Privacy Policy

Effective date: October 8, 2026

This Privacy Policy explains how we collect, use and share your personal information when you use Bacopa, its web app, its MCP server and its Chrome extension, and your rights over that information. By using Bacopa, you agree to this Privacy Policy. Please also read our Terms of Service.

1. Information we collect

• Account information: if you sign in with GitHub, your GitHub account's numeric id and username; if you sign in with Google, your Google account's id. The provider gives us these when you sign in. Apart from your email address, we don't ask either for anything else, and we don't keep the access token it gives us. Each GitHub or Google account is a separate Bacopa account, even when both have the same email address.
• Email address: the address GitHub or Google has verified for your account, which it gives us when you sign in. When you create your account, we keep it to send you a few emails during your trial, about getting started and about when the trial ends, and we delete it after the last one, on your fifth day, when you unsubscribe with the link at the end of each email, or when your account is deleted. When a subscription ends, we send one email to the address you paid with, which Stripe gives us, and we don't keep it. Otherwise, we don't keep your address.
• Bookmarks: the links you save, the PDFs you upload, and what Bacopa makes from them: a copy of each document (its original), its text, its facts, its brief, and an embedding of each fact, a list of numbers that lets search find facts by meaning. With each bookmark we record when it was saved, whether you or an AI agent saved it, and which connected client saved it.
• Trial and subscription: when your trial starts and ends; if you subscribe, Stripe's ids for you as a customer, for your subscription and for the checkout page you opened last, whether you pay monthly or yearly, its status and its dates; if you joined with an invitation, which one you used; and the date your account will be deleted if you have neither. We also keep the time of each save for 30 days, to count the saves your trial or subscription allows. Stripe collects your payment details on its own checkout; we never see them.
• Imports: only the links of a file you import. Titles, tags, notes and dates in the file are dropped, and each link waits in a queue until Bacopa saves it.
• Connected clients: the registration of each AI client you connect through MCP, and the access tokens it holds.
• Sessions: a record for each browser you sign in with, which we delete when you sign out and which expires after 30 days.
• Free tools: PDF to Markdown reads the PDF you upload, and URL to Markdown fetches the page you name, to make its Markdown; neither tool keeps the file, the page or the Markdown. To limit abuse, each counts conversions by IP address for one minute.
• Usage data: logs of requests to Bacopa, such as the address requested, its time and its outcome, which we use to fix problems and keep the service secure.

We don't collect sensitive personal data unless it appears in the documents you save. If it does, you are responsible for making sure that processing it complies with applicable data protection laws.

2. How we collect information

We collect personal information when you:

• Sign in with GitHub or Google.
• Save links, upload PDFs or import links, in the web app, with the Chrome extension, or through an AI agent.
• Connect an AI client through MCP.
• Subscribe, through Stripe's checkout.
• Contact us for support.

The Chrome extension sends Bacopa only the address of the tab or link you choose to save, and the words you type after bc in the address bar to search your bookmarks. It never reads the content of pages, your browsing history or your browser's bookmarks.

3. How we use your information

We use your personal information to:

• Provide Bacopa: fetch the pages you save, extract their text, write their facts and briefs, and let you and your agents search and read them.
• Send a new account a few emails during its trial, which you can stop at any time, and one email when a subscription ends.
• Count the saves your trial or subscription allows, and delete accounts that have neither.
• Maintain, improve and secure the service.
• Respond to support requests and replies to our emails.

Your documents are processed only to build your own bookmarks. Nothing from your bookmarks is shared with other users, even when they save the same page. We don't use your documents to train AI models, we don't use your information for advertising, and we don't sell it.

4. Legal basis for processing

We process your personal information, including your bookmarks, on the following legal bases:

• Contractual necessity: to give you access to Bacopa and its features.
• Legal obligation: to comply with legal requirements.
• Legitimate interests: to maintain, improve and secure the service, including through request logs, and to help you get started with a few emails, which you can stop at any time.

5. Sharing of information

We share your information with:

• Cloudflare: for hosting and storage, to run the AI models that extract text from web pages, write facts and briefs, and embed facts and search queries (Workers AI), and to send and receive email.
• GitHub or Google, whichever you sign in with: to sign you in.
• Stripe and Link, its payment service, which sells subscriptions as merchant of record: to take payments, collect taxes and manage your subscription. Stripe receives your Bacopa user id with your subscription, and handles what you enter at checkout under its own privacy policy.

To fetch a page you save, Bacopa requests it from the website that publishes it. The website sees a request from Bacopa's servers, not from you. We don't share your personal information with any other third party, except as required by law.

6. International data transfers

As our service is accessible worldwide, your personal information may be transferred and stored outside your country of residence.

7. Data retention

We keep your personal information for as long as your account is active, and as needed to comply with legal obligations or resolve disputes.

• Deleting a bookmark deletes its original, its text, its facts, their embeddings and its brief.
• Deleting your account, from the Account screen, cancels your subscription, deletes all your bookmarks, your queued imports, your email address, your trial and subscription record and your sessions, and revokes every client you connected. We delete an account in the same way when its trial ends without a subscription, and 30 days after its subscription ends. Stripe keeps its own payment records as the law requires.
• Our database keeps backups for up to 30 days, so deleted data leaves them within 30 days.

8. Security

We use appropriate technical and organizational measures to protect your personal information against unauthorized access, loss or misuse. Your bookmarks are never publicly reachable, and we store only a hash of each session, so a leak of our database couldn't sign anyone in.

However, Bacopa is an alpha service under active development and is built in part with AI-generated code, so there may be risks and limits in its security and reliability. Avoid saving highly sensitive documents at this stage, and export your links regularly.

9. Cookies

Bacopa uses only the cookies it needs to work, and no analytics, advertising or tracking cookies:

• bacopa_session keeps you signed in, for up to 30 days.
• bacopa_github_state and bacopa_google_state protect signing in with GitHub or Google, for 10 minutes.
• sidebar_state remembers whether the web app's sidebar is open, for 7 days.

10. Your rights

Depending on where you live, you may have the right to:

• Access your data.
• Correct or update inaccurate data.
• Request deletion of your data.
• Object to or restrict processing of your data.
• Data portability.

You can exercise several of these rights yourself in the web app: export your links as CSV, download each bookmark's original, and delete bookmarks or your whole account. For anything else, contact us at hello@bacopa.dev.

11. Children's privacy

Bacopa is not intended for children under 13 (or 16 in the EU). We don't knowingly collect personal information from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will tell you through the service. Please review this policy from time to time.

13. Contact us

If you have any questions about this Privacy Policy or how we handle your personal information, contact us at:

Email: hello@bacopa.dev
Location: Switzerland