Privacy Policy
Effective Date: November 10, 2026 · Version 2.2
BryDepth was engineered on a non-negotiable principle: your thoughts, files, and personal memories belong exclusively to you. This Privacy Policy outlines how your chats, documents, and Living Memory Vault data are encrypted and isolated using PostgreSQL Row Level Security (RLS), how requests are dispatched to official AI provider APIs, and why we never sell or train public models on your personal data.
1. Living Memory Vault & PostgreSQL Row Level Security (RLS)
Cryptographic tenant boundary isolation baked directly into the database engine.
When you use BryDepth, your conversational turns, uploaded documents, generated knowledge trees, and vector embeddings are stored in a dedicated Supabase PostgreSQL instance:
Every table (conversations, messages, memories, documents) has active PostgreSQL RLS policies. Database queries are authenticated via secure user JWTs, rendering cross-tenant data leaks mathematically impossible at the database layer.
High-dimensional embeddings derived from your living memory are indexed exclusively within your user workspace partition. No other user or unauthorized process can query or discover your semantic memory vectors.
2. Third-Party AI API Processing & Zero Training Guarantee
Official commercial API integration with strict data protection covenants.
BryDepth connects directly to official third-party enterprise APIs to provide model reasoning:
- Google Gemini APIGemini 2.5 Flash enterprise reasoning queries.
- OpenAI APIGPT-4o flagship model queries.
- Anthropic APIClaude 3.7 Sonnet reasoning queries.
We use strictly commercial, enterprise-tier API endpoints. Under our agreements and provider commercial policies (such as OpenAI Business Terms, Anthropic Commercial Terms, and Google Cloud Vertex/Gemini Enterprise APIs), your prompt data, memory context, and uploaded files are NEVER used to train, retrain, or improve public foundation models.
We Never Sell, Rent, or Broker Your Personal Data
- We do not sell personal information, chat histories, or contact details to third-party ad networks, data brokers, or marketing firms.
- We do not inject third-party ad trackers, tracking pixels, or cross-site fingerprinting scripts.
- We do not monetize your data—our revenue model relies solely on transparent 30-day prepaid passes via Creem.io.
3. 14-Day Free Trial Integrity & Minimal Signal Verification
Protecting server availability without invasive hardware fingerprinting.
We provide a genuine 14-day free trial without requesting credit card details. To prevent automated bot farms from depleting server infrastructure, we collect minimal, non-invasive verification signals:
Your email is normalized (lowercased, alias-stripped) and salted using HMAC-SHA256. We never store plain hashes that could be indexed or matched via rainbow tables.
A random UUID stored in a secure, HttpOnly, SameSite cookie (brydepth_did), solely used to maintain browser session context and prevent instant trial cycling.
Coarse network subnets (/24 for IPv4, /48 for IPv6) are hashed before storage to prevent burst script attacks. We never retain raw, unhashed IP addresses in permanent storage.
Transient session logs, risk counters, and network diagnostic timestamps are automatically expunged after 90 days.
4. Data Retention Schedules & Account Deletion (GDPR Art. 17)
Clear retention schedules and total control over your data lifecycle.
| Data Category | Storage Purpose | Retention Period | On Account Deletion |
|---|---|---|---|
| Conversations & Memories | AI Living Memory Vault | Until user deletes or requests deletion | Permanently destroyed immediately |
Device Sessions (brydepth_did) | Session integrity | 90 days (automatic TTL purge) | Decoupled and purged |
| IP Subnet Hashes | Rate limiting & abuse prevention | 90 days (automatic TTL purge) | Decoupled from identity |
| Payment Records (Creem.io) | Tax & accounting compliance | As required by statutory financial regulations | Retained pseudononymously for tax records |
Privacy Inquiries & Data Rights Requests
To exercise your GDPR data access rights, request an export of your Living Memory Vault, or submit an erasure request, please reach out to our privacy officer: