Privacy

Brag Sheet is in a free beta. The product is a short weekly check-in with an agent that helps you remember and write down your wins. This page is the short, honest version of what data that involves today.

The waitlist (before you sign up)

Until sign-up opens, we run a private waitlist on the landing page. Joining it only asks for your email and a confirmation that we may email you when invites open. We use that email only for that one message.

Each signup is one row in our waitlist_signups table in D1. For new signups we store:

• email — the address you entered.
• consent_recorded_at — the timestamp of the moment you ticked the consent checkbox. This is our lawful basis for storing the row (consent, not legitimate interest).
• signup_source — a short label for where you came from (for example hn, twitter, google, or direct).
• created_at — when the row was written.

Historical waitlist rows from before our BRA-100 form simplification may also carry a role value and an optional free_text note; new signups do not collect those. We never sell or share the email, and the waitlist uses no analytics, no pixels, and no third-party scripts.

What we collect (after you sign up)

• Your account email, used to sign you in and to reach you about account issues.
• The brags you save: a title, a short body, the date you told us about, and any tags you add.
• The conversation turns between you and the agent that produced those brags.
• Coarse analytics: that you loaded a page, the type of device, and which buttons you pressed. No raw IP addresses are stored; request IPs are hashed with a rotating salt and used only for spam control.

Where it is stored

• Waitlist rows live in the waitlist_signups table in Cloudflare D1 (SQLite at the edge).
• Account rows, brags, and OAuth state live in the same D1 database.
• Each user's conversation state lives in a per-user Durable Object on the same Cloudflare account.
• Everything stays inside the Cloudflare account that hosts the API; nothing is shared with third-party processors.

What we do not collect

• No third-party trackers. No Google Tag Manager, no Meta pixel, no Hotjar. The waitlist uses no analytics, pixels, or third-party scripts of any kind.
• No advertising cookies.
• No browsing history outside the app. The agent only sees what you type into the weekly check-in.

How to export or delete your data

From /app/settings you can download every brag as JSON, or delete your account. Account deletion removes your user row, your brags, your Durable Object conversation, and your hashed analytics events in one pass. Deletion is final; we do not keep a soft-deleted copy.

If you joined the waitlist but never created an account, email hello@brag-sheet.com with the address you used and we will delete that waitlist_signups row by hand, the same way we delete users and brags rows on request. We aim to do this within seven days.

You can also email hello@brag-sheet.com for account deletion and we will run the same deletion by hand within seven days.

Contact

Questions: hello@brag-sheet.com.