Privacy Policy

ELI-Brief is made by Ellis AI Labs LLC ("we", "us"), in Kent, Washington. This policy covers the ELI-Brief apps for iPhone and Android, ELI-Brief on the web at elibrief.app, and this website. It says what we collect, why, who else handles it, how long we keep it, and what you can do about it. Questions: justin@ellisailabs.com.

1. What we collect

Your account

Your name, username and email address; your password (stored only as a one-way hash we can't reverse); the secret for your authenticator app (stored encrypted); and your recovery codes (stored as hashes).

Your content

• Recordings you make in the app or upload, and lecture videos and files you add (documents, slide decks, spreadsheets, PDFs).
• If you connect a Plaud account: your Plaud recordings' transcripts, notes and details, read from your Plaud account with your permission.
• If you connect a calendar (Google, Microsoft 365 or Outlook.com, Zoho) or add a calendar link: your calendar events.
• What ELI-Brief makes from all of this: transcripts, summaries, to-dos, notes, plans, recaps, and the search index used to answer your questions.
• If you choose to: a short sample of your voice, so notes can be read aloud in your own voice.
• Questions you ask by voice (the audio is deleted as soon as it's turned into text).

Devices and security

For each device or browser you sign in on: its name and type, the browser, its IP address and sign-in times; a push notification token if you allow notifications; and a security log of sign-ins and account changes.

Subscriptions

Payments are handled by Stripe. Your card details go to Stripe, never to us. From Stripe we keep your email, Stripe's customer and subscription IDs, your plan, its status and its dates. Stripe also collects your billing address to work out sales tax.

This website

elibrief.com has no advertising or tracking scripts. It loads its fonts from Google Fonts, so Google receives your IP address when you visit. Cloudflare, which delivers our sites, may keep basic traffic logs. ELI-Brief on the web uses one cookie, to keep you signed in.

2. How we use it

• To run ELI-Brief for you: transcribing recordings, organizing notes and to-dos, reminders, planning your day around your calendar, search, answering your questions, and reading notes aloud.
• To keep your account secure: two-step sign-in, spotting suspicious sign-ins, and the security log.
• To bill your subscription (through Stripe) and send service email: your sign-up link, sign-in and security notices, and notices about your subscription.
• To help you when you ask us for support.

We don't use your information for advertising, we don't build profiles to sell, and we don't use your content to train AI models.

3. Where your information is, and who can see it

ELI-Brief runs on Mac computers that Ellis AI Labs runs in Washington State, USA. The AI work (turning speech into text, writing notes, search and reading aloud) runs on those computers. When it's busy, the work can be shared with other computers we run, connected over an encrypted private network. Each account has its own database, encrypted with AES-256 under its own key, in its own locked-down container. Information travels encrypted (TLS) between your device and us.

Our support tools work on accounts (for example, unlocking an account or resetting an authenticator once we've confirmed it's you), not on your notes, and every action they take is recorded in a security log. Because we run the computers ELI-Brief runs on, we could technically reach your data. We only would to fix a problem you ask us to look at, or if the law requires it, and we'd tell you unless the law forbids it.

4. Who else handles it

We use a few companies to run ELI-Brief. They handle your information only to provide their service to us:

Company	What for	What it handles
Cloudflare	Delivers our sites and the app's connection, and protects them from attacks	All traffic, encrypted in transit
Stripe	Payments, receipts, sales tax, your billing page	Name, email, billing address, card details
Our email delivery provider	Sends sign-up links and account and security emails	Name, email address, the email itself (never note content)
Expo, Apple and Google	Deliver push notifications to your phone	The notification. By default it carries no note content, only counts; you can turn on details in Settings
Tailscale	The encrypted network between our own computers	Device names and addresses, not content
Our off-site backup provider	Keeps copies of our nightly backups	Encrypted archives only; we keep the key
Have I Been Pwned	Checks that a new password isn't a known leaked one	Only the first 5 characters of a hash of the password

When you connect your own Plaud account or calendars, ELI-Brief reads from them on your behalf, and their own privacy policies apply to what they hold. ELI-Brief adds something to a calendar only after you approve it, and deleting something in ELI-Brief never deletes it in Plaud.

We'd also disclose information if the law requires it, or to protect someone's safety. If Ellis AI Labs or ELI-Brief is ever sold or merged, your information would move under this policy, and we'd tell you first.

5. How long we keep it

What	How long
Your content	As long as your account exists. Things you delete stay in Recently deleted for 30 days (so you can bring them back), unless you remove them sooner.
Recordings made in the app, and uploaded videos	Until they're turned into text; the audio or video is then deleted and the transcript kept.
Questions asked by voice	Deleted as soon as they're turned into text.
After you delete your account	You're signed out everywhere right away. Your content is erased within 30 days, and from our encrypted backups within a further 30 days.
After a subscription ends	Your account is paused and kept for 60 days in case you come back, then deleted as above.
Security log	400 days. It holds account events, not your content.
Billing record	Your email, Stripe's IDs, plan and dates are kept after your account is deleted, for tax and accounting and so the free trial is used once per person. Stripe keeps its own records under its privacy policy.

6. Your choices

• Export: Settings → Export notes and files gives you all your notes, to-dos and files.
• Correct: edit your notes, to-dos and account details in the app, or ask us.
• Delete: Settings → Account → Delete account, in the app or at elibrief.app. Or email us; see Delete your account.
• Disconnect: disconnect Plaud or any calendar in Settings at any time.
• Notifications: turn them off, or choose whether they include details, in Settings.

Depending on where you live (for example California, Washington, the EU or the UK), you may have rights to access, correct, delete or get a copy of your information, or to object to how it's used. Email justin@ellisailabs.com and we'll answer within 30 days. We don't sell or share personal information as those laws define it, and we won't treat you differently for using your rights.

7. Security

Encrypted connections; a separately encrypted database for each account; two-step sign-in for everyone; checks against leaked passwords; lockouts after wrong guesses; an app lock with Face ID or your phone's screen lock; a tamper-evident security log; and encrypted nightly backups. No system is perfectly secure. If a breach affects your information, we'll tell you as the law requires.

8. People in your recordings

Your recordings and notes can include other people. We process them only for you, as part of your account. You're responsible for having the right to record and for getting any consent the law requires. If someone asks us about information in your account, we'll ask them to contact you.

9. Children

ELI-Brief is for adults (18 and over) and isn't directed at children. We don't knowingly collect information from children under 13. If you think a child has given us information, email us and we'll delete it.

10. Changes

If we change this policy, we'll post the new version here with its date. If a change matters to how your information is used, we'll email you before it takes effect.

11. Contact

Ellis AI Labs LLC, Kent, Washington, USA
justin@ellisailabs.com