Privacy Policy: How We Protect Your Data

1. Introduction

This Privacy Policy explains what personal data we collect when you visit cmdbrief.com, use the CmdBrief app for Mac, or use CmdBrief for ChatGPT; why we collect it; who receives it; how long we keep it; and the choices you have. CmdBrief runs on your Mac: your repositories, terminals and agent conversations stay there unless this policy says otherwise.

2. Data Controller

CmdBrief is operated by, and the data controller under the GDPR is:

3. Information We Collect

At a Glance

The short version; the sections below give the detail.

Account

• Account data: Your email address, account and subscription status, promotional access you redeem, and when you signed up
• Devices: A random device ID and a device name for each Mac or browser you sign in from (the app uses your Mac's name; a browser shows as "Web browser"), when it was added, and when it was last active
• Sign-in security: One-time sign-in codes (encrypted until the email is sent, then kept only as a keyed hash) and sign-in tokens (stored as hashes). ZeptoMail receives your email address, the code and the device name to send the sign-in email

Billing and Payment Risk

Stripe receives your email address and account ID to create your customer record, and collects your card, name, billing address and any tax ID itself, under its own privacy policy. We keep Stripe customer, subscription, price, invoice, charge, dispute and event identifiers; subscription status and renewal time; fraud-warning, refund and dispute reason and outcome codes; the Terms version you accepted; and security timestamps. We never receive or store full card numbers or card security codes.

The CmdBrief App

• Subscription checks: The app checks your subscription with cmdbrief.com at launch and periodically, using its sign-in token
• Updates and release notes: The app checks cmdbrief.com for updates once a day and downloads release notes after an update. These requests carry no account or device identifiers
• Crash reports: When a release build crashes, it sends Sentry (EU region) the error message, stack trace, app version, macOS version and build, Mac model, and the diagnostic messages the app recorded before the crash. Your home-folder path is replaced before sending. We do not add terminal content, prompts, agent responses, or files, but an error message can quote the text the app failed on, such as a file path. Some app versions also include the Mac's name
• No usage analytics: The app does not track how you use it

Feedback and Contact Messages

• Feedback from the app: The type, area, summary and message you write and whether we may reply, linked to your account and device. If you leave diagnostics on: app version and build, macOS version, chip architecture, renderer, and which agent CLIs are installed. If you choose: one screenshot you pick and the app's latest local crash log
• Contact form: Your name, email address, topic and message. We store it, and ZeptoMail delivers it to our inbox

Voice Agent

Voice Agent runs only while you hold a session. Your Mac connects directly to the provider you choose (OpenAI Realtime or xAI Grok) with your own API key; the conversation does not pass through cmdbrief.com. The provider receives your microphone audio, the session instructions, and what the agent reads for you: screen text of panes, agents' questions, and the files it lists or opens. Transcripts of the last 100 sessions stay on your Mac. Language availability and accuracy vary by provider; each provider requires your API key and bills usage separately.

Your Agents and Accounts

CmdBrief runs agent CLIs such as Claude Code and Codex on your Mac. They send your prompts to their providers under your own accounts and those providers' terms; that traffic does not go through cmdbrief.com. With your local credentials, the app also asks providers for your usage limits, checks npm or Homebrew for agent CLI updates (you can turn this off in Settings), reads pull requests through your GitHub CLI login, and, if you turn it on, sends image prompts to OpenRouter. None of this reaches us.

The Website

• Analytics: Only after you accept analytics cookies: page views, clicks on calls to action such as Download, product video plays, and (PostHog) when you leave a page. Google Analytics runs with Google signals and ad personalization off. PostHog runs without autocapture, session recording or person profiles. Global Privacy Control turns analytics off
• Consent records: Your cookie choices, consent version, time, Global Privacy Control status, the page you chose on, a random consent ID stored in your browser, your browser's user agent, and a keyed hash of your IP address
• Cookies and local storage: See the Cookie Policy for each one

Server Logs and Security

Cloudflare delivers every request to cmdbrief.com. Our servers log requests (time, IP address, the page or API path requested, status, size, referrer and browser user agent) to keep the service running and secure, and log account IDs for some security and billing events. Rate limits keep short-lived counters keyed by IP address or account.

4. CmdBrief for ChatGPT

CmdBrief for ChatGPT lets you plan a project in ChatGPT and send it to CmdBrief on your Mac. It does nothing until you connect ChatGPT to your CmdBrief account and turn on ChatGPT in the cloud in the app's Settings > Account. ChatGPT is run by OpenAI, which handles your ChatGPT conversations, including CmdBrief's answers, under its own privacy policy.

• From ChatGPT to your Mac: Plans you build or send (title, phases, gates, notes), the workspace or folder you choose, links to images you attach or generate, and your questions about your crews. The app downloads images from those links itself; images do not pass through cmdbrief.com
• From your Mac to ChatGPT: What you ask for: workspace names and project folders (shown from your home folder), project and roadmap titles and progress, plans waiting for your confirmation, runs with their goals and each agent's name, role, status and what it reports doing, what needs you (agents' questions; permission requests with the command, its folder and up to four file paths; the start of a message you held back), which lead agents are installed, and Claude and Codex usage levels. It never sends file contents, terminal output or git history
• What we store: The connection: ChatGPT's client registration, hashed access tokens, and when it was made and last used. A plan you send while the app is offline, encrypted, until the app receives it, for at most 7 days. A receipt of each send, encrypted, for at most 14 days, so a retry from ChatGPT is not delivered twice: whether the app accepted it, and its title, workspace and folder, not the phases or files. Other requests and answers pass through our servers in memory and are not stored or logged
• Your controls: Nothing starts until you confirm a plan in CmdBrief. Turning off ChatGPT in the cloud stops relaying. Disconnecting ChatGPT in Settings > Account revokes its access at once and deletes plans waiting for the app, and so does deleting your account

5. How We Use Your Information

6. Data Sharing

We do not sell your personal data or share it for cross-context behavioral advertising.

These providers receive the minimum data they need for the purposes listed:

We may also disclose data to professional advisers, or to authorities when the law requires it.

Global Privacy Control turns off analytics and marketing preferences. For the current list of subprocessors, contact [email protected].

7. International Transfers

Our servers are in Germany, PostHog is configured for its EU Cloud, and Sentry stores crash reports in its EU region. Some recipients, including Stripe, Google, Cloudflare, Zoho (ZeptoMail), Discord, OpenAI and xAI, are based in the United States or elsewhere outside the EEA and may process data there. Those transfers rely on safeguards such as the EU–U.S. Data Privacy Framework or Standard Contractual Clauses.

8. Data Retention

9. Your Rights (GDPR)

You can delete your account and sign out devices on the account page. Deleting your account cancels any subscription first, replaces your email address with a placeholder, revokes every session, device and ChatGPT connection, and deletes your sign-in codes, plans waiting for the app and their receipts. You can disconnect ChatGPT on its own in the app's Settings > Account. For anything else, including access, correction, portability, objection, or deleting feedback reports, contact messages or waitlist records, email [email protected].

Deletion rights are not absolute. We may keep the minimum billing, tax, fraud-prevention, security, or legal-claim records required or permitted by law, restrict them from ordinary product use, and explain the exception in our reply.

You can also complain to the Estonian Data Protection Inspectorate (aki.ee) or the data protection authority where you live.

10. Security

We protect personal data with HTTPS everywhere, access controls, and regular security reviews. Sign-in codes and tokens are stored as hashes, plans waiting for an offline Mac are encrypted with AES-256-GCM, and card data stays with Stripe.

CmdBrief does not collect terminal content, prompts, repository contents, or detailed usage telemetry as billing or dispute evidence. We rely on Stripe purchase records and existing account, device, authentication and security timestamps.

11. Contact Us

For privacy questions and requests:

When this policy changes, we update the date at the top of this page.