Privacy policy

Who runs Briefkin

Briefkin (briefkin.dev, its dashboard, API, installer, hooks, skill and Telegram bot) is run by Petar Slovic, based in Serbia. On this page, “Briefkin”, “we” and “us” mean Petar Slovic, who decides how your data is used and is responsible for it (the “controller”, in data protection law).

Write to privacy@briefkin.dev about anything on this page. The Terms of service cover the rest of our agreement with you.

What we collect

Your account

You sign in with GitHub. We ask GitHub only for permission to read your public profile (the read:user scope) and keep two things from it: your numeric GitHub user id and your username. We don’t store your email address or your avatar, and we have no access to your repositories or code. The access token GitHub gives us is used once, to ask who you are, and then thrown away. Signing in for the first time creates your workspace, with you as its only member. For a new account we also note which page of this site you started signing up from (just its path, such as /skills), so we can see which pages are useful to people.

Sign-in sessions

When you sign in, your browser gets a random session token in a cookie. We store only a SHA-256 hash of it, with when it was created and when it expires, 30 days later. Signing out deletes it.

The Chrome side panel can’t use that cookie, so it signs in with a short code you approve on the site. Its token is kept in the panel’s own storage and works like a session for a year; Settings lists each panel and disconnects it.

Your computers

When you run the installer, it sends the computer’s name (its hostname) and the list of agent tools it found, so you can see which computer you are approving. Each computer gets its own agent token, named after the hostname. We store only a hash of the token, when it last reported, and which version of the hook script reports from each place (for example “Claude Code · my-repo”), so the dashboard can tell you when a hook is out of date. The token itself is saved on your computer, in ~/.config/briefkin/env, readable only by your user.

What your agents send

Each update an agent, hook or script sends is one small JSON event. It can contain:

• a project name, and where the work runs (for example “Claude Code · my-repo”: the tool and the folder name);
• a title and a short status line;
• the state of the work (in progress, blocked, done…), its progress, and who it is waiting on;
• a checklist: the agent’s own task list;
• for a question to you: the request, why it is needed, how to do it, and answer options;
• links, metric values with their dates, and the charts or tables an agent describes.

We keep every update as it arrived, so each card can show its history, and the latest state of each card. The full list of fields is in the API reference.

What the installed hook sends. By default, one card per agent session:

• A title for the task, and a status line saying what happened or what is needed. Both are written on your computer (see What stays on your computer). If no AI tool is available to write them, the hook cuts them from the first line of your prompt and the first sentences of the agent’s last reply.
• When the agent stops for permission, the tool’s own notice, such as “Claude needs your permission to use Bash”.
• The agent’s task list, when it keeps one.
• Never the whole conversation, unless you set BRIEFKIN_DETAILS=1, which also sends the agent’s full final reply so you can read it on the card.

Agents that report through the Briefkin skill, and your own scripts, write their cards themselves. The skill asks agents to report where things stand, not to copy their work, but what goes into a card is up to the agent and you. Please don’t let agents send passwords, API keys or other secrets.

What the usage collector sends. The installer also sets up a small script that runs every 15 minutes and reads the usage your agents already keep on the computer (Claude Code, Codex and OpenCode logs). It sends counts only: tokens per day, project and model, the cost the agent counted itself, the number of sessions, and your computer’s name and time zone. It also sends how much of each plan limit is used, as percentages with their reset times: Codex’s from its own logs, Claude Code’s from the usage it keeps on the computer (or what it tells the status line), and Cursor’s from your Cursor account, which the collector asks from your computer (see What stays on your computer). Never a prompt, a reply, a file or a sign-in. Projects you keep off the board are counted as “Other”. BRIEFKIN_NO_USAGE=1 installs without the collector, BRIEFKIN_NO_LIMITS=1 without the limits, and BRIEFKIN_NO_CURSOR=1 in ~/.config/briefkin/env leaves Cursor alone.

Routines. With node on the computer, the installer also adds the routines runner, a background service that runs the routines you put in ~/.config/briefkin/routines/ when you press Run on your board. It sends each routine’s name, description, input fields and schedule, and a routine’s run as a card (what the agent says it is doing, its questions, its result). We keep the inputs you type for a run with that run. So you can see what a routine does from the board, it also sends its prompt, folder, allowed tools and file path, which we keep until the routine leaves that computer; a routine whose file says private: true keeps them on your computer. When you change a routine’s prompt on the board, we hold the new prompt until your computer has written it into the file. When you install a skill or a widget on your computer from the board, the runner fetches it from us and writes the routine there. If the skill asks which property, repo or channel to use, we hold your answers only until your computer has written them into the routine, then delete them. For a widget your agent fills, we keep what you typed in the widget builder (its name, what the agent should report and the widget’s shape) so its skill and its install command work; its address is random and unlisted. BRIEFKIN_NO_ROUTINES=1 installs without it.

Your answers

When you answer a card, in the dashboard or by tapping or replying in Telegram, we store your answer on the card and hand it to the agent when it next checks.

Your settings

How you arrange your board (pinned projects and cards, view, tile sizes, project colours, wall motion), your “What gets sent” rules, snoozed and archived cards, and, if you connect Telegram, the chat’s id and title.

Feedback

If you send feedback from the dashboard, we store your message, the page you sent it from, your answer to “Would you pay?” if you gave one, and your username with it.

Technical data

Like any website, every request reaches our servers with your IP address, your browser’s user agent and the address requested. Cloudflare processes this to deliver and protect the site, and our error logs keep request details for a few days so we can fix problems. We don’t use it to profile you.

Page visits

To see which pages people read and where they came from, our pages load Cloudflare Web Analytics. For each page view it reports the page address, the site that linked you here, your browser and device type, your country and how fast the page loaded. It sets no cookies, keeps nothing in your browser and doesn’t fingerprint you, so it can’t follow you across visits or other sites. We only see totals. Cloudflare’s Web Analytics page explains how it works. A content blocker that stops it changes nothing else on Briefkin.

What we don’t collect

No advertising or tracking cookies, no pixels, no fingerprinting, no third-party trackers. Fonts, videos and images are served from briefkin.dev itself; the only outside request a page makes is Cloudflare’s analytics script.

The State of AI agent coding survey

The quiz at /state-of-ai-coding needs no account. Each run gets a random id; we store your answers to its multiple-choice questions, the optional lines you type (a tool or way of running agents the list missed, and one line of advice), your result, the day, whether you used a phone or a desktop browser, and the tag on the link you came from (such as a post or a colleague’s link). We don’t store your IP address or anything about your location; region is a question you can skip. Your browser holds a secret that lets it finish or resume its own run and nobody else. Published numbers are counts only, shown once at least 10 people have answered, with small groups hidden in filtered views; your advice line appears on the report only if you ticked that it may. A tool or setup you type in is read only by the survey’s maker, to improve the questions, and is never published as typed. Kin’s model-written lines see only the options you picked, never what you typed. If you type an email address to get the report, it is kept in a separate table, used for one confirmation and one report mailing, and deleted afterwards.

What stays on your computer

Briefkin is built so that the sensitive part of your work never has to leave your machine. Most of the deciding happens in the hook, on your computer, before anything is sent.

• Your code and files. Briefkin never reads your repositories, files or terminal output. The hook looks at the folder’s name (and the repository’s, from git) only to label the card.
• Status lines are written on your computer. To turn a prompt and a long reply into one short line, the hook asks an AI command-line tool you already use: Claude Code (with Haiku), else Codex, else OpenCode, on your own login. Your prompt (up to 3,000 characters) and the agent’s last reply (up to 6,000) go to that provider under your own agreement with them, like the rest of your agent’s traffic. They never pass through Briefkin; only the finished line is sent. Briefkin’s own AI features (the daily Brief, ask triage, card merging and board routing, under Who else handles it) read only what is already on your board. Set BRIEFKIN_SUMMARIZER=off to turn this off.
• Your “What gets sent” rules. In Settings you choose which projects are sent (all, all but some, or only some) and whether chats outside any project are sent always, never, or only when your own rule allows it. The hook fetches your rules and applies them on your computer, so a task you keep off the board sends nothing at all, not even its title. As a backstop, Briefkin also drops anything from an excluded project that reaches it anyway.
• Private mode. With BRIEFKIN_PRIVATE=1, the hook sends no text from your prompts or the agent’s replies, to Briefkin or to any AI tool. Cards show only states such as “Working on a prompt”, “Waiting for permission” and “Turn finished”, with the agent’s task list when it keeps one.
• Working files. The hook keeps small notes about each session in your temporary folder (the current task, your last prompt, the plan) so it can tell what changed. They never leave your computer.
• Your agents’ logs and sign-ins. The usage collector reads your agents’ local logs on your computer and sends only the totals. For Cursor’s plan usage it reads the sign-in Cursor.app keeps on your computer (or a cursor.com session cookie you paste into ~/.config/briefkin/env) and uses it from your computer to ask cursor.com, the way desktop usage widgets do; that sign-in goes to cursor.com only and is never sent to Briefkin. BRIEFKIN_NO_CURSOR=1 turns this off. The Claude Code status-line shim saves what Claude Code tells the status line (model, folder, context and limit figures) to ~/.config/briefkin, and only the limit percentages are sent. From Claude Code’s own settings file, ~/.claude.json, the collector reads one entry, the plan usage Claude Code keeps there, and sends only its percentages and reset times; nothing else in that file is read or sent.

The installer and the hook are plain shell scripts you can read before running them, at /install and /hooks.sh. To stop a computer from sending, revoke its token in Settings; it stops at once. To remove Briefkin from a computer, delete the Briefkin entries from your agents’ settings (the installer left a .briefkin-backup next to every file it edited) and the ~/.config/briefkin folder.

How we use it

We use your data to:

• show your board, cards and their history to you, and only to you, except a board you share: its public link shows its widgets and the numbers you switch on, to anyone with the link, until you stop sharing it (agent cards and asks never show there);
• send the Telegram alerts you turned on, and deliver your answers back to your agents;
• write your daily Brief and sort your asks (a real decision, a routine permission or something that can wait), with an AI model;
• connect your computers to your workspace during setup;
• keep Briefkin secure and working: prevent abuse, investigate errors, enforce limits;
• understand use in aggregate: we count accounts, new sign-ups and workspaces that reported something in the last 7 days, without reading what your cards say;
• read and act on your feedback;
• tell you about changes to Briefkin, its prices or these policies, in the dashboard and on this site.

We don’t:

• sell or rent your data, or share it with anyone for advertising;
• use your cards to train AI models, ours or anyone else’s;
• look at what your cards say, except when you ask us to help with something, when we need to in order to fix a problem or keep the service safe, or when the law requires it.

Legal bases

For people in Serbia, the EU, the UK and places with similar laws: we use your account, cards and settings to provide the service you signed up for (performance of a contract). We keep logs, protect the service and count use in aggregate because we have a legitimate interest in running a secure, working product. Feedback and Telegram alerts are things you choose to use. We keep records the law requires us to keep, such as payment records once paid plans start (legal obligation).

Who else handles it

Briefkin relies on a few providers. Each one handles only what it needs for the job listed, under its own security and privacy commitments.

Cloudflare, Inc. hosting, database and logs

Runs Briefkin’s servers (Workers), stores its database (D1), counts page visits (Web Analytics) and sends the survey’s result email (Email Service) to people who ask for the report. Everything on this page passes through Cloudflare. Their privacy policy.

GitHub, Inc. sign-in

You sign in on GitHub, which tells us your user id and username. GitHub knows that you signed in to Briefkin. Their privacy policy.

Anthropic, PBC the daily Brief, ask triage, card merging, board routing and the skill creator

To write your daily Brief, Briefkin sends Anthropic’s Claude the facts of your last day from your board: card titles, asks, project and board names, numbers and AI cost. To sort your asks, it sends each new ask’s title, text, options and project (the hook’s permission prompts are sorted without it). To show the same task reported by two sessions as one card, it sends a new card’s title, summary, project, source and links, with those of the few recent cards it could repeat. When a project reports for the first time and you have more than one board, it sends the project’s name, its card’s title, summary and source, and your boards’ names with the projects and widget names on them, to pick the board it belongs on. The skill creator sends what you describe. The State of AI agent coding quiz sends the labels of your picks (never the open line you type) so the mascot can write two lines about them. Requests may pass through Cloudflare’s AI Gateway. Under Anthropic’s commercial terms, this data is not used to train their models. If a model hosted by Cloudflare (Workers AI) is picked instead, the same data goes to Cloudflare. Their privacy policy.

Telegram alerts, only if you connect it

An alert carries the project, the card’s title, the request or status line, where the work runs, a link to the card and answer buttons. Your taps and replies come back through Telegram. Messages stay in your chat under Telegram’s policy. Their privacy policy.

Gumroad, Inc. payments, when paid plans start

Paid plans are not live yet. When they are, Gumroad will run checkout and hold your payment details; we will never see your card number. This page will say exactly what we receive from Gumroad before anyone pays. Their privacy policy.

Your own AI tools are not our providers. Anthropic, OpenAI or whichever provider writes your status lines does so through your own command-line tool and your own account. Briefkin sends them nothing.

We may also disclose data when the law requires it (for example, a valid court order), to protect someone’s safety, or if Briefkin is sold or transferred. A new owner would have to keep the promises on this page, and we would tell you first.

Where it’s processed

Cloudflare runs on a global network, and our providers are based in the United States, so your data may be stored and processed outside your country, including in the US. Where data leaves Serbia, the EU, the UK or Switzerland, they rely on recognised safeguards such as standard contractual clauses or the EU-US Data Privacy Framework.

How long we keep it

Your account until you delete your account

Your GitHub user id and username, and your workspace.

Cards and their history until you delete your account

Every update as it arrived, the current state of each card, metric history, your answers, your daily Briefs, the label triage gave each ask and which cards were shown as one. Archiving a card hides it from the board; it does not delete it. Cards the hook made that go quiet are put away after 1 to 12 hours without news and archived 3 days later.

Settings until you change them

Board layout, “What gets sent” rules and your Telegram connection (until you disconnect it).

Feedback until you delete your account

Or sooner, if you ask.

Survey answers finished: kept as counts; unfinished: 7 days

The State of AI agent coding survey keeps finished answers and the result under a random id that nothing links to you. A quiz opened and not finished is deleted after 7 days. An email address typed to get the report is deleted after that one mailing, or sooner if you ask.

Agent tokens until you revoke them

A revoked token stops working at once, and stays listed as revoked in Settings.

Sign-in sessions 30 days

Or until you sign out. A Chrome side panel’s sign-in lasts a year, or until you disconnect it in Settings. Expired sessions are deleted automatically.

Setup and link codes minutes

Setup codes expire after 15 to 60 minutes and are deleted a day later. Telegram link codes expire after 10 minutes.

Server logs a few days

Kept by Cloudflare so we can investigate errors, then deleted.

Backups up to 30 days

Data you delete can remain in database backups for up to 30 days before it is gone for good.

Deleting your account

There is no delete button yet. Ask at privacy@briefkin.dev with your GitHub username, or send the request with Feedback in the dashboard, which tells us it really comes from your account. We delete your workspace and everything in it (cards, history, tokens, sessions, settings, feedback and the Telegram connection) within 30 days and confirm when it is done. You can also remove Briefkin’s access on GitHub, under Settings, Applications.

Your choices and rights

In the app, any time

• Choose what your agents send, in Settings, What gets sent.
• Revoke a computer’s token, in Settings, Agents.
• Disconnect Telegram, in Settings, Telegram alerts.
• Archive cards, and sign out of the dashboard.

By asking us

Write to privacy@briefkin.dev, and you can:

• get a copy of your data, which we send as JSON;
• have anything wrong corrected;
• have your account and everything in it deleted;
• object to, or ask us to restrict, how we use your data.

We answer within 30 days and don’t charge for it. You can also complain to a data protection authority: in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection, or the authority where you live. We would like the chance to fix it first.

Security

• Credentials are stored only as SHA-256 hashes: agent tokens, sign-in sessions, setup codes and Telegram link codes. A copy of the database would not contain anything that lets someone sign in or report as you.
• Everything travels over HTTPS. The session cookie is __Host- prefixed, HttpOnly, Secure and SameSite=Lax, and the dashboard refuses changes sent from other sites.
• Every query is scoped to one workspace. An agent token can only read and write its own workspace’s cards.

No system is perfectly secure. If a breach affects your data, we will tell you in the dashboard and notify the authorities where the law requires. Found a vulnerability? Please write to privacy@briefkin.dev.

Cookies and local storage

Briefkin sets only the cookies it needs to sign you in, and none for tracking or analytics, so there is no cookie banner.

__Host-bk_session 30 days

Keeps you signed in. Holds a random token; we store only its hash.

bk_oauth_state 10 minutes

Protects GitHub sign-in from forged requests.

bk_oauth_next 10 minutes

Remembers which page to open after sign-in, such as the card a Telegram alert linked to.

bk_oauth_from 10 minutes

Remembers which page of this site you started signing up from.

The dashboard also remembers a few view choices in your browser’s local storage. These stay on your device and are never sent to us:

briefkin.group

Whether the board is grouped by status or by project.

briefkin.listProject

Which project the list view shows.

briefkin.snooze

The snooze length you picked last.

briefkin.panelToken

Only inside the Chrome side panel: its sign-in token, kept apart from the site’s own storage.

briefkin.quiz

Only after you open the State of AI agent coding quiz: your run’s id and secret, your answers so far and your result, so a closed tab loses nothing. “Start over” on the result removes it.

Children

Briefkin is a tool for developers and isn’t meant for children. You must be at least 16 to use it. If you think a child has given us personal data, tell us and we will delete it.

Changes to this policy

When this policy changes, we update this page and the date at the top. If a change matters to you, such as a new kind of data, a new provider that sees your cards or a new use for them, we will say so in the dashboard at least 14 days before it takes effect.

Contact

Questions, requests and complaints: privacy@briefkin.dev, or Feedback in the dashboard. Briefkin is run by Petar Slovic, Serbia.