPT itself is a product of OpenAI, and what it does with a memory once it has one is governed by OpenAI's terms, not ours.
Memories that sync between your computers, and the backups we keep of them, are encrypted on your computer before upload, with a key that only your computers and your recovery phrase hold. We never have that key, so we cannot read your memories, cannot search them, and cannot produce them for anyone. What we do hold is real and worth naming: the encrypted data itself, its size, count and timing, the hash of each piece, and a signed index your computers use to check that nothing was altered or dropped. We also hold your vault's public keys and the encrypted copies of your vault key that your computers made for each other and for your recovery phrase, none of which lets us decrypt anything.
The same design means we cannot recover your synced data for you. If you lose every computer on the account and your recovery phrase, that data is gone, and no support request can bring it back. A partition you mark as staying on one computer, and the documents ModelBrain reads from your folders, never leave that computer at all, not even in encrypted form; that is checked before anything is sent. If your stored data passes 50 GB we email you once, so a folder added by mistake does not quietly turn into a bill.
A shared partition is encrypted with a key held only by the computers of the people it is shared with, so we cannot read what is in it either. To run an organization we keep its name; its members' email addresses, roles and when they joined; the invitations it has sent (the invited address is erased once an invitation is accepted, withdrawn or expires, after seven days); the names of its shared partitions; who may read or write each one; the signed organization log that members' computers use to check who is in and who is out; and the encrypted shared data with its sizes and timing. If the organization sets up single sign-on, we keep its identity provider's address, client ID and the domain it verified; the client secret is stored sealed with a key kept outside the database.
What people in an organization can see of each other: every active member can see the other members' email addresses and roles. Owners and admins can also see each member's computers (their names, operating system and when they were last seen), pending invitations, billing, and the organization's audit log, which records organization actions (members, roles, invitations, access changes, partition changes, key changes, billing and single sign-on changes) with who did each one, from which computer, and their shortened network address. The audit log is kept for 400 days and never contains memory content. The email address of the owner who most recently set up or changed billing is the organization's billing contact at Stripe, and every owner gets the emails about failed payments and an ending plan.
If an organization stops paying, its shared data stays readable for 30 days and is then deleted from our servers; the organization, its members and its log stay, so paying again starts a fresh upload. If an organization is deleted, its shared data, access grants, invitations and single sign-on settings are deleted 14 days later. In both cases each person's own memories, and the copy of the shared partition on each member's computer, are unaffected.
Standard server logs (IP address, user agent, requested page) are kept briefly for security and aggregate traffic counts, and no longer than 30 days. Separately, each installer download is recorded as a dated entry containing the file name and version, the country, state and time zone your request appears to come from, the website that referred you, whether it looks like an automated request, and a shortened browser identifier, with no IP address, no account and no cookie; a copy of each entry is kept in our analytics provider (PostHog) without a person profile; these entries show that and when the software was downloaded, and are kept for as long as we need that record. There are no advertising or cross-site tracking cookies of our own. Two third-party scripts run on this site: every page loads Google Fonts, so your IP address is sent to Google when the fonts load; and article pages load Google's "Add to preferred sources" button (news.google.com/swg/js/v1/publisher.js), which may set its own Google cookies if you use it. Neither is under our control. Every page also loads privacy-friendly analytics (PostHog, cookieless, no session recording, no heatmaps) so we can see which pages are useful; it runs on a separate PostHog project from any other NexSpark product, stores no cookies, and discards your IP address. The ModelBrain application itself sends none of this: see how it works. If you join the early-access list we store your email address and the date you joined, use it only to send the updates described at signup, and delete it on request or when you unsubscribe. If you use the support & feedback form we store your name (if you gave one), your email address, the category you chose and the message text, use it only to respond to you, and delete it on request.
Stripe processes payments, including through Link as the merchant of record for paid plans, and receives your email address, billing details, your plan and your device and storage counts. Brevo delivers our email (sign-in codes, invitations, receipts, billing and deletion notices, and the early-access and support-form notifications) and receives your email address and that message. Cloudflare serves this website and the API, and stores the encrypted sync, backup and Teams data in its R2 storage; it never has a key. Linode (Akamai) hosts the account service, the database and the ChatGPT relay. PostHog counts website page views as described above. If you choose to sign in with Google, Microsoft or Apple, that company handles the sign-in and tells us your email address and whether it has confirmed it, along with an identifier for that account that we don't keep. We ask for nothing else, and never receive your password. If your organization uses single sign-on, its own identity provider receives your sign-in. None of them receives your memory contents in readable form. We update this list when it changes.
Every request from your computer to our service is signed with a key that never leaves that computer, every upload is checked against a hash your computer announced, and the index of your synced data is a signed chain your computers verify, so a tampered or missing piece is noticed rather than trusted. The important part of our security is structural: the data that matters is encrypted before it reaches us, so a breach of our servers exposes ciphertext and the account details listed in section 3, not memories. If we learn of a security incident that affects your personal data, we will tell you by email without undue delay, as the law where you live requires, and say what happened, what it affects and what we are doing. The software itself does not encrypt your vault on disk; turn on your computer's disk encryption, as the security statement explains.
The website and the services with an account are not directed at children under 13, or under 16 in the European Union and the United Kingdom (or the lower age a country there has set), and we do not knowingly collect personal data from anyone below that age. If you believe a child has created an account, write to us at the address below and we will delete it. The free software collects nothing from anyone, whatever their age.
For data we hold (account, billing, email, computers, activity log, organization membership), you can ask for a copy, a correction or deletion, and we will respond within 30 days. Much of it you can do yourself: the account page shows and exports your activity log, lists your computers and connected apps and lets you disconnect them (removing an active computer is done from one of your computers, so an email alone cannot do it), and deletes the account; the app exports your encrypted synced data to a folder. For data we never hold, there is nothing to request: you already have it, and deleting your local vault is complete deletion, performed by you, with no involvement from us. We do not sell personal data and do not share it for advertising. If you are in the EU, UK or another place with its own privacy law, you may also have the right to complain to your local data protection authority.
We are based in the United States and the services with an account are operated from there. If you use them from outside the US, the data described above (account, billing, email, computers, activity log, and your encrypted sync and Teams data, which we cannot read) is transferred to and processed in the US. The free software transfers nothing anywhere.
Material changes will be noted in the changelog with a date, not applied silently, and if you have an account we will email you at least 30 days before a material change takes effect: one that affects prices, billing, what we collect, how long we keep it, or your rights. Smaller changes, such as clearer wording, are noted in the changelog only. Questions and requests: privacy@modelbrain.net, or NexSpark LLC, Buford, Georgia, USA.