One Brain · Prophet

Privacy Policy

Last updated: October 7, 2026

One Brain is a product by Prophet that works as a company’s collective memory: it stores and connects the team’s decisions, progress and knowledge so they are available when needed. This policy describes what data we handle, what for, and who we share it with.

What data we collect

• Account data: your name, email address and (if you sign in with Google) your profile picture. We use them only to identify you and give you access to your company’s brain.
• Content you save: the memories, notes, decisions, meetings and entities that you or your team add to One Brain.
• Meeting transcripts: if someone on your team brings in a meeting recorded with Granola (with the brain_reuniones tool or from the plugin), One Brain stores its title, date, participants, a summary and the full transcript. Everyone in your company’s brain can see it and search it. One Brain does not connect to Granola and holds no Granola credentials: the data is passed in by the assistant of the person who brings the meeting in, from their own Granola connector.
• Inventory of the team’s keys: the name of each key or token your team chooses to store, and what it is for. The value is stored encrypted (AES-256-GCM) and no connector tool returns it, not even to your assistant: it can only be retrieved with the One Brain plugin’s local command (onebrain-secret), which copies it to the clipboard without passing it through the conversation. Every upload and every retrieval is logged with who and when.
• Claude Code session summaries (only if you install the plugin): for the Semana view, the plugin uploads each session’s title, first message, folder and repository, times, models, tokens, estimated cost and your own commits. It does not upload the rest of the conversation.
• Minimal technical data: access and usage logs needed to run and protect the service (for example, to limit abuse).

What we use the data for

• Authenticating you and showing you only your company’s brain.
• Storing, searching and connecting your team’s memory (including semantic search).
• Keeping the service secure and running.

We do not sell your data or use it for advertising. Each company (tenant) is isolated: one brain cannot see another company’s brain.

Use of Google data

When you sign in with Google, we receive your email, name and profile picture, for the sole purpose of authenticating you. One Brain’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use that data to train models or transfer it except as strictly necessary to provide the service.

Who we share data with (subprocessors)

We rely on infrastructure providers that process data on our behalf:

• Supabase — database and authentication.
• Vercel — application hosting.
• PostHog — site analytics: which pages are visited, where people come from and how many create their brain. If you sign in, it links those visits to your email.
• Voyage AI — embeddings for semantic search.
• Google — sign-in (OAuth).
• Resend — sends the team invitation and account-activation emails: it receives the person’s email, the company name, who invited them and the link.
• TypeSafe — only in brains that turn on the automatic review of contradicting memories: it receives the two texts of each pair under review.
• Telegram — only if your team links a Telegram group: to-dos left with brain_mention are also posted in that group, where its members can see them.

One Brain’s server does not run language models of its own. Content reaches Claude or ChatGPT because you connect One Brain from your account there, and Anthropic or OpenAI handles it under its own terms.

Security

We encrypt data in transit, hash access tokens, isolate each company at the data level and limit administrative access. No system is infallible, but we treat security as a priority. The team’s keys are stored encrypted and can only be retrieved from the local plugin, never from a conversation.

Retention and deletion

We keep your data while your account is active. If you stop using the service or ask us to, we delete or export your company’s data. Write to us to exercise any of these rights.

Your rights

You can ask to access, correct or delete your personal data, and request a copy of your company’s information. We answer these requests within a reasonable time.

Contact

For any question about this policy or your data, write to bautista@prophet.lat.

Leer esta política en castellano.

One Brain — Prophet. This page describes actual data-handling practices.