Privacy

Plain-language summary: MAAD Brain is a hosted, early-access preview. Your memory content lives as Markdown on a server we operate. We do our best to keep it private to you, but this is not a production-hardened product yet. Do not store anything you would not be comfortable losing, corrupting, or inadvertently exposing.

What we collect

• OAuth identity: your provider (GitHub or Google), provider account id, name, email, and avatar URL.
• Bearer tokens you issue to yourself. Tokens are hashed (SHA-256) at rest — we cannot recover a token you lose.
• Brain content: every Markdown document, frontmatter field, and git commit you write into your brain.
• Minimal request metadata (timestamps, last-used-at) for token hygiene.

Where it lives

Brains are stored on an encrypted block volume attached to a VPS we operate. Nightly backups are encrypted client-side and sent to Backblaze B2. Tenant isolation is at the folder and schema level (Tier 2) — same model as Notion, Linear, or Roam. We do not use zero-knowledge per-user encryption; doing so would break the cross-agent shared-memory feature that is the point of this product.

Who can read your brain

• You, via any MCP-compatible agent you hand a bearer token to.
• Operators of MAAD Brain — we avoid reading brain content, but we have the technical ability to. No third party receives it.
• Law enforcement if compelled by a valid legal request. We will notify you unless prohibited.

Third parties

We use:

• GitHub and Google for OAuth sign-in
• Cloudflare for DNS and edge proxy
• Backblaze B2 for encrypted backups

We do not sell your data. We do not run analytics or ad trackers.

Your controls

• Revoke any bearer token from the dashboard at any time.
• Request deletion by emailing luis@patchnet.ai. We will remove your brain and user record within 30 days. Backups roll off within 90 days.

Changes

This is an early-access preview. We will update this policy as the product matures. Material changes will be announced on the dashboard before they take effect.