What we collect, who sees it, and how to delete it.

This page explains what brief.finance keeps about you, which companies help us run it, how long we keep things and how to get them deleted. The short version: we keep what you put into Willow so you can come back to it, we share it only with the services that run the product, we never sell it, and analytics run only if you say yes.

Last updated: 2026-10-26

Who we are

brief.finance, which includes the website, the Mac app, the MCP server and the API, is run by Reaktif LLC, a limited liability company registered in Delaware, USA. Reaktif LLC decides how your personal data is used, which makes it the "controller" under UK and EU data protection law. Its founder lives in the United Kingdom.

For anything about your data, email joseph@brief.finance. If you are in the UK you can also complain to the Information Commissioner's Office at ico.org.uk; in the EU, to your local data protection authority.

What we collect

What we keep depends on what you use:

Your account: your email address and name, and your sign-in history from our sign-in provider. If you sign in with Google, Google shares your name, email address and profile picture with us. We never see or store your password.
Billing: when you subscribe, Stripe collects your card, name and billing address. We keep only what we need to run your plan: your Stripe customer number, your plan, whether it is active, and your credit use. We never see your full card number.
What you ask Willow and what it answers: your questions, Willow's answers and their sources, chat titles, and the briefs, files and research Willow builds for you. This is the heart of the product, so we keep it under your account until you delete it.
Files you upload: for PDFs and text files, your browser reads the text and only that text is sent to us. Images are stored as image files. Both stay until you delete them or the chat they belong to.
Your voice: when you dictate, the recording is sent to a speech-to-text service to be turned into text. We do not store the recording. The text goes into your message box, and nothing is sent to Willow until you press send.
Things you set up: your watchlist and the companies you follow, notes on them, questions you ask Willow to watch filings for, move alerts and filing alerts, schedules, automations, skills you write, and notes you save so Willow remembers them in later chats. You can see and delete each of these in the app.
What you make public: if you share an answer, anyone with the link can read your question as you typed it, the answer, its sources and its date, until you stop sharing it. If you publish a skill, other members can see its text and your account name, never your email address.
How you use the app: which companies and news pages you opened recently and which setup steps you have finished. We use this for features like your recent companies. When you are signed in we also keep the company names you search for and whether we found a match, for 90 days, to learn which companies and markets readers want us to cover.
How you found us: when you subscribe, we save the campaign and website that sent you to brief.finance (for example a newsletter link) and any referral code, and we pass them to Stripe with your subscription.
Notifications: if you turn on browser notifications, we store the delivery address your browser gives us.
API keys: we keep only a scrambled (hashed) copy of each key, never the key itself, and when it was last used.
Messages to us: emails you send us and, if you joined our waitlist, what you entered there.

Our server uses your IP address for a moment to block abuse (rate limits). We do not save IP addresses in our database.

We don't ask for your holdings, income, goals or appetite for risk. If you tell Willow about them, in a chat, an upload such as a brokerage statement, or a note you save, Willow may use that to decide what to research and explain for you, but its view on a company stays the same for everyone. We store what you send like any other message or note, until you delete it. If you'd rather we didn't hold it, don't send it, or delete it later.

How we use it

To run the service: sign you in, answer your questions, keep your research, send the alerts and emails you asked for, and bill your plan.
To write a brief once for everyone: a brief's analysis is written only from public sources such as company filings and market data, never from your chats, notes or holdings. So when another member asks for a brief on the same company within a day, we may give them the same analysis with fresh prices. They never see who asked first.
To keep it safe and working: rate limits, abuse checks and fixing errors.
To make Willow better: we read samples of real conversations to find wrong or weak answers and fix them. Before a sample leaves our database, your account ID is replaced with a scrambled code. An AI model helps us review the samples.
To email you: a welcome email when you sign up, and the emails you choose to receive. You can turn those off in Settings, and the weekly email has a one-click unsubscribe link.
With your permission, to understand how the product is used (see section 9).

We do not sell your personal data, and we do not use it for advertising.

Our legal grounds (UK and EU)

If you are in the UK or EU, the law requires us to name our grounds for using your data:

Contract: to provide the service you signed up for, including sign-in, answers, saved research, alerts and billing.
Legitimate interests: security, fixing errors, reviewing conversations to improve answers, counting visits and signups, and learning which campaigns bring us customers, including linking a visit to your account when you sign in or subscribe the same day. We weigh these against your rights, and you can object (section 8).
Consent: product analytics, session recordings, and, if you are in the UK, EU, EEA or Switzerland, the attribution visitor ID stored in your browser. You can withdraw it at any time.
Legal obligation: keeping billing and tax records.

Who we share it with

We use other companies to run brief.finance. Each one gets only what it needs for its job. As data protection law allows, we list them by what they do. Email joseph@brief.finance and we will tell you the names of the companies we currently use.

Sign-in provider: your email address, name and sign-in history, and your Google profile if you sign in with Google.
Google: runs Sign in with Google, if you use it.
Stripe (payments and sales tax): your name, email address, billing address and card, your plan, and the campaign or referral that brought you.
AI model providers: what Willow needs to answer you: your messages and chat history, your uploads, and your saved research notes and watchlist. They do not receive your email address, name or card.
Speech-to-text provider: your voice recordings, to turn them into text.
Web search providers: search queries based on your question, and an ID that is never your name or email.
Link previews (DuckDuckGo's icon service, and the websites an answer cites or links to): when an answer cites or links to a web page, your browser loads that site's small icon from DuckDuckGo, and when you open a link's preview card, the page's preview image from that website. As with any web request, they see your IP address and which site's icon or image was asked for. Your browser does not tell them which brief.finance page you are on, and we pass them nothing about you.
Market data provider (stock prices and ticker lookup): ticker symbols, and what you type into the ticker search box.
Public and social data sources (SEC EDGAR filings, and Reddit and YouTube posts): ticker symbols and company names only, no personal data.
Product analytics provider: only if you allow analytics. See section 9.
Marketing attribution (our own tool, also made by Reaktif LLC): when you create an account, it gets your brief.finance user ID and the time you signed up, unless you had already declined analytics in the browser or app you signed up with. Our attribution tag in your browser records the pages you visit, the website or campaign that sent you, when you start checkout, and your user ID when you are signed in. Until you allow analytics (in the EU/EEA, the UK and Switzerland, and wherever we can't tell) it keeps no ID in your browser: it works out a visitor ID for that day from a scrambled mix of your IP address and browser type, with a key that changes daily and is deleted within 48 hours, and it never saves your IP address. So a visit is linked to your account only on a day you are signed in or subscribe. The Mac app does not do this: there the tag waits until you allow analytics in Settings. If you decline analytics, or your browser sends Global Privacy Control, the tag sends nothing. It tells us how many people visit and sign up, and which channels bring paying customers.
Email delivery provider: your email address and the emails we send you.
Notification services (Apple, Google, Mozilla, Microsoft): deliver notifications if you turn them on. A notification holds a short title and line, such as a ticker and the type of filing, or the name of an automation you set up. Browser notifications are encrypted so the service can't read them. Apple delivers iPhone notifications over an encrypted connection, but it can see their text.
Website, storage and hosting providers: serve our website and the Mac app's downloads and updates, store the images you upload, and run the server behind our API and database.
Monitoring provider: error logs and performance data from our server, so we can find and fix problems. They carry your account ID, but not your name, your email address or what you ask Willow.
AI review tools: an AI model helps us review samples of conversations, as described in section 3.

We also share data when the law requires it, to protect people's safety or our legal rights, or with a buyer if Reaktif LLC or brief.finance is sold. A buyer would have to keep to this policy for the data we already hold.

Where your data is stored

Reaktif LLC is a US company, and most of the companies that help us run brief.finance are in the United States, so if you are in the UK or EU your data is transferred there. Where a company is certified under the EU-US Data Privacy Framework and its UK Extension, we rely on that. Otherwise we rely on the standard contractual clauses, with the UK Addendum, in that company's data processing terms. Email joseph@brief.finance for a copy of the safeguards that apply.

How long we keep it

Your chats, uploads, briefs, notes, watchlist, alerts and anything else you create: until you delete them or your account. Cancelling your subscription does not delete them.
Shared answers: until you stop sharing, edit or retry the answer, or delete the chat.
Voice recordings: never stored by us.
Billing and tax records: as long as tax law requires, usually six years in the UK and up to seven in the US.
Server logs and performance data: kept for a few weeks to fix problems, then deleted.
Analytics (only if you allowed it): kept by our analytics provider until we delete it or you ask us to.

To delete your account, choose Delete account in Settings, Account. It happens straight away: your account and everything in it are deleted and you are signed out. We keep only a scrambled, one-way copy of your sign-in ID, with no name or email, so the deleted account can't be re-created by mistake. If you can't sign in, email joseph@brief.finance and we delete it within 30 days. The billing records the law requires stay with our payment provider.

Your rights

You can ask us to:

give you a copy of the personal data we hold about you;
correct anything that is wrong;
delete it, except what the law requires us to keep;
send it to you in a file another service can read;
stop or limit some uses, including analytics and conversation reviews;
withdraw your consent at any time.

You can do much of this yourself: delete a chat, upload, note, shared answer, alert, API key or your whole account in the app, and turn analytics off under Settings, Privacy & data. For anything else, email joseph@brief.finance. We reply within one month and don't charge, unless a request is clearly unfounded or excessive. We may ask you to confirm who you are first.

If you live in a US state with its own privacy law, such as California, you may have similar rights, and we will not treat you differently for using them. We do not sell personal data, and we do not share it for targeted advertising.

Cookies and browser storage

We use cookies and your browser's storage for three things:

Needed for the service to work: keeping you signed in, and remembering your theme, layout, pinned chats, unsent drafts and analytics choice. These can't be turned off.
Analytics, only with your permission: our analytics provider's cookies and storage. We record a fixed set of product events, such as which features are used and which campaign or website brought you, linked to your user ID. On our public marketing pages (home, pricing, methodology and compare) we also record session replays and heatmaps, with everything you type hidden. We never send analytics your questions, answers, tickers or financial details. Nothing is recorded until you choose Allow analytics.
Marketing attribution: we remember the campaign, website and referral code that brought you, so we can credit them if you subscribe. Our attribution tag keeps a random visitor ID in a first-party cookie and your browser's storage. Outside the EU/EEA, the UK and Switzerland it does this unless you decline analytics or your browser sends Global Privacy Control; inside them only once you allow analytics. Until then it counts your visit without keeping any ID in a cookie or storage (section 5).

You can change your analytics choice at any time under Settings, Privacy & data, on the website or in the Mac app. Turning it off stops recording and clears the analytics cookies from that browser. We do not use advertising cookies.

The Mac app

The Mac app shows the brief.finance website in its own window, so everything on this page applies to it too.
It keeps a small log on your Mac, in ~/Library/Logs/finance.brief.desktop, with the app version, update checks and errors. The log stays on your Mac and holds none of your chats.
It checks for updates when it opens and every few hours, by downloading a small file from our server. That request shows our server your IP address. We count these checks to know roughly how many Macs run the app; the count is not linked to your account.
It uses your microphone only while you dictate, and macOS asks your permission first.
If you allow notifications, it shows your alerts and finished automations as Mac notifications, with the same short title and line as above.

Children

brief.finance is for adults. You must be 18 or older to use it, and we don't knowingly collect data from anyone younger. If you think a child has signed up, email us and we will delete the account.

Security

All traffic to brief.finance is encrypted. Stripe handles payments, so card numbers never reach our servers, and API keys are stored only in scrambled form. Only the founder can access production data. No system is perfectly secure: if a breach puts your data at risk, we will tell you, and the regulators, as the law requires.

Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in the app at least 14 days before the change takes effect. The date at the top shows the current version. See also our Terms of Service and Disclosures.

brief.finance is run by Reaktif LLC, a Delaware limited liability company.

Terms Privacy Disclosures Methodology