Privacy Policy

Last Updated: March 2026

Thank you for using "Brain Behavior Tree". This policy explains what data we collect, store, and how we protect it.

1. What Do We Store in Our Database (MongoDB)?

If you log in with Google, we store the following in our server database:

Account Data (Users)

Activity Logs (AuditLog)

We log your actions for debugging and security purposes:

Logs use an anonymous sequential number. After account deletion, logs can no longer be linked to your identity.

Rate Limiting Data (Security)

To prevent abuse, we temporarily store: IP address, anonymous user ID, request counts, user-agent hash, and suspicion scores. This data automatically expires after 24 hours.

Ban Records (BannedUsers)

Users who severely abuse the service may be permanently banned. The ban record stores only a one-way SHA-256 hash (with a server-side random salt) — it cannot be reversed to identify your Google ID or email.

2. Where Is Your Behavior Tree Data Stored?

Your actual behavior tree analysis data is never stored on our servers. It lives only in:

• Your browser's Local Storage: settings, nodes, login token, preferences
• Your Google Drive (if authorized): via the drive.file scope — only files created by this app or explicitly selected by you

3. Google Drive API Scope

• We can only access files created by this app or files you explicitly open via the Drive Picker
• We cannot access any other files, photos, or folders in your Drive

4. Data Deletion

Use "Remove all my data" in the app menu at any time:

• All account data (Google ID, email, name, picture, tokens, Drive paths) is permanently deleted
• Anonymous audit log entries may be retained (cannot be linked to your identity after deletion)
• Ban records (if any) use one-way hashes and may be retained permanently to prevent re-abuse

5. Data Security

• OAuth tokens encrypted with AES-256-GCM
• Ban identification uses SHA-256 + server-side salt one-way hash
• All APIs have rate limiting and abuse protection

6. No Data Sharing

We will never sell, trade, or rent your personal data to any third party.

7. Contact & Revocation

To revoke Google authorization, visit Google Account Security Settings. To delete all your data from our database, use the "Remove all my data" option in the app.