Bragi beta privacy notice

Bragi is operated by Skald and Stone LLC. Privacy questions and deletion requests can be sent to james@skaldandstone.com.

Bragi connects a Slack workspace to sources authorized by its members. It stores workspace and member identifiers, installation settings, Slack profile email addresses, and encrypted OAuth credentials. These records enable private replies, identify the connecting member, and enforce workspace boundaries. A member's source searches use that member's own provider permissions. Administrators can limit the folders and Confluence spaces searched. Those application limits do not reduce the broader Google Drive read-only permission shown during consent.

Source text is fetched as needed to produce excerpts and citations. It is not maintained as a shared content index. Private answers remain in Slack under the workspace's retention settings. The standalone beta currently makes no AI model calls. Connecting an AI provider is not enabled by source consent.

Installation settings and credentials are retained while the connection is active. Disconnecting removes the saved source credentials; operational connection status and Slack identifiers can remain until workspace uninstall. Uninstalling removes that workspace's installation, source credentials, sessions, drafts and queued work from the active registry. Pending OAuth state expires within ten minutes; application sessions expire within one hour. Interrupted queued requests can remain for up to 24 hours before expiry. Local disconnect does not revoke the provider-wide OAuth grant; that can be revoked in the provider account's settings.

The beta runs on Google Cloud infrastructure. Cloudflare supplies DNS. Slack, Google and Atlassian process requests under their own policies. Optional company logo URLs contact the selected image host when a settings page is displayed. OAuth credentials are encrypted at rest; access to operator infrastructure remains restricted.

Google-source data is used only to deliver the requested Bragi features. It is not sold, used for advertising, or used to train general-purpose AI models. Bragi's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy.

The operator can assist with access, correction and deletion requests using the contact above. Material changes to these practices require an updated notice before the changed feature is enabled. This beta notice applies to Bragi at bragi.skaldandstone.com.

Bragi periodically reports retained Atlassian account identifiers and the oldest dates that their profile data was retrieved to Atlassian's Personal Data Reporting API. These reports do not include document text. Atlassian's responses can require Bragi to remove saved Atlassian connections and request fresh consent. An application-level operator credential supports reporting independently of customer Slack installations; removing the operator's Slack installation does not disconnect that reporting credential. Disconnecting reporting, or an uncertain reporting failure, removes saved Atlassian connections from Bragi and requires reconnect. Keyed account hashes and reporting dates can remain after erasure to enforce reporting intervals and prevent closed accounts from being retrieved again. Google connections and source-system permissions are unaffected.

Bragi · Privacy notice · Beta terms