brunvo

Privacy Policy

Effective date:

This policy explains what personal data Brunvo collects, why, who processes it for us, how long we keep it, and the rights you have. It covers brunvo.com, your Brunvo account, and the Brunvo app for Mac (the "App").

The short version. Your terminal content, scrollback, commands, prompts, files and folder paths, repository names, AI provider credentials, and GitHub tokens never leave your Mac. We collect what we need to run your account, your membership, and the App's updates, plus product analytics that you can turn off (and that start off in Europe) and crash reports only if you agree. We do not sell or share your personal data for advertising, and the public pages of brunvo.com set no cookies.

1. Who we are

The controller of your personal data is Schedule Key LLC, doing business as Brunvo, 8695 Hillbolt Rd, Cat Spring, TX 78933, United States. Contact for anything in this policy, including privacy requests: support@brunvo.com.

2. What we collect and why

Your account

  • What: your email address, your name and picture if a sign-in provider gives them, the sign-in method you used (GitHub, Google, or Sign in with Apple, where offered, or an email code) and that provider's account identifier, your profile settings, and sign-in session records including IP address and browser or App user agent. Authentication audit records also include your email address and IP address.
  • Why: to create and secure your account and to contact you about it.
  • Legal basis: performance of our contract with you.

Membership and billing

  • What: your trial and membership status, plan, renewal dates, the identifiers Stripe gives us for your customer record and subscription, and a record of the renewal terms you agreed to at checkout and when. We never receive or store your full card number.
  • Who handles payment: Stripe processes payments through Stripe Managed Payments, where Link, Stripe's reseller service, is the seller of record for your payment. Link collects your payment details, billing address, and tax information, sends your receipts and invoices, and handles them as an independent controller under its own privacy policy. Stripe also keeps the subscription and invoice records we use to run your membership, as our service provider.
  • Why: to provide the membership you paid for, handle refunds, keep the consent records the law requires, and meet tax and accounting duties.
  • Legal basis: performance of contract; legal obligation.

Trials

  • What: when your trial started and ends; a key derived from your email address that treats variants of one address (such as name+tag@) as the same, so each address gets one trial; and a one-way hash derived from a random marker the App creates on your Mac, so each Mac can start trials for at most two accounts. If we refuse a trial because the email address is a disposable one, we record that refusal on your account; it is deleted with your account.
  • Why: to run the free trial and stop trial abuse. Legal basis: performance of contract; legitimate interests in preventing abuse.

Your Macs (device records)

  • What: for each Mac signed in to your account, a random device identifier created by the App and bound to a key kept in the Mac's Secure Enclave, your Mac's computer name as set in macOS (for example 'Northwind MacBook Pro'), which you can rename on brunvo.com, its model name, the App's version and update channel, the macOS version, and when it was first and last seen. We do not collect serial numbers or hardware identifiers.
  • Why: to enforce the 3-Mac limit and let you see and remove your Macs.
  • Legal basis: performance of contract.

License checks

  • What: when the App checks your membership: your account and device identifiers, the App and macOS versions, the time, and the IP address the request came from. We keep a record of each license we issue (account, device, state, and times); the IP address appears only in our providers' short-lived request logs.
  • Why: to issue the signed license token the App uses offline, and to detect abuse.
  • Legal basis: performance of contract; legitimate interests in security.

Updates

  • What: when the App checks for or downloads an update from download.brunvo.com: the IP address, the App version, and the update channel. Once a day the App also fetches the public list of AI tool versions Brunvo has tested from there, and if our servers cannot be reached it fetches a signed status notice; those requests carry no identifier, only the IP address they come from.
  • Why: to deliver updates and roll them out in stages, to keep agent status working when an AI tool updates, and to keep the App working during an outage.
  • Legal basis: legitimate interests in keeping the App secure and working.

Product analytics (you can turn them off)

  • What, from a fixed list only: App launch and quit with the App version, build, macOS version, and chip family, update channel, and edition; how many sessions start and end, by AI tool name; launch and reattach timings; how often features are used (for example a desk created, a split, the Manager started, a Settings section opened, a key rebound); error and failure codes with the component that raised them (codes only, never messages that could contain paths); onboarding steps completed; update results; and changes in license state.
  • Never collected: terminal content, scrollback, commands, typed input, prompts, transcripts, file or folder paths, repository, branch, or issue names, environment values, usernames, AI provider account details, or GitHub tokens.
  • Identity: a random install identifier per App profile, never your account identifier. We do not link analytics to your account. The IP address a batch comes from is used only as a one-way hash to count requests against abuse limits, kept for at most 2 hours and never stored with the events.
  • Default: analytics start on, except on Macs set to a region in the EU, the EEA, the UK, or Switzerland (or whose region cannot be read), where they start off until you turn them on.
  • Your control: a switch shown during onboarding and in Settings ▸ Privacy & Permissions, with a preview of exactly what is sent. Turning it off stops collection at once and deletes anything not yet sent, along with the install identifier.
  • Why: to find and fix bugs and performance problems in real use.
  • Legal basis: legitimate interests in improving the App, which you can object to at any time with the switch; in Europe, where analytics start off, your consent when you turn them on, which you can withdraw with the same switch.

Crash reports (only if you agree)

  • What: a crash report from the App, its background service, or its session helper: the App's version, build, and update channel, the macOS version and chip, what stopped it, and up to 64 threads' stacks showing code locations. It includes loaded libraries' names and IDs; libraries other than Apple's and Brunvo's are sent as "other". It never contains what is in your terminals, commands, file or folder paths, names, environment values, or window titles, and no account, device, or install identifier. The App shows you a report in full before the first one is sent. The IP address a report comes from is used only as a one-way hash to limit how many reports one sender can make, kept for at most 2 hours.
  • Why: to fix crashes. Legal basis: your consent, which you can withdraw in Settings ▸ Privacy & Permissions.

Support

  • What: what you send us by email, including any diagnostics report you choose to attach after previewing it in full (versions, counts, states, the names of settings you changed, and error codes; never terminal content, paths, setting values, or names).
  • Where: email to support@brunvo.com is forwarded by Cloudflare Email Routing to our Google Workspace mailbox.
  • Why: to answer you. Legal basis: legitimate interests; performance of contract.

Support requests

  • What: the problem reports and ideas you file in the App's Support window or on your account's Support page: what you write, the files you choose to attach, your comments, and each request's status. With each request we keep your account's id, name, and email address, whether your email is confirmed, how long you have had the account and which kind of membership it has, and, from the App, its version, build, update channel, macOS version, and chip. The App attaches its diagnostics report only if you choose to, after showing it to you in full.
  • Why: to fix problems and weigh ideas, and to show you where each request stands. We write our own engineering notes from your request; your words, files, name, and email address are not copied into them. Legal basis: performance of contract; legitimate interests.
  • Where: in our request service, which we operate ourselves on the same providers as the rest of Brunvo: Supabase stores the requests and their files, and Vercel hosts support.brunvo.com, where your requests open (section 4). How long we keep them is in section 6.
  • Triage: an AI agent that runs on Anthropic's Claude models reads each new request: what you write, your comments, the names of the files you attach (never the files themselves), and the account and App details sent with it. It suggests how to file the request and drafts our engineering note in its own words. A person on our team reviews every draft before anything is filed. Anthropic processes this data as our service provider (section 4).

Account email

  • What: a record of the account emails we send you (for example trial reminders, payment problems, a new Mac on your account) and whether you turned off the optional trial reminders.
  • Why: to send each email once and respect your choice. Legal basis: performance of contract; legitimate interests.

The waitlist

  • What: your email address, where you signed up from (for example a campaign tag or the referring page), the version of the consent text you saw, when you signed up and confirmed, and a salted hash of your IP address used only to stop abuse.
  • Why: to tell you when Brunvo opens. We send one email to confirm your address, may invite you to the private beta, and then write about Brunvo's launch. Legal basis: your consent, which you can withdraw at any time using the unsubscribe link in a waitlist or launch email, or by writing to support@brunvo.com; we then delete your entry.

The private beta

  • What: if we invite you, your email address, when you were invited, and when you accepted; if you send beta feedback, what you wrote, your account's email address, and the App version.
  • Why: to run the beta and fix what testers report. Legal basis: legitimate interests; performance of contract.

Teams and programs

  • What: for a team membership, the team's name, its members, and the email addresses the owner invites; the team's owner and members can see the members' addresses. If you apply for the student or open-source program, the answers you give (such as your school or project) and our decision.
  • Why: to run team memberships and the programs. Legal basis: performance of contract.

brunvo.com

  • No website analytics: brunvo.com runs no analytics or tracking scripts.
  • Bot protection: forms and sign-in on brunvo.com use Cloudflare Turnstile to check that a person is sending them.
  • Hosting logs: our hosting providers keep short-lived server logs, including IP addresses, for security and reliability.

3. Cookies

The public pages of brunvo.com set no cookies. Signed-in pages use strictly necessary cookies to keep you signed in, and the private preview and beta invitation pages set strictly necessary cookies once you enter a password or open an invitation. We use no advertising or cross-site tracking cookies.

4. Who processes data for us

We use these service providers. Each processes personal data only on our instructions and under its data processing terms. The current list, with what each does, is on the Subprocessors page.

  • Supabase — database, sign-in, and server functions for accounts, devices, licenses, analytics, and crash reports, and the database and file storage of our request service for support requests.
  • Vercel — hosting for brunvo.com and support.brunvo.com.
  • Stripe — payments, subscriptions, invoices, and tax, through Stripe Managed Payments (see section 2; Link acts as seller of record under its own privacy policy).
  • Cloudflare — DNS, update downloads (R2 storage), bot protection (Turnstile), and Email Routing, which forwards email sent to support@brunvo.com.
  • Google — Google Workspace, the mailbox where email to support@brunvo.com arrives and is kept.
  • Resend — sending sign-in codes, waitlist and beta emails, and account email.
  • Anthropic — the Claude AI models our agent uses to triage support requests: they read a request's text, comments, file names, and the account and App details sent with it.

When you sign in with GitHub, Google, or Apple, where offered, that provider handles the sign-in under its own privacy policy and shares your basic profile with us.

We may disclose data if the law requires it, to protect our rights or users' safety, or to a successor if the business is transferred, such as to a company formed to run Brunvo. We will tell you before your data becomes subject to a different privacy policy.

5. International transfers

Our providers store data in the United States (our database is in the US East region). When we transfer personal data from the EU, UK, or Switzerland, we rely on the Standard Contractual Clauses (with the UK Addendum) in each provider's data processing terms, or on the EU-US Data Privacy Framework and its UK and Swiss extensions where a provider is certified.

6. How long we keep data

  • Account, device, trial, team, and program records, and beta feedback: while your account exists; deleted when you delete your account, except what the items below keep.
  • Sign-in sessions: while the session exists; deleted with your account.
  • Authentication audit records in our database: 30 days.
  • License issuance records: 90 days.
  • Payment event records from Stripe: 13 months, without your account once you delete it.
  • Records of your consent to subscription terms and of account actions (audit log): 3 years, as California's automatic renewal law requires for consent records. Invitation email addresses are not kept in this log; account deletion removes names and email addresses from matching entries.
  • A deleted account's trial records: the one-way hash that limits free trials per Mac, and a keyed one-way hash of the account's email address (an HMAC under a secret key only our server holds), kept only to stop a second trial on the same address. Neither holds your account or your email address itself; both are kept for 3 years after you delete your account.
  • Account email records: 90 days; the address is removed when the email is sent, skipped, or expires; a failed goodbye email also loses its address.
  • Raw product analytics events: 90 days, then only daily totals that cannot identify an install.
  • Crash reports: 90 days.
  • Support email: 2 years after your last message.
  • Support requests: files attached to a request (yours and any our team adds): 180 days after the request is closed, however it closes, including when we close a request after 180 days without activity, and, on a request still open, they become due for deletion when its text is erased and are removed by the next scheduled cleanup runs. A request's title, description, and comments (yours and our team's replies), and the App and account details sent with it: 2 years after its last activity, such as a comment or a change of its status. The email address we hold to identify your requests: until you delete your account. In every case, when you delete your account we erase your requests' text, every comment on them (yours and our team's replies), and their files, and each request remains only as a placeholder with its reference and status (for example "BRV-12: erased"), so our engineering notes still make sense. Our request service keeps a one-way hash of your account's id so an erased account's requests cannot be recreated, and our record that the erase ran keeps your account's id until it completes, then 30 days after it completes.
  • Waitlist entries: unconfirmed sign-ups 30 days; confirmed entries until you ask us to remove them, or 12 months after Brunvo's public launch, whichever comes first.
  • Beta invitations: 12 months after Brunvo's public launch.
  • Backups: deleted data can remain in our encrypted database backups for up to 30 days, until they are replaced.
  • Tax and accounting records: as long as tax law requires.

7. Your rights

Depending on where you live, you have the right to:

  • access your personal data and get a copy of it;
  • export it in a portable format: "Download my data" on brunvo.com/account gives you your profile, devices, membership and license history, team, your own account activity, and all of your support requests, however many, with their comments (yours and our team's replies), statuses, and links to their files (valid for one hour) as a JSON file;
  • correct it;
  • delete it: deleting your account at brunvo.com/account expires any checkout you left open, cancels your subscriptions, deletes every Stripe customer record of your account, deactivates your Macs, erases your support requests, and deletes your profile from our systems, except the records section 6 keeps. The record of the deletion in our audit log keeps the identifiers of what was closed at Stripe (for example the subscription and customer IDs), so a late payment event can still be matched and refunded. While a payment dispute on your account is still open, we keep the account until the dispute is resolved. A waitlist entry or beta invitation is separate from your account; use the unsubscribe link to remove your waitlist entry, or write to us to remove either;
  • object to processing based on legitimate interests, including product analytics (turn them off in Settings ▸ Privacy & Permissions);
  • withdraw consent at any time, for analytics where they started off, crash reports, and the waitlist;
  • restrict processing in some cases; and
  • complain to your data protection authority.

To use a right that the App or your account page does not already provide, email support@brunvo.com. We will answer within one month (45 days for California requests) and may need to confirm your identity first. We will not treat you differently for using your rights.

California

We do not sell or share personal information, as those terms are defined in the California Consumer Privacy Act, and we do not use sensitive personal information to infer characteristics about you. The categories we collect are identifiers (email, account and device identifiers, IP address), commercial information (membership and billing status), internet or electronic activity (license checks, update checks, product analytics), and the content of messages you send us, for the purposes described in section 2, and we keep them for the periods in section 6.

Other US states and appeals

Residents of other US states may have rights to access, correct, delete, or obtain a copy of their personal data, and to opt out of sale, targeted advertising, or certain profiling, under their state's law. We do not sell personal data or use it for targeted advertising or profiling that produces legal or similarly significant effects. To appeal a denied privacy request, reply to our decision or email support@brunvo.com with the subject "Privacy appeal". We will explain our decision within the time required by your state's law and, if we deny the appeal, tell you how to contact your state's attorney general or other privacy regulator.

8. Security

We protect data with encryption in transit, access controls, row-level security in our database, and signed license tokens and updates. No system is perfectly secure; if a breach affects your personal data we will tell you and the authorities as the law requires.

9. Children

Brunvo is not directed to children under 16, and we do not knowingly collect their personal data.

10. Changes to this policy

If we change this policy materially, we will tell you by email or in the App at least 30 days before the change takes effect. Adding a new kind of data collection, such as a future remote-control feature, will come with a new version of this policy first.

11. Contact

Schedule Key LLC, doing business as Brunvo, 8695 Hillbolt Rd, Cat Spring, TX 78933, United States. Email: support@brunvo.com.