Privacy Policy

Account information. When you sign up with email and password, we collect your email address and a hashed password. We do not store your password in plain text. If you sign up using Google Sign-In, we collect your email address, name, and profile picture as provided by Google. See "Google Sign-In" below.

Google Sign-In. If you choose to sign in with Google, we receive from Google your email address, your name, and your profile picture. We use this information solely to create and identify your Brainmunk account. We do not receive your Google password or access to any other Google services or data.

Course inputs. We store the topics, experience-level answers, and other inputs you provide to generate courses, along with the generated course content itself.

Usage data. We collect information about how you interact with the Service — pages visited, courses generated, lessons completed, and features used. This helps us improve the product.

Payment information. Payments are handled by Stripe. We receive a confirmation and a masked card number (last four digits); we do not receive or store full card details.

Cookies and local storage. We use cookies and browser storage to keep you logged in and remember your preferences. We do not use third-party advertising cookies.

• To create and deliver your account and generated courses.
• To process payments and manage your subscription.
• To send transactional emails (account confirmation, password reset, billing receipts).
• To improve the Service — analyzing usage patterns and fixing problems.
• To respond to your support requests.
• To comply with legal obligations.

We may share, license, or transfer aggregated or de-identified data to third parties for business, research, or commercial purposes. When we do, we take reasonable steps to ensure that data cannot be used to identify you individually. We do not sell data in a form that directly identifies you by name or email address without your explicit consent.

We may use aggregated or de-identified data derived from your use of the Service to develop, train, or improve our own AI models and services. We make no commitment about whether data is used in connection with third-party AI model training.

We share data only as needed to operate the Service:

• AI service providers (currently including Anthropic) — your course topic and intake answers are sent to one or more AI providers to generate course content. We may change or add AI providers at any time. Each provider's own privacy policy governs their handling of this data.
• YouTube / Google — search queries are sent to the YouTube Data API to find relevant videos. No personal account data is shared.
• Stripe — payment details are processed by Stripe. See Stripe's privacy policy for details.
• Supabase — our database and authentication provider. Data is stored in their infrastructure.
• Vercel — our hosting provider. Standard server log data (IP address, request metadata) passes through their infrastructure.

We may also disclose information if required by law or to protect the rights, property, or safety of Brainmunk, our users, or others.

We retain your account data and course history for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal or financial compliance purposes.

Depending on where you live, applicable law may give you rights over your personal data. This includes rights under the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and similar laws in other jurisdictions. These rights may include:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data ("right to be forgotten").
• Object to or restrict certain types of processing.
• Receive a copy of your data in a portable format.

To exercise any of these rights, email us at contact@brainmunk.ai. We will respond within 30 days.

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will delete it promptly. If you believe a child under 13 has provided us personal data, please contact us.

We implement industry-standard safeguards including encrypted data storage, HTTPS for all data in transit, and hashed passwords. No system is perfectly secure, however, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above and, for material changes, notify you by email. Continued use of the Service after changes take effect means you accept the updated policy.

Privacy questions or requests? Reach us at: