Beta Privacy Policy

Interim beta information. These pages have not yet been reviewed by counsel and describe the features and limits available today.

Only fictional planning data may be entered during observed beta sessions until legal review is complete. Financial figures, planning ages, estate names, notes and Guide questions must be invented examples, not information about you or anyone else. Sign-in still uses your own email address. Participation begins only after an invitation and confirmation that testing is ready.

Last updated Nov 6, 2026

This policy explains what Brivoda collects during the beta, why, who processes it for us, how long we keep it, and the choices you have. Where a protection is weaker than you might assume, it says so.

The short version

  • We do not sell your data or use it for advertising.
  • Brivoda never asks for a Social Security number, a full legal name, a home address or a full date of birth.
  • You can download a copy of your data, or delete your account, in Settings → Data. An account is deleted 30 days after you ask.
  • The Brivoda Guide sends questions and selected context to AI providers, and only after you allow it. You can withdraw that permission at any time in Settings → Privacy.
  • Usage analytics run only if you agree to them.
  • The pre-launch plan is to delete every beta account and its data, after at least 30 days’ notice.

Who we are

This test is run by Brivoda’s founder (“we” or “us”), who is responsible for Brivoda’s handling of your information under this policy. Formal legal identification of the operator remains for legal review. Questions and requests go to support@brivoda.com.

What we collect

When you create an account

Your own email address, which you use to sign in. Optional fields include a display name, birth year, state and ZIP code. During fictional-data sessions these planning fields use invented examples. Google sign-in can also store provider account identifiers and sign-in tokens. Phone numbers are only collected with text-message features, which are off in the beta.

Joining the beta

A beta request stores your email address, current- or next-group purpose, declaration that you are 18 or older and dates. Only the Super Admin reviews identifiable requests. A request grants no access, reserved place or promise and is not a newsletter signup. No receipt is emailed. An entered address and declaration are unverified. Repeating a request does not extend its retention. Separately, we keep the email address the founder approves, who it is for and when the approval was made, used or ended. When you agree to the Beta Terms of Service, we keep the version you accepted and when.

What you enter

The figures and choices entered into the tools: account types and balances, income, spending and assumptions, scenarios and results, goals, life events, reflections and notes, and estate entries such as beneficiary shares and familiar names. Until legal review is complete, these must be fictional examples, not personal financial information or real names from your household.

When you use the Brivoda Guide

Your questions, the Guide’s answers, and any calculator result you choose to attach to a question. Whether you allowed the Guide’s AI processing, which version you allowed and when, and any withdrawal. If you report an answer, the reason you chose and any note you add.

If you share a household

Which household you belong to, your role in it, and its invitations.

When you use Brivoda

Sign-in sessions and security records, such as sign-in attempts and changes to your account. The session and audit records use scrambled, one-way versions of IP addresses and browser details. Hosting logs can include request details and provider errors, which can contain an email address. Our hosting provider keeps these logs for up to 30 days.

Only if you agree

Usage analytics: which pages and features are used, linked to a scrambled identifier and never to your email address. Brivoda does not record your screen: session replay is turned off in Brivoda’s code.

What you send us

Messages you send to support. Feedback you send with the Feedback button: what it is about, any note you add and the name of the page. The page’s figures and web address are not attached automatically. The team can read everything in your note.

When something goes wrong

If a page fails, Brivoda can send a technical error report to Sentry: a fixed error description, the kind of error, a general code location with line and column numbers, and the page’s route with private parts removed. The original error message and file paths are omitted. Reports do not include your account, your figures, what you typed, cookies or the page’s full web address.

What we never ask for

We designed Brivoda to support retirement planning without collecting a full legal identity or government identifiers.

We never ask for:

  • Your Social Security number
  • Your driver's license or passport
  • Your full legal name
  • Your home address or city
  • Your date of birth (month and day)

We do ask for (all optional except email):

  • Your email (for login)
  • Your birth year (for age-based planning)
  • Your state and ZIP code (for taxes and cost of living)
  • Your phone number — only if you opt into SMS alerts or SMS two-factor

A database breach would still be serious. Not storing Social Security numbers, full birth dates, full street addresses, account numbers or document files reduces what an intruder could obtain; it does not make identity theft or other harm impossible. Optional familiar names in estate references and letter addressees can identify people. These names are encrypted and private to the household primary’s estate pages and protected packet; they are not verified legal identities.

How we use it

We use your data to:

  • run Brivoda: sign you in, save your work and show your results;
  • keep accounts secure, detect misuse and limit repeated sign-in attempts;
  • send the emails Brivoda needs, such as sign-in codes, invitations and security notices, and a weekly summary of new notifications, which can be turned off;
  • answer support requests and learn from feedback;
  • with your agreement, see how features are used so we can improve them.

We do not sell your data or share it for advertising.

How the Brivoda Guide uses AI

The Guide sends nothing to Anthropic or Voyage AI until you allow it. Brivoda records which version of that permission you allowed and when. You can withdraw it at any time in Settings → Privacy; withdrawing stops new answers and does not delete saved conversations. Built-in calculator explanations and the Guide’s quick explanations work without it.

When the Guide is used, each question goes to Anthropic, which writes the answer. Brivoda also sends recent exchanges, relevant library passages and any attached result, including its figures. Preparing a calculator attachment can send those figures to Anthropic to measure request size before you submit a question, even if you later cancel. Explicitly included scenario context can contain age, state, balances and assumptions.

Before sending context, Brivoda redacts recognized identifier shapes, including email addresses, phone numbers, Social Security numbers, street addresses, ZIP codes, dates of birth and member birth years. Financial amounts and names are generally kept; numbers that resemble identifiers can also be redacted. The request does not add your sign-in email or account identifier as metadata. Redaction is not a guarantee that every identifier is removed.

To find relevant library passages, Brivoda may also send your question, with the same identifiers removed, to Voyage AI.

Anthropic’s commercial API terms do not permit model training on submitted content by default; retention follows its terms, including safety and legal exceptions. Voyage AI may store and use submitted text for model training unless the customer’s organization opts out. Brivoda’s organization has opted out; the setting was confirmed in Voyage AI’s dashboard on November 3, 2026.

Guide conversations are stored encrypted. Each one is deleted 12 months after its last message, unless you pin it, and all of them are deleted with your account.

The Guide’s answers can be wrong, and its quality review is not finished.

If you report a Guide answer, the report keeps that answer, the question it answered, the reason you chose and any note you add. Only Brivoda’s founder can open a report, and each opening is recorded. A report is never sent to an AI provider or copied into the Guide’s test cases.

Who processes your data for us

These services operate parts of Brivoda:

  • Vercel hosts Brivoda’s website and servers.
  • Neon hosts our database, which it encrypts on its disks.
  • Upstash holds short-lived counters that limit repeated sign-in attempts. They are keyed by scrambled values, not by your email address.
  • Resend delivers automated emails, such as sign-in codes and invitations. It also sends support-form messages to our mailbox, with your entered address as Reply-To, so it processes that address, subject and message. Provider acceptance does not confirm delivery to an inbox.
  • Zoho hosts our support mailbox, so it receives support messages and replies. These conversations are outside the automatic account download; a verified copy can be requested through support.
  • Anthropic writes the Brivoda Guide’s answers.
  • Voyage AI helps the Guide find relevant library passages.
  • PostHog records usage analytics, only if you agree to them.
  • Sentry receives error reports with identifying details removed, and never your account, your figures or what you typed.
  • Google signs you in, if you choose to sign in with Google, and gives us your email address.
  • If you turn on browser notifications, your browser’s own push service delivers them. It receives only an encrypted count of new notifications.

We may also disclose data when the law requires it, or to protect someone’s safety.

If you share a household

A household has a primary member and at most one partner. Each participant, including a partner, joins only with their own approval. Registration is currently closed.

Your partner can see the household’s accounts and balances, its scenarios and their results, and the shared goals and notes. A partner cannot change the household’s financial entries.

Some things stay private to the person who wrote them: reflections, private notes, life events, monthly check-ins, lifestyle and relocation explorations, calculator drafts and Guide conversations.

Digital Legacy Vault contents, Survivor Packet contents, familiar estate names, the estate checklist and the beneficiary audit are primary-only: a partner cannot see them.

If you ask the Brivoda Guide a question, it can include what you can see of the shared household, including figures your partner entered. Whether it is sent depends on your permission for the Guide, not your partner’s.

How we protect it

Connections to Brivoda are encrypted. Our database provider encrypts the stored data on its disks.

Some content gets an extra layer: Brivoda encrypts it before storing it. This includes Guide conversations, Digital Legacy Vault contents, Survivor Packet contents, familiar estate names, reflection notes, private and shared conversation-starter notes, life-event content, monthly check-in answers, shared-goal amounts, descriptions and comments. It also includes account balances, holdings and institution names, beneficiary shares, the goals you write during onboarding, your household’s own conversation-starter questions, your saved calculator results and the inputs behind them, your calculator drafts, and your scenario assumptions and their notes. Structured metadata beside these fields is not necessarily encrypted separately.

Other entries do not yet have that extra layer, including scenario names and descriptions, account types and dates, goal titles and dates, other onboarding answers, estate checklist statuses, beneficiary relationships, and review dates. They rely on the database provider’s disk encryption and restrictions on database access.

The key for the extra layer is held in our hosting provider’s protected settings, not in a separate key-management service.

No system is perfectly secure. If a breach affects your data, we will tell you as the law requires.

Admin access and audit logging

Admin tools show a member’s email address, display name and role for sign-in and support. An Admin or Super Admin can also open a view-only financial summary after entering a written reason for each access. The reason and access attempt are recorded in an audit log that cannot be edited. The summary includes visible household accounts, planning inputs and educational projections; shared information can include a partner’s figures. The summary includes the selected member’s own private scenarios. A household partner cannot open these unless they are shared; their names can appear in an invitation preview. It excludes another member’s private scenarios. It does not show Guide conversations, estate names or private notes. Direct access to the database is limited to the people who run Brivoda.

Cookies and similar storage

Brivoda uses a few cookies it needs to work: one keeps you signed in, one supports two-step sign-in if you use it, one remembers your cookie choices, and one remembers the scenario you last opened.

If you agree to analytics, PostHog keeps its own cookie and browser storage. Your browser also remembers your choice of display theme.

The analytics choice can be changed at any time in Settings → Privacy. Your choice is kept for 12 months; then we ask again.

How long we keep it

  • Account and planning records are kept while your account exists. If no one signs in to an account for 18 months, we email a warning; at 24 months the account is scheduled for deletion, with the same 30 days to keep it. The pre-launch reset has not run.
  • When you delete your account in Settings → Data, every session ends and the account is deleted 30 days later. Until then nothing is deleted: signing in shows the date and lets you keep the account or download a copy of your data, and we email a reminder on day 14. On the date we delete the account and everything in it, including your planning records, notes, estate records, Guide conversations and the record of your account activity. If you are a household’s primary member, the household and what your partner saved in it are deleted too; your partner is told when you ask and keeps their own account. If you are a partner, the household’s shared scenarios and goals stay with the primary.
  • An approved email address that never created an account is deleted 30 days after the approval expired or was ended. Once it has created an account, it is kept with that account and deleted with it, as are your agreements to the Beta Terms of Service.
  • Backups: our database provider keeps a restore history of up to 7 days, so deleted data leaves the backups within 7 days.
  • Security records, such as sign-ins, changes to your account and downloads of your data, are kept for 24 months (the use of a recovery code for 12 months) and then deleted. Your account-linked records are deleted with your account; the daily count of deletions names no one. Records of what our administrators did are kept for 7 years and name an account only by an internal identifier. Accounts with retained administrator records need a separate review before deletion; removing a staff role does not remove those records.
  • PostHog keeps usage analytics for up to 12 months.
  • Support messages and replies: deleted within 90 days after the conversation closes, or at the pre-launch reset. We handle verified deletion requests in both mail systems; provider backup retention may differ. Beta requests: deleted 90 days after submission while pending, or 30 days after approval or dismissal, with verified account deletion and at reset. For a copy or deletion without an account, contact support so ownership can be verified. An account export includes matching requests for its verified address. Feedback sent with the Feedback button: deleted 12 months after it is sent, sooner at reset, and with your account.
  • A reported Guide answer’s report is deleted 90 days after it is made, and sooner if its conversation or your account is deleted. Your Guide AI permission choices are kept with your account and deleted with it.
  • Sentry keeps error reports for 30 days.

Your choices and rights

You can:

  • see and correct most of what you have entered, directly in Brivoda;
  • download a copy of your data in Settings → Data: a readable PDF of what you entered and what your household shares with you, and the complete file as JSON for other apps. Brivoda makes each file when you ask and does not keep it. We try to email you about each download; that message can fail to send. Names in estate records are not in either file; the household’s primary member downloads them as the password-protected Survivor Packet;
  • delete your account in Settings → Data; it is deleted 30 days after you ask. Before then, you can sign in and choose Keep my account to cancel;
  • turn analytics on or off in Settings → Privacy;
  • turn off the weekly summary email from its unsubscribe link or in Settings → Notifications;
  • allow the Guide’s AI processing, or not, and withdraw it in Settings → Privacy; the built-in explanations work either way;

Depending on where you live, you may have legal rights to access, correct, delete or get a copy of personal data, and to appeal an answer. Requests go to support@brivoda.com. A verified process for handling them is required before external sessions begin. Requests may require confirmation of account ownership.

Children

Participation is restricted to adults 18 and over: before approving an address, the founder confirms that the person has said they are 18 or older. When we learn that a participant is under 18, we delete their account at once, without the 30-day wait.

Changes to this policy

If we change this policy in a way that matters, we email participants at least 14 days before the change takes effect, unless it is needed sooner for legal or security reasons.

Contact

Privacy questions and requests go to support@brivoda.com.