Your data is yours.

We store your account email, name and profile image when provided, account identifiers, and email verification status. Google sign-in requests only basic identity information: email, profile, and OpenID. Apple sign-in requests your name and email, which may be an Apple private relay address. We use this information to create your account, recognize you when you return, and associate your projects and subscription with you.

Our authentication system stores provider account records and returned authentication tokens, plus session records that can include your IP address and browser information. First-party cookies keep you signed in. If you choose email sign-in, Resend receives your email address and a temporary sign-in link to deliver the message.

Saved projects and conversations can include your prompts, agent responses, project memory, and activity summaries. These are stored in our database so you can return to your work, and some are cached in your browser. When you run an agent, the selected model provider receives the prompt, context, and any supported attachments included in that request.

Where hosted AI is available, our server sends model requests to Anthropic and may send generated search queries to Tavily when search is enabled. Web tools can send requested URLs and search queries through our server to public websites. The providers you use also process data under their own policies; we do not promise zero retention by those providers.

Your Anthropic or xAI API key is saved in this browser's local storage and sent directly to that provider for model requests. It is not saved in our account database. You can remove it from the API key panel. This does not prevent saved conversation content or web-tool requests from reaching our server as described above.

Stripe processes checkout and payment details. We use Stripe customer and subscription identifiers, billing email, payment status, and plan information to connect a subscription to your Brocco account and control access. A first-party checkout cookie helps you resume an unfinished checkout or cancel an unclaimed trial. We retain account trial-claim records to prevent duplicate trials. We do not store your full card number in our database.

We use first-party cookies and browser storage for sign-in, preferences, consent choices, and cached project data. Vercel Analytics and Speed Insights collect page and performance metrics. When configured and you accept analytics cookies, PostHog collects page views and product interactions, including click activity, and can associate those events with your signed-in account.

When Meta Pixel is configured and you accept marketing cookies, it reports page views and conversion events to Meta. Separately, if server-side Meta conversion reporting is configured, our Stripe webhook sends checkout completion events with a hashed email address, checkout identifier, amount, and currency to Meta.

We use Vercel for hosting and site metrics, Neon for database storage, Resend for sign-in email, and Stripe for billing. Google or Apple handles social sign-in when selected. Model and search providers can include Anthropic, xAI, and Tavily, depending on the features and provider you use. PostHog is used for optional analytics when configured and consented to. Meta can receive marketing and conversion data when those integrations are configured, as described above.

Email privacy@brocco.dev to ask about your data or request access, correction, export, or deletion. We may need to verify your account ownership before acting on a request.

Brocco requires users to be at least 18. We do not knowingly collect data from children.

We will post updates to this policy here and revise the date above.