LEGAL · DATA RIGHTS

Your data, your authority

The Brain exposes scoped export, cooling-off deletion, versioned consent and bounded ephemeral retention without exporting credentials or secret material.

Portable export

Step-up protected account/business export excludes password hashes, MFA secrets, raw tokens, provider keys and vault material.

POST /api/account/export · ACCOUNT_EXPORT

Deletion workflow

Whole-account deletion uses a 24-hour cooling-off period and can be cancelled before finalization. A submitted account-deletion request immediately revokes and removes stored YouTube Authorized Data for the requesting user where a live YouTube connection exists; that YouTube data is not restored if the later whole-account deletion is cancelled.

POST/DELETE /api/account/deletion

Current policy versions

{
  "consent": {
    "PRIVACY": "privacy-2026-10-06-v3",
    "TERMS": "terms-2026-10-06-v3",
    "DATA_PROCESSING": "data-processing-2026-09-v1"
  },
  "retention": {
    "version": "p02-retention-2026-09-v1",
    "authTokens": {
      "daysAfterTerminal": 30
    },
    "webauthnChallenges": {
      "daysAfterTerminal": 1
    },
    "stepUpGrants": {
      "daysAfterTerminal": 1
    },
    "identityLinkIntents": {
      "daysAfterTerminal": 1
    },
    "revokedSessions": {
      "daysAfterRevocation": 90
    },
    "securityEvents": {
      "mode": "RETAIN_AUDIT"
    },
    "consentReceipts": {
      "mode": "RETAIN_VERSIONED"
    },
    "deletionReceipts": {
      "mode": "RETAIN_HASHED_NON_PII"
    }
  }
}