Privacy · The Brancusi Files

This notice describes how The Brancusi Files handles information for the Maiastra research project. The project administrator is Nicolas Espinoza, who can be contacted at nicolas@masspredict.io.

Google sign-in and account information

When you use Google sign-in, the app receives your email address, its verification status and a unique Google account identifier. It uses these to verify your identity, match an existing invitation and connect your Google account to your project account. The Google identifier is stored with your account for later sign-ins.

Google sign-in requests only identity and email permissions. It does not request access to Gmail messages, Google Drive files, contacts or calendars. Sign-in access and refresh tokens are not retained by the app.

Your project account also contains the name and email supplied by an administrator, your role and your access status. If you use a project password or personal API key, the app stores a hash rather than the original credential.

Optional Gmail sending

Gmail is a separate, optional connection. If you connect a mailbox, the app requests permission to send email and uses Google identity and email information to identify the account you choose. It cannot read your inbox or Gmail drafts. The selected mailbox may differ from your project sign-in address and is shown before you send.

Mail connection credentials and unsent drafts are encrypted on the server with a separate encryption key and stored in a private area of the project’s GitHub repository. They are excluded from shared research records, search, version-history pages and connected research tools. Your authenticated project account can open its own drafts and authorize use of its Gmail connection. The app can also use that connection for chat email copies when you explicitly enable them; the house agent cannot send email. Short-lived access tokens are used in server memory and are not saved.

After you review a message and press Send email, its recipients and content are sent through Gmail. When Gmail confirms acceptance, the message, sender, recipients, send time and Gmail message identifiers are archived as shared project correspondence. Invited project members and authorized research tools, including the optional research assistant, can access that archive. Gmail’s acceptance confirms submission, not delivery to the recipient.

Use of Google user data follows the Google API Services User Data Policy, including its Limited Use requirements.

Team chat and optional email copies

The Team conversation is shared with active project members. Direct messages are available only to their participants through the app. Chat messages, mentions, read markers and email preferences are stored in a private area of the data repository and are excluded from shared research records, research tools and the house agent’s automatic page context. Administrators of the underlying repository infrastructure can administer that storage.

Email forwarding is off by default. In Account, members with a connected Gmail mailbox can choose copies of new direct messages and @mentions, or all new messages they can access. Copies contain the message, its author and a link to the app. They are sent through the recipient’s own connected Gmail account to that same mailbox and may also appear in Sent. They are not added to the shared correspondence archive. Email replies do not post to chat.

Turn forwarding off in Account or disconnect Gmail to stop future copies. Connecting a different mailbox or reconnecting requires enabling forwarding again. Copies already delivered remain in the mailbox until its owner removes them; private preference and delivery records may remain in Git history and backups.

Research records and services

Your contributions, comments and research activity are shared within the project. Changes are attributed using your project name and email and retained in the research revision history.

The app runs on Vercel. Account records and research data are stored in the project’s private GitHub data repository; evidence files may also use Vercel Blob storage. These providers process information needed to host and operate the workspace, including technical request information.

If the research assistant is enabled, prompts and project content it retrieves are sent to OpenRouter and the selected model provider to produce responses. Authorized connected research tools can also access project content within their granted permissions. Research assistant transcripts are saved in the project.

Cookies and browser storage

An essential session cookie keeps you signed in for up to 14 days. Google sign-in and Gmail connection each use a separate security cookie lasting up to ten minutes, cleared when that attempt returns. Your chosen colour theme may be saved in your browser. The app does not use advertising cookies.

Your language preference is saved in your account and in an essential cookie for up to one year.

Retention and your choices

Account information is retained while your project access is maintained. Research contributions and previous versions of records can remain in Git history and backups after an account is changed or removed.

Disconnect Gmail in Account to remove the app’s current mail credential and request revocation from Google. If Google cannot confirm revocation, the app asks you to remove its access in your Google Account. Disconnecting does not delete saved drafts, already sent messages or their project archive; encrypted historical records may remain in Git history and backups. Contact the administrator to request deletion of saved drafts or connection records.