Know where the work goes.
This is a product-source draft, not a published or legally approved privacy policy. BriefHarbor does not yet have a verified production domain, operator identity, effective date, or support mailbox. Do not use this route as App Store or customer-facing legal evidence until those external gates are closed.
What BriefHarbor is designed to handle
- Account and collaboration data: name, email address, authenticated account subject, workspace memberships, roles, invitations, and security/audit records.
- Creative workflow data: brands, projects, research questions and sources, briefs and immutable versions, rights and consent attestations, reference metadata, prompts, recipes, reviews, revisions, approval hashes, schedules, handoff records, and aggregate workflow events.
- User content: reference images, video, audio, transcripts, and generated candidates only when a user chooses a cloud workflow. The native companion keeps capture/import and transforms on the device by default.
- Commercial and support data: subscription status, product and entitlement identifiers, transaction lifecycle state, support receipts, and messages sent to support. BriefHarbor is not designed to receive payment-card numbers directly.
- Operational data: bounded request metadata, error state, idempotency keys, job state, and privacy-safe event dimensions needed to secure and operate the service.
How data is designed to be used
Data is used to authenticate users, enforce workspace roles and subscriptions, run the requested research and creative workflow, preserve provenance, process user-directed provider jobs, recover failures, deliver collaboration notices, provide portability and deletion receipts, prevent abuse, and measure whether the product workflow completes.
Ordinary analytics exclude raw media, prompts, provider payloads, customer identifiers, and platform performance. The native companion does not include an advertising, IDFA, PostHog, or cross-company tracking SDK in the current source graph. See the source-bound privacy and rights guidance for reporting a concern.
Local and cloud boundaries
Native originals and local derivatives stay in the device library unless the user deliberately exports or shares them. A visible OS share-sheet handoff is not proof that a destination published the media.
The web operator is designed to use Cloudflare infrastructure for authenticated application state, private media, queues, transactional email, and receipts. Better Auth supplies the session boundary. Stripe is the planned authority for web subscriptions and RevenueCat for the Apple companion. Fal or LightReel receive data only when their capabilities are explicitly enabled and a user-authorized job passes rights, model, and cost gates. Those production services are not currently configured or verified.
Control, retention, and deletion
Authorized users can export workspace metadata and lineage. Original media is not bundled into that metadata export. The in-app account deletion flow issues export and support receipts, revokes BriefHarbor session bridges and agent access, removes memberships, and queues sole-owner workspaces for purge. Data in a shared workspace remains available to its other members.
Provider, payment, Apple, email, fraud-prevention, legal, and backup retention may require separate handling and cannot be represented as erased by a local receipt. Hosted residual-data and provider-deletion proof remain launch gates. The source-only deletion guidance is at Delete account.
Security and choices
BriefHarbor is designed around tenant-scoped authorization, short-lived provider media access, hashed personal-access tokens, idempotent paid mutations, account-epoch revocation, and deletion-aware job fences. These source controls do not substitute for a deployed security review.
Users choose whether to upload reference media, request an external generation, use optional speech assistance, purchase a subscription, or hand an export to another app. A denied optional permission must leave unrelated local capabilities available.
Contact and policy status
The planned contact is support@briefharbor.com, but mailbox ownership and delivery have not been verified, so this source draft does not open an email action. Operator identity, jurisdiction-specific rights, retention periods, processors, international transfer terms, and the effective date require legal and production-account review before publication.