Privacy Policy

OneBrain, by Apex Labs · Last updated 9 September 2026 · Contact: or@apxlbz.com

OneBrain is a shared memory for organizations: it ingests the work conversations and records your organization chooses to connect, distills them into durable facts, and makes them searchable by the people of that organization — and only them.

What we collect

• Account data. Your name and email address from Google Sign-In, used to identify you and to key your organization by its email domain.
• Connected sources you authorize. Depending on what your organization connects: Gmail messages (read-only), Google Drive meeting notes and transcripts (read-only), Google Calendar events (read-only), and Trello board content (read-only). We request only read access and cannot modify or delete anything in those services.
• Other tools you connect. Any remote service your organization connects through its MCP server (for example Notion or Linear). OneBrain reads through the one tool you chose for it and stores what comes back as facts; the grant you approve there can be revoked in that service at any time.
• Content you submit. Notes and context written into OneBrain through its tools and integrations.
• Usage metering. Token counts of the processing we perform for your organization, used for billing. We do not use third-party advertising or analytics trackers.

How we use it

Connected content is processed to extract durable organizational knowledge (facts, decisions, commitments), which is stored with vector embeddings so your organization can search it. Processing is performed by large-language-model providers acting as our processors; content is never used to train their models. We do not sell personal data, and we do not share it with third parties except the processors necessary to run the service (hosting and model inference).

Google user data — Limited Use

OneBrain's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the organization-memory features the user sees, is never used for advertising, is never sold, and is transferred to humans only with consent, for security, or to comply with law.

Where it lives

Data is stored in a per-organization tenancy on Supabase (PostgreSQL), encrypted in transit and at rest. Access is enforced by row-level security: members of an organization can only ever read their own organization's rows. OAuth tokens are stored encrypted in a dedicated secrets vault.

Retention and deletion

Data is retained while your organization uses the service. From Settings, an organization can delete all of its memory, or delete the organization entirely — the latter also revokes each connected source's access at the provider (Google token revocation, Trello token deletion). You can also revoke OneBrain's access at any time from your Google Account permissions.

Changes

If this policy changes materially, we will note the change on this page with a new date. Questions and requests: or@apxlbz.com.