Privacy Policy

Effective July 28, 2026

Brain50 is a local-first desktop application. Google OAuth credentials are stored on your device and Google API requests are made directly from your device. When you direct Brain50 to analyze connected content, the content needed to perform that request may be sent to OpenAI for processing.

This Privacy Policy describes how Streetbeat, LLC (“Streetbeat,” “we,” “us,” or “our”) handles information when you use Brain50, including its Gmail, Google Calendar, and Google Drive integrations.

1. Information Brain50 accesses

Depending on the integrations you choose to connect, Brain50 may access:

• Gmail: message identifiers, headers, senders, recipients, subjects, dates, snippets, message bodies, attachments, labels, and draft or sent-message data. Brain50 may search and read mail and, only when you request and approve it, apply labels, move messages to or from Trash, create drafts, or send messages.
• Google Calendar: calendars, events, dates, descriptions, locations, attendees, and availability. Brain50 may read calendars and, only when you request and approve it, create, update, or delete events.
• Google Drive: file and folder names, metadata, search results, and file contents that are available under the access you grant. Brain50’s Google Drive integration is read-only and does not modify or delete Drive files.
• Local project information: files you add, project instructions, reports, and other content stored in your Brain50 workspace on your device.
• Account and service information: your work email and basic profile information when you use Streetbeat-managed sign-in, together with operational information needed to provide downloads, entitlements, and account administration.

2. How information is used

Brain50 uses this information only to provide or improve user-facing features that you request, including:

• searching, summarizing, and answering questions about connected information;
• creating evidence-grounded reports and local project deliverables;
• performing an email or calendar action that you explicitly request and approve;
• maintaining the connection you choose to authorize; and
• securing, supporting, and operating Brain50.

We do not sell Google user data, use it for advertising, or use it to determine creditworthiness or lending eligibility.

3. Google data flow and sharing

• Direct Google connection: Brain50’s desktop application completes the Google authorization flow in your system browser. Google OAuth tokens are stored locally using operating-system-protected storage. Access tokens are kept in memory while needed. The desktop application calls Google APIs directly.
• No Streetbeat token proxy: Streetbeat’s Brain50 backend does not receive or store your Google OAuth access tokens, refresh tokens, Gmail messages, Calendar events, or Drive file contents.
• OpenAI processing: when you ask Brain50’s agent to work with Gmail, Calendar, Drive, or local project content, the content required to execute that request may be transmitted to OpenAI as a service provider for model processing. This processing is limited to delivering the user-facing feature you requested. OpenAI states that API inputs and outputs are not used to train or improve its models by default. OpenAI may retain API content and associated logs under its published API data controls, including abuse-monitoring retention that is generally up to 30 days unless different approved retention controls apply. Limited authorized review of content may occur for abuse and security monitoring under those controls.
• Other disclosures: we may disclose information when required by law, to protect users or the service, or in a corporate transaction, subject to applicable law. We do not authorize a recipient to use Google user data for unrelated purposes.

Streetbeat personnel do not read Google user data obtained through the integrations except when you have given affirmative consent for support, when necessary to investigate abuse or a security incident, or when required by law. The desktop architecture ordinarily gives Streetbeat personnel no server-side copy of that Google user data to access.

4. Google API Limited Use

Brain50’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to create, train, or improve a generalized or foundation AI model.

5. Storage and retention

• Google OAuth refresh tokens are stored in encrypted form on your device. Access tokens are held in memory while needed.
• Content imported into a Brain50 project is stored in that project’s local files until you delete it.
• Streetbeat’s Brain50 backend may retain account, entitlement, security, and billing-administration records for as long as needed to provide and protect the service and meet legal obligations. Those records do not include Google OAuth tokens or Google Workspace content obtained by the desktop integrations.
• Content processed by OpenAI is subject to OpenAI’s applicable API retention controls, as described above.

6. Your choices and deletion

• You choose which Google integration to connect and can decline any requested permission.
• Brain50 requests confirmation before Gmail or Google Calendar mutations.
• You can disconnect an integration in Brain50. Disconnecting removes the local credential for that integration. You can also revoke Brain50 from your Google Account’s third-party access settings.
• You can delete imported content by deleting it from the applicable local Brain50 project, or delete the project itself.
• To request deletion of Streetbeat-managed account records, contact dev@streetbeat.com. We may retain information where legally required or necessary to protect the service.

7. Security

Brain50 uses safeguards designed to protect information, including system browser authorization with PKCE, state verification, operating-system protected credential storage, encrypted transport, least-privilege integration scopes, and explicit approval before external mutations. No method of storage or transmission is completely secure.

8. Business and organization accounts

If your organization provides Brain50, your organization may administer your access and may have its own policies governing your use of connected information. Contact your organization for details about its practices.

9. Website information

The Brain50 website and download portal may process ordinary server logs, such as IP address, request time, requested URL, user-agent information, and security events. When you sign in to the portal, it uses secure, HTTP-only cookies to maintain the sign-in flow and session. The website requests font files from Google Fonts and CDNFonts and the visual logo library from the unpkg content-delivery network; those providers receive the network information necessary to serve the requested files. We use website information to provide, secure, diagnose, and operate the website and downloads.

10. Changes to this policy

We may update this policy as Brain50 changes. We will post the revised policy here and update the effective date. Material changes will be communicated as required by applicable law.

11. Contact

Streetbeat, LLC
228 Hamilton Avenue, 3rd Floor
Palo Alto, CA 94301, United States
dev@streetbeat.com