Privacy Policy

OneBrain, by Apex Labs · Last updated 11 October 2026 · Contact: or@apxlbz.com

OneBrain is a shared memory for organizations: it ingests the work conversations and records your organization chooses to connect (or that your tools send it), distills them into durable facts, and makes them searchable by the people of that organization — and only them. This page says plainly what we store, who else touches it, and how you get it out or get rid of it.

What we collect

• Account data. Your name and email address from Google Sign-In (handled by Supabase Auth). The email is used to identify you, to key your organization (by your email domain, or as a personal organization for consumer addresses), and to record your role (owner or member) and when and from which surface (web, API, MCP, a hook) you were last seen. We also keep per-member counters of recalls and remembers.
• Memory content. Everything stored as memory: the raw inputs (messages, notes, transcripts, tool exchanges), the facts, entities, relationships and summaries distilled from them, and the vector embeddings used to search them. Content you send through the API, MCP tools or the Claude Code hooks is stored as-is, except that likely credentials (API keys, passwords, high-entropy secrets) are redacted before storage. Redaction is best-effort; don't send secrets on purpose.
• Connected sources you authorize. Depending on what your organization connects: Gmail messages (read-only), Google Drive meeting notes and transcripts (read-only), Google Calendar events (read-only), and Trello board content (read-only). We request only read access and cannot modify or delete anything in those services.
• Other tools you connect. Any remote service your organization connects through its MCP server (for example Notion or Linear). OneBrain reads through the one tool you chose for it and stores what comes back as facts; the grant you approve there can be revoked in that service at any time.
• Credentials. OAuth tokens for connected sources, and any Anthropic or Voyage API keys your organization supplies, are stored in Supabase Vault. Personal API tokens (ob_…) are stored only as SHA-256 hashes; we can't read them back.
• Billing data. Your plan, credit balance and ledger, and the Stripe customer and subscription IDs for your organization. Payment card details go to Stripe and never touch our servers.
• Usage metering. For every model call made on your organization's behalf: the operation, provider, model and token counts (not the content), used for billing and capacity limits.
• Activity records. A forget_audit row for every forget request (who asked, which surface, the selector they typed, the ids removed — never the deleted content), recall events (used to rank and tune search), and fact feedback ratings.
• Email. We send you product emails (onboarding, tips, occasional newsletters) and keep a record of which we've sent. Every one has an unsubscribe link.
• Status page subscribers. If you enter your email on the status page to be notified of incidents, we keep just that address and a random token, with no account attached. We email it only for status updates; the confirmation email includes a one-click unsubscribe link that deletes the address from this list.
• Anti-abuse trial records. To stop one person claiming the free trial repeatedly, we keep a record of trial claims keyed by a normalized form of your email address or domain. See "Retention and deletion" for how this one behaves.
• No advertising or analytics trackers. We don't run third-party analytics, ad pixels or cross-site tracking. Server logs are kept for operating the service, with provider error text truncated and credentials redacted.

How we use it

To run the service: extract durable organizational knowledge (facts, decisions, commitments) from connected content, embed it so your organization can search it, answer recall and MCP requests, enforce roles and limits, send you product email, and bill you. Your content is not used to train models — ours or our processors'. We do not sell personal data, and we don't share it except with the processors listed below.

Who processes it

These providers handle data on our behalf to run the service:

• Supabase — database (PostgreSQL), authentication, Vault and edge-function hosting.
• Stripe — payments and subscriptions. Receives your organization's name and ID and whatever you enter at checkout.
• Language-model providers — memory content is sent to a model to extract facts and judge what's worth keeping. If your organization brings its own Anthropic key, that is Anthropic (under your key and terms with them); otherwise the OneBrain-provided engine runs on an open-weights model hosted by DeepInfra.
• Embedding providers — text (and your search queries) is sent to an embedding model to produce vectors: Voyage AI if your organization supplies a Voyage key, otherwise the OneBrain-provided embedding model on DeepInfra. An organization's embedding provider is fixed when it first needs one.
• Resend / SMTP — delivers product email to your address.
• Sources you connect — Google, Trello and any MCP service, at your direction.

Content leaves our infrastructure only to the model, embedding and source providers above, to do the job you asked for.

Google user data — Limited Use

OneBrain's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the organization-memory features the user sees, is never used for advertising, is never sold, and is transferred to humans only with consent, for security, or to comply with law.

Where it lives and who can see it

Data is stored in a per-organization tenancy on Supabase (PostgreSQL), encrypted in transit and at rest. Access is enforced by row-level security and by the API: members of an organization can only read their own organization's memory. Memory is shared across the organization by design — anyone in your organization can recall what any connected member's sources contributed. Destructive actions (deleting memory or the organization) require an organization owner.

Your rights: access, export, deletion

• Access and export. GET /v1/export returns your organization's memory as JSON: raw inputs, facts, entities, relationships and summaries, ids preserved. Embeddings are omitted (they're model-specific and reproducible), and anything already forgotten is not included.
• Forget specific things. POST /v1/forget (or the forget tool) permanently deletes chosen facts and the inputs they came from, by id or by matching text. It is a hard delete, not a tombstone. Bulk matches need explicit confirmation, and you can dry-run first.
• Erase all memory. POST /v1/purge deletes every input, fact, entity, relationship, summary and recall record for the organization; the account, tokens and connections stay. Owner only, with the organization name typed back.
• Delete the organization. POST /v1/reset (also in Settings) cancels the Stripe subscription, revokes each connected source's access at the provider (Google token revocation, Trello token deletion), purges all memory, deletes the organization row — which cascades to members, API tokens, connections, usage, billing ledger and audit records — and deletes its Vault secrets. Owner only, with the organization name typed back. Irreversible.
• Revoke access. You can also withdraw OneBrain's access from your Google Account permissions at any time.
• Corrections and anything else. Email or@apxlbz.com. If you're a member who wants your own data handled and not the whole organization's, ask us; we'll work with your organization's owner.

Retention

Memory is kept while your organization uses the service, until it is forgotten, purged or the organization is deleted. Backups held by our database provider age out on their normal schedule after deletion. Two records deliberately outlive an organization reset: Stripe's own financial records (which Stripe and tax law require it to keep), and our anti-abuse trial-claim record (a normalized email or domain key, an organization ID and a date), which exists so deleting and re-creating an organization can't be used to claim another free trial. Email us if you want that record removed.

Changes

If this policy changes materially, we will note the change on this page with a new date. Questions and requests: or@apxlbz.com.