Privacy Policy

Last updated: November 1, 2026 (version 2026-10-28-v7). Replaces version 2026-10-28-v6.

This policy explains what Bryno ("Bryno", "we", "us") collects when you use bryno.io, why, who helps us process it, how long we keep it, and the choices you have. It covers personal cards, accounts, business profiles, AI agents and the report form. "Bryno" is a trade name (a "doing business as" name) used by the owner of the Bryno business; when this policy says "Bryno", "we" or "us", it means that owner.

Questions or requests: support@bryno.io.

The short version

• Bryno doesn't sell your personal information or share it for advertising.
• Bryno has no analytics, advertising or tracking scripts, and no third-party cookies.
• Bryno counts, per day, how many times each card is opened, opened from its QR code, has its contact file downloaded, and receives a shared contact, to show the owner those totals. The counts hold no visitor identity, IP address or cookie.
• Your card is private until you share its link. Anyone with the link can then see it.
• Bryno doesn't store the text of AI chats.
• You can download your data, delete a card, or delete your account yourself, at any time.

What we collect and why

Where a period is given below, deletions run once a day, so an item can last up to a day longer.

Your account

• Your email address, to create your account, sign you in and send you service emails (sign-in links, security notices, purchase and renewal notices, account-deletion confirmations, and notices about your content). Kept while your account exists.
• Sign-in records (the email address, the time, one-way fingerprints of the link, the code and the device that asked for them, and the number of wrong codes), to sign you in and stop abuse. Deleted after 30 days.
• Sessions (a one-way fingerprint of your sign-in cookie and when it was used), to keep you signed in. Deleted 30 days after a session ends or is revoked.
• Account history (for example when a card was added), deleted after 30 days. The record that an email address was changed or an account deleted is kept for 365 days as a security record; it doesn't include the address.

Your cards

• What you put on a card: your name, title, phone, email, photos, the sections you add, and any payment links. We use it to build and show your card.
• Photos. Up to 40 uploaded images per card. Each image is re-encoded to WebP (at most 1,600 pixels, plus a 480-pixel thumbnail) by Cloudflare Images; Bryno doesn't keep the original file. According to Cloudflare's documentation, this conversion removes embedded metadata, including location (EXIF/GPS) data. Photos are private until the card is shared; a shared card's link shows the photos the card uses.
• Card settings, such as whether the share link is on and whether you allow search-engine indexing.
• Drafts. A free card you start but don't keep in an account is deleted 30 days after you create it. A card kept in an account, or a card with Pro, stays until it's deleted. Keep a Pro card in an account so you can edit or delete it from any browser: without one, your browser's access to it ends after 30 days, and you can ask us to delete it at support@bryno.io.

Saved connections and follow-up drafts

When you save someone's card, Bryno keeps their name, title, phone and email, the note and place you type, and, only if you allow your browser to share it, your approximate location rounded to two decimal places (about 1 km). Only you see them. They're tied to the browser you saved them in and are deleted 90 days after you last change them, or sooner if you remove them. Follow-up drafts are saved with the connection and deleted with it.

The same applies the other way round: if someone saves your card, or you share your card back with someone, a copy of your card's name, title, phone and email is kept in their list on Bryno until 90 days after they last change it. Deleting your card doesn't remove those copies; email support@bryno.io if you need them removed.

Business profiles and the website analysis

• The website analysis: the address you enter, the public pages BrynoBot reads (up to ten) and the facts it extracts. Kept 30 days.
• Draft and published business profiles: the details, images and text you approve. Private drafts are kept 30 days. If you start checkout, the unpublished profile and the images you approved for it are kept until you ask us to delete them. Published information stays while the profile exists.
• Website verification records, to confirm you control the website.

AI chats

Your card's AI agent. What you teach it (your answers to its topics, its greeting and starter questions) and any web pages or PDFs you add. Text from a page or PDF is used only after you approve it. Kept with your card, and deleted when the card is.

When a visitor chats with a card's or business's AI agent, or Bryno's own, the question, the recent conversation and relevant information from that card or profile (including what its owner taught the agent) are sent to Anthropic to generate a reply. Bryno doesn't store the chat text. We record only counts, token usage, cost and outcome, and a session identifier (a one-way fingerprint of a random browser identifier and the visitor's network address) used to apply conversation limits. These are kept 30 days. Please don't share sensitive information in a chat.

Purchases

Stripe processes payments. Bryno never sees or stores your card number. Stripe gives Bryno the amount, status and the email address you gave Stripe. For each purchase we also keep the words you agreed to, their version, the plan and the time. We use this for payment records, support, refunds, renewal notices and our legal and tax obligations. Order and consent records are kept for at least 7 years after the purchase, or after the subscription ends if that's later, and are not deleted when you delete a card or account.

Reports

If you send a report at /report, we keep what you submit: the page address (and the image address, if you give one), your description, the statements you confirmed and the version of their wording, and, where the report type needs them, your name, email address, signature and (for a copyright counter-notice) your postal address. We use this to review the report, contact you about it and keep a record of what we did.

• Email confirmation. For a report about an intimate image or child safety that includes an email address, we email you a single-use confirmation link. While the report is unconfirmed, we keep only a one-way fingerprint of that link, never the link itself, along with when it expires and how many links we've sent. When you confirm, the fingerprint is deleted and we record the time you confirmed.
• Abuse prevention. We keep a coded form of your network address, to limit abuse of the form; it's cleared after 30 days.
• Who sees it. We don't tell the owner of a reported card who reported it. We may share a copyright notice or counter-notice with the other party, as copyright law contemplates, and we may share a child-safety report with the National Center for Missing & Exploited Children or law enforcement.
• If your card is reported. We keep the report and a record of each step we take (for example restricting a card or disabling an image). When we disable an image, we keep a one-way fingerprint of the image file so identical copies can't be uploaded again, until Bryno lifts the block. We also delete the card's stored preview images and contact photos, which may show the image; they're made again without it.
• How long. Reports and the records of what we did about them are kept for as long as they may be needed for legal or safety reasons; we don't currently delete them on a fixed schedule.

Other information

• Agent-network invitation requests (contact name, email and agent details): kept 90 days after a decision, or 180 days after submission if undecided.
• Agent registrations (invite-only): a registered AI agent's public details, such as its name, the addresses of its card and endpoint, and its operator's website, are stored and shown in the agent directory while it's listed.
• Network address and request information. Your browser sends your network (IP) address with every request. Bryno uses it for rate limiting and abuse prevention; rate-limit records, some keyed by network address, are deleted after 24 hours. Cloudflare also processes network and request information to host and secure Bryno and keeps operational logs under its own service retention.
• Product and security logs. Bryno's server writes short log lines about events, such as "a card was created", "an account was deleted" or "a report came in". They hold identifiers and reason codes, not network addresses, chat text or what you type into a card or chat (a few name the website address you asked Bryno to analyze). Cloudflare's request logs also record the address of each page requested, which for sign-in and confirmation links includes their single-use code. Both are kept in Cloudflare Workers Logs under its retention.
• Contacts shared with a card. If a visitor chooses to share their contact details with a card's owner (name, email and, optionally, phone) and ticks the consent box, Bryno stores them for that owner, who can see them on their card's page. Bryno doesn't email or market to them, and they're deleted after 180 days, or sooner when the owner deletes them, the card or the account.
• Former updates opt-in. An earlier version of Create Your Card had a box to hear about new features. It has been removed. Bryno doesn't send marketing email; cards that ticked it keep that record on the card.

What's public

• A shared personal card: everything on the card, including its photos, is visible to anyone with the link. Turning the link off stops the old address working. Copies people already saved (a contact file, a screenshot) are outside our control.
• A published business profile: what the owner approved for publication.
• Search engines. While Bryno's sitewide indexing is off, as it is now, Bryno asks search engines and AI crawlers not to read or index any of its pages, including shared cards and published business profiles. When it's on, share links still tell search engines not to index a card unless its owner allows it.

Cookies and browser storage

Bryno uses only first-party cookies that are strictly necessary for the service, or that remember a choice you made. Bryno has no analytics, advertising, session-replay or third-party scripts, and its fonts are hosted by Bryno.

bryno_session, bryno_account and bryno_signin can't be read by page scripts (HttpOnly).

Bryno also keeps a few items in your browser's own storage, which aren't sent to Bryno unless noted:

• Until you close the tab: bryno_visitor (an identifier that keeps a business chat together), bryno_left and bryno_wizard_start (navigation), bryno.background.idea:… (text you type into the AI background idea box), and, on websites that add a business's chat widget, bryno_widget_session and bryno_widget_ref. While widget analytics are off, as they are now, the widget doesn't send the referring site or campaign tags.
• Until you clear site data: bryno-buddy-visitor (an identifier for Bryno's own AI agent), bryno-ce-hint (you dismissed an editor tip) and bryno.music.provider (your preferred music app).

No cookie banner. Every cookie and storage item Bryno uses is either strictly necessary to provide the service you asked for or remembers a choice you made, and none is used for analytics, advertising or tracking. For that reason, Bryno doesn't show a cookie consent banner.

Requests your browser makes to other sites

• Images on cards. A card may show artwork loaded directly from other services: Apple (mzstatic.com), Open Library, Google Books, Spotify, YouTube thumbnails, TVmaze, RAWG and the Internet Archive (archive.org). When your browser loads them, those services receive your network address. Bryno tells your browser not to send them the page address (no referrer).
• Media search in the editor. When a card owner searches for music, books or films in the editor, the owner's browser sends the search words to Apple's iTunes Search and to Wikidata directly. Those services receive the search words and the owner's network address, but no Bryno cookies and no referrer. Bryno's servers also look up the titles and links a card owner adds with Spotify, Apple, YouTube, Open Library, Google Books, TVmaze, RAWG and Wikidata, to show their artwork and details; those services receive the search words or the link, but not the owner's network address.

Do Not Track and Global Privacy Control

Bryno doesn't track visitors across other websites and doesn't allow third parties to do so through Bryno. Because of that, Bryno treats every visitor the same whether or not the browser sends a Do Not Track or Global Privacy Control signal.

Who processes data for us

• Cloudflare: hosting, the database (D1), image storage (R2) and resizing (Images), email delivery, Workers Logs and security.
• Stripe: payments. Bryno never sees your card number.
• Anthropic: AI replies, drafting text from a business's website or from a page you add for your card's agent, and follow-up drafts. For a follow-up draft, Bryno sends the names and titles involved, how and when you connected, your note and place, and your card's link.

Our statement that Bryno doesn't store chat text doesn't mean the AI provider keeps nothing. Anthropic's commercial retention rules include exceptions for safety, legal obligations and agreed arrangements; see Anthropic's retention policy. Cloudflare keeps operational logs under its configured service retention; see the Workers Logs documentation.

We don't sell or share personal information for advertising. We disclose information to others only as this policy describes, when you ask us to (for example by sharing a link), or when the law requires it, including reports of apparent child sexual abuse material to the National Center for Missing & Exploited Children and responses to valid legal process. We may also disclose information to protect people's safety or Bryno's rights. If the Bryno business is sold or reorganized (for example as a company), the information may pass to whoever takes it over, who must keep using it as this policy describes unless they tell you otherwise first.

Legal holds

Information connected to a report or legal matter may be placed on a legal hold. While a hold is open, that information isn't deleted, even on the schedules above or when you ask. If a hold delays your deletion request, we tell you, record the request (or, for a card that isn't in an account, alert our team), and finish it after the hold is released.

Your choices and rights

You can do these yourself, at any time:

• See and edit your cards from My Cards.
• Download my data: a JSON copy of your account, its cards, their image details, purchases and what you agreed to, sessions and sign-ins (times only), account history and requests.
• Turn off a share link, and choose whether search engines may index a card.
• Delete a card. Its row, photos and every stored copy, including its link-preview images and contact photos, are deleted. Copies of its contact details in other people's saved connections stay, as described above. Deleting a card with Pro ends Pro for that card and isn't a refund.
• Delete your account and all its cards in one step.
• Remove a saved connection.
• Change your email address. We send a security notice to the old one.
• Stop BrynoBot reading your website with robots.txt (User-agent: BrynoBot / Disallow: /).
• Unpublish a business profile from its dashboard.

For anything else, including access to or deletion of information not covered by Download my data (such as a business profile or saved connections), correction, or a question, email support@bryno.io. We verify requests about an account by confirming them through that account's sign-in, and may ask for more information to verify other requests. We don't treat you differently for making a request.

State privacy laws. Some states give residents rights under comprehensive privacy laws, such as the California Consumer Privacy Act and the Texas Data Privacy and Security Act. Bryno currently falls below the thresholds at which those laws apply, but honors requests to access, correct or delete personal information from everyone, wherever they live.

Security

Sign-in uses single-use links and codes that expire in 10 minutes; Bryno's database stores only one-way fingerprints of them and of session cookies. Payments are handled on Stripe's pages. No system is perfectly secure. If a breach affects your personal information, we'll notify you as the law requires.

Children

Bryno is for people 18 and older and isn't directed to children. We don't knowingly collect information from anyone under 18. If we learn that a card or account belongs to a minor, we disable it and delete it. If you believe a minor is using Bryno, tell us at support@bryno.io or through /report.

Visitors outside the United States

Bryno is based in the United States and is offered to people in the United States. It isn't directed to people in the European Union or the United Kingdom. Information is processed in the United States and wherever Bryno's service providers operate. Wherever you live, you can ask us at support@bryno.io to access, correct or delete your personal information, and we'll honor the request.

Changes to this policy

We'll post changes here with a new "last updated" date. If a change is material, we'll post it before it takes effect and, where you have an account or purchase, email you.

Contact

Email support@bryno.io.