Privacy Policy

The short version

Who we are

Just is built and operated by Just Second Brain (“Just”, “we”, “us”). We are the data controller for the personal data described here under the EU General Data Protection Regulation (GDPR).

You can reach us at hello@justsecondbrain.com for anything in this policy.

What we collect

Account

When you sign in with Apple, Google or an email address we receive your email, a display name if the provider shares one, and a unique account identifier. We also store your app settings: language, first day of the week, notification preferences and similar.

Content you create

This is the point of the app, and all of it is personal data because it is about your life:

• Tasks, checklists, projects and life areas, with due dates, plans and completion history.
• Habits and every check-in you log.
• Notes, and bookmarks you save, including the title and text of the linked page that we fetch to summarise it.
• Journal entries.
• Food entries and calorie estimates, and photos of meals you choose to analyse.
• Spending entries and budget categories, and photos of receipts you choose to scan.
• Flashcard decks, cards and your review history.
• Workout routines, training, stretching and mindfulness sessions you log.
• Pictures you attach to tasks and habits, and images the app generates for you.

Some of this is sensitive by nature. Food, weight-related goals, workouts and journal entries can reveal health and well-being; spending reveals finances. We treat all content with the same protections, and you decide what to put in.

Voice

When you tap the capture button and speak, your audio streams to a speech-to-text service while you talk. We keep the written transcript, not the recording. Audio is not stored by us.

Purchases

Subscriptions are bought through the Apple App Store or Google Play. We never see your card or bank details. Through our subscription provider we receive an anonymous subscriber identifier, the product you bought, its status and renewal dates, and the price tier, so we can unlock Pro features and your AI credits.

Usage and diagnostics

To find bugs and understand which features are used we collect analytics events (which screen you opened, which action you tapped, when), device and app information (device model, operating system version, app version, language, time zone), and crash and error reports. After you sign in these are linked to your account identifier and email so we can trace a problem you report.

We also record short, masked session replays. Before anything leaves your device, every piece of text is replaced with placeholder blocks and every image is blanked, so the replay shows layout and taps but never your notes, tasks or photos.

What we do not collect

• Your location.
• Your contacts, calendar or photo library beyond the single photo you pick.
• Health data from Apple Health, Google Health Connect or any other source.
• Advertising identifiers. Just has no ads and no ad tracking.

How we use it

We process your data for these purposes, each on a legal basis the GDPR allows:

We do not use your content for advertising, do not sell it, and do not use it to train machine-learning models, ours or anyone else's.

AI features

Several features send data to third-party AI providers. Each one is triggered by you, except the search index described below.

• Speech to text. Audio from the capture button streams to ElevenLabs and comes back as text. Recordings are capped at one minute and are not stored by us.
• Capture filing. The transcript or text you typed, together with the names of your projects, areas and topics, goes to OpenAI so it can suggest whether it is a task, a habit, a note or a meal and where it belongs. You confirm before anything is saved.
• Food and receipt photos. The photo you pick goes to OpenAI to estimate calories or read the receipt. The result is a draft you review.
• Bookmarks. When you save a link we fetch the page and send its text to OpenAI for a title, summary and topic suggestions.
• Memory search. So you can search by meaning rather than exact words, we create numeric “embeddings” of your notes, bookmarks and journal entries with OpenAI and store them next to the original. This happens in the background when you use memory search.
• Generated images. Titles of tasks, habits and topics you ask to illustrate go to OpenAI’s image model. The image is stored in your account.

We use these providers’ business APIs. Under their terms they do not use data sent through the API to train their models, and they retain it only for a short abuse-monitoring window before deleting it. AI output can be wrong. Calorie counts, receipt totals and filing suggestions are estimates that you should check.

Browser extension

The Just extension for Chrome saves things from the web into your Just account. It works only when you use it, and only with an account you already have: it cannot create one.

• Signing in. You sign in with your email and password, a one-time code we email you, or Google. With Google, the extension first sends the sign-in token Google gives it to our server, which checks only whether a Just account already uses that Google account. If none does, nothing is created or stored. Your session is kept in the extension’s own storage in Chrome, which websites cannot read, and is removed when you sign out.
• Saving a page, link or selection. When you choose Save to Just from the right-click menu, the extension sends the address and title of the page or link. For a note it sends the text you selected and the page it came from. Saved links are summarised as described under AI features.
• Importing bookmarks. Only if you open the import page and allow it, the extension reads your Chrome bookmark folders on your computer so you can pick some. For the folders you choose, it uploads each web link’s address, title and the date you bookmarked it, and has them summarised like any saved link, using your AI credits. Folders you do not pick never leave your computer. To skip duplicates, it checks your links against the ones already in your Just account. Import progress is kept in Chrome’s storage on your computer until the import finishes.
• What it does not do. It does not read your browsing history or look at pages you do not save. It has no analytics or tracking and shows no ads. It touches the current tab only when you save from it, to show a small confirmation card.

The extension’s use of information complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Data is used only to provide the features above. It is never sold, never used for advertising, and never used to train AI models.

Where your data lives

On your device. Just is offline-first. A full copy of your content sits in an encrypted area of your phone’s storage so the app works without a connection. It is removed when you sign out or uninstall.

In the EU. Our database, file storage and server functions run on Supabase in Frankfurt, Germany (AWS eu-central-1). Analytics and crash reports are hosted by PostHog in the EU.

Outside the EU, for specific processing. OpenAI and ElevenLabs process AI requests in the United States. RevenueCat, which handles subscription status, is also in the United States. These transfers rely on the EU–US Data Privacy Framework where the provider is certified and on the European Commission’s Standard Contractual Clauses otherwise.

Who we share it with

We share data only with the service providers below, who process it on our instructions and under contracts that bind them to confidentiality and to this policy’s limits.

Beyond that, we disclose data only if the law requires it, to protect someone’s safety, or, if Just is ever acquired or merged, to the successor who takes on this policy. We will tell you before that happens.

How long we keep it

• Content and account data: for as long as your account exists. Items you delete in the app are removed from our live systems within 30 days.
• After you delete your account: all content, files and account records are deleted from our live systems within 30 days and from backups within a further 30 days.
• Voice audio: not kept. Only the transcript is saved.
• Usage, replay and crash data: no longer than 12 months.
• Purchase records: as long as tax and accounting law requires, typically up to 10 years, in anonymised form where possible.

Your rights

Under the GDPR, and under similar laws elsewhere, you can:

• Access the personal data we hold about you and get a copy.
• Correct anything inaccurate. Most of it you can edit directly in the app.
• Delete your data (see below).
• Export your content in a machine-readable format. Email us and we will send a JSON export.
• Restrict or object to processing based on legitimate interest, such as analytics.
• Complain to your national data protection authority if you believe we have handled your data unlawfully. We would rather hear from you first.

To exercise any of these, email hello@justsecondbrain.com from the address on your account. We answer within 30 days.

Deleting your account

Open Settings in the app, choose Account, then Delete account, and confirm. Or email us from your account address and ask. Either way your sign-in is removed immediately and your content, files and search index are purged on the schedule above. Active subscriptions must be cancelled separately in the App Store or Google Play; deleting your account does not cancel a store subscription.

Security

Data travels over TLS. At rest it is encrypted by our hosting provider. Every database row is tied to your account and protected by row-level access rules, so one user cannot read another’s data even through a bug in the app. API keys for AI providers never ship inside the app; the app receives short-lived tokens from our servers instead. No system is perfectly secure. If a breach affects you we will tell you and the relevant authority as the law requires.

Children

Just is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has an account, email us and we will delete it.

Changes to this policy

If we change what we collect or how we use it, we will update this page, change the date at the top, and tell you in the app before the change takes effect. Minor wording fixes may happen without notice.

Contact

Just Second Brain
hello@justsecondbrain.com
justsecondbrain.com