Privacy Policy — Bellwether

Bellwether does its work on your own Mac. The databases and files you connect to, the copies of data Bellwether pulls from them, and the workbooks you build stay on your Mac. Passwords and access tokens for your data sources are kept in the macOS Keychain and are never sent to us. Nothing you build reaches Bellwether Cloud until you sign in and choose to publish it. What you publish is stored on our servers so that your other devices, and anyone you give a share link to, can open it. Separately, the Mac app checks for updates, and unless you turn them off it sends usage analytics and diagnostic reports that never include your data. Each of these is described below.

• Workbooks. A workbook is a file on your Mac. It holds your worksheets, dashboards and calculated fields, the query behind each extract, and the definition of each connection: its name and kind, where it points (a server address, port and database name, a file path, or a hosted database's account and database identifiers) and the user name. It never holds a password or an access token. • Extracts. The rows Bellwether pulls from a data source are kept in a second file beside the workbook, together with the history of its refresh runs. • Connection secrets. Passwords and access tokens for your data sources are kept in the macOS Keychain, separately on each Mac. They are never written into a workbook and never sent to Bellwether Cloud, so a workbook opened on another Mac asks you to authorize its connections there. • Connecting. Bellwether connects from your Mac directly to the data sources you add, with the credentials you supply. Those connections do not pass through our servers.

In this release, using Bellwether on your own Mac needs no account. Publishing, opening your published workbooks on another device, share links and background publishing need a Bravely Account, which is covered by its own policy at bravely.dev/privacy/bravely-account. Signing in creates a workspace for your account in Bellwether Cloud. Bellwether is in early access and has no purchase step, so we hold no payment or purchase records for it. If that changes, this policy will be updated before any purchase is possible.

Publishing is something you start, either with the Publish command or by setting an extract to publish after each of its scheduled runs. It sends: • The workbook, as described above: its worksheets, dashboards, calculated fields, queries and connection definitions, and never a password or an access token. We keep each version you publish. • A snapshot of each extract you choose to include: the rows of that extract as they stood when it last ran, with a short description of the snapshot (the extract's name, its column names and types, the row count and size, when it was refreshed, a fingerprint of its query, and the version of Bellwether that wrote it). • If you, or a script or tool you authorize, send a table of rows to your workspace through Bellwether's interface for automated tools, those rows and their column names. We read those rows as they arrive in order to store them and to work out the type of each column. We store what you publish so that you, your other devices and the people you give a share link to can open it. We do not sell it and we do not use it for advertising. We use the records about your workspace, such as its storage use, run results and their error messages, and link and device activity, to operate and support the service. The data in your workbooks and snapshots is yours. If it contains personal information about other people, you are responsible for having the right to publish it.

A share link is something you create for one published workbook. Anyone who has the link can view what was published, without signing in, until the link is revoked: the dashboards and worksheets, the data in the workbook's snapshots, and the workbook's definition, which includes its queries and the names, addresses and user names of its connections (never a password). A link cannot be used to change anything. We store only a fingerprint of a link, so we cannot show it to you again after you create it. We record when a link was last used, and we do not record who opened it beyond the ordinary request information described under Service Requests. You can see your links and revoke them in the Mac app. A revoked link stops working immediately, and so does every link to a workbook once that workbook is deleted from Bellwether Cloud. Revoking a link cannot recall a copy that someone already saved: the Mac app and the iPhone and iPad viewer keep a copy of a shared workbook on the device that opened it.

Scheduled refreshes run on your own Mac, in the app or, if you turn it on in Settings, in a background helper that starts when you log in. In this release Bellwether Cloud does not connect to your data sources. When a run belongs to a workbook you have published, your Mac reports the result to Bellwether Cloud: when the run started and finished, whether it succeeded, how many rows and bytes it produced, and the error message if it failed. An error message comes from your data source and can include names from your query or your server. We use these reports to show run history and to mark data as out of date when a refresh is missed. Setting up background publishing registers your Mac as a device in your workspace. We store a name for it (your Mac's computer name), its platform, when it was created and last used, and only a fingerprint of its access token. Stop background publishing in Settings and that device's access is revoked. The background helper keeps its own log file on your Mac. That log is not sent to us.

If a refresh of a published workbook starts failing, we email the address on your Bravely Account once for that run of failures, not once per attempt. The message names the workbook, identifies the extract that failed, says when it failed, quotes the error message, and links to the workbook. These are service messages about your own workbooks, not marketing, and there is no setting to turn them off in this release. We keep a record of each notice: the address it was sent to, its subject and text, and when it was sent.

Published workbooks open in a browser at bellwether.bravely.dev. The charts are computed in your browser: the page downloads the snapshot and queries it there. Our servers store and send the files. They do not run your queries or draw your charts. To do that work in your browser, the page loads its charting code and query engine from a public content delivery network, and the query engine downloads components it needs from its own project's server. Those requests carry your IP address and browser details, as any web request does. They never carry your workbook or its data. Both hosts are named under Sub-processors. Signing in to the web viewer sets cookies that keep you signed in for up to 14 days and protect that session. Opening a share link sets no cookies. The viewer uses no advertising or analytics cookies, and it asks search engines not to index it.

The viewer for iPhone and iPad is distributed through Apple's TestFlight during early access, under Apple's own terms for that program. It signs in with your Bravely Account, downloads your published workbooks and their snapshots, and keeps them on the device so dashboards open offline. It can also open a share link without signing in. Delete downloads, in the viewer's Settings, removes those copies from the device and leaves your account and Bellwether Cloud as they were.

Unless you turn it off, the Mac app sends usage analytics so we can see which features matter and what breaks. Events record kinds and counts: that the app was opened, that it was updated and between which versions, that Settings was viewed, that the beta updates setting was changed, that sign-in started or finished, that a workbook was opened and whether it came from a file, the cloud or a share link, that an extract was refreshed, with the kind of connection and a rough size band for its row count, which chart type was applied, that a field's type or time zone setting was changed, and that a workbook was published. They never include your data, the name of a workbook, field, table, server, database or file, a query, or any value. Every event carries the app version and build, the macOS version and an installation identifier, and while you are signed in it also carries your Bravely Account identifier. It never carries your email address. The events about installing, opening, updating, signing in and viewing Settings are also sent to our own account service, which is where we count installs and sign-ins. You can turn this off at any time in Settings, under General, with Share anonymous usage data, and it takes effect immediately.

A diagnostic report is a short technical report that helps us fix a problem. The Mac app sends one when you press Send Diagnostic Report in Settings and, unless you turn off Send diagnostics automatically, when something goes wrong, at most once an hour for the same kind of problem. Reports are sent only while you are signed in. If the app ended in a crash, its next report notes that a crash happened. A report contains the app and engine versions, the macOS version, the app's own recent log lines, and a few counts: how many extracts, worksheets and dashboards the open workbook has, which kinds of connection it uses, the state of the background helper, and whether beta updates are on. Before a log line is kept, query text, quoted names and values, file paths inside your home folder, server names and addresses, web addresses, email addresses, and anything that looks like a password, key or token are removed. The background helper's own log is never attached. With each report we record your Bravely Account identifier, the app's network user agent, and the country your connection came from. A report you send yourself returns a short code you can give to support.

The Mac app checks our servers for a new version once a day and when you ask it to. That check tells us the version you are on and the usual information any download involves, such as your IP address. It carries nothing about your workbooks or your data. If you turn on Install beta updates in Settings, the same check also offers beta versions.

Signing in, publishing, opening a workbook from the cloud, run reports and update checks send the request information needed to operate those services, such as your account identifier or device access token, the app version, your network address, and connection or error details. We also keep a log of changes in your workspace: that a workbook, share link or device was created, deleted or revoked, by which account or device, and when. Account-level records are described in the Bravely Account policy.

In this release Bellwether does not send your workbooks, your data or your queries to any AI provider. From version 0.3.0 the Mac app can be driven by tools and agents that run on your own Mac under your own user account: through a local connection that never leaves the Mac, such a tool can open workbooks, change charts, run the same commands the app runs, and read what is on screen, exactly as you could by clicking. Whatever that tool then does with what it reads is governed by its own policy, not this one. You can turn this off in Settings, under General, with Let agents on this Mac drive Bellwether.

• On your devices: workbooks, extracts, downloaded copies and logs stay until you delete them. We hold no copy of a workbook or its data unless you published it. • Published workbooks: every version you publish is kept until the workbook is deleted. • Snapshots: for each extract we keep the 30 most recent snapshots, plus the newest snapshot of each day for 90 days. Anything older is deleted by a daily job. • Deleted workbooks: once a published workbook is deleted it stops being served at once, including through any share link, and 30 days later its versions, snapshots, share links, schedules and run reports are removed from Bellwether Cloud. Earlier copies of those records remain in Cloudflare's recovery history for up to 30 days, and earlier copies of the records and files remain in our backups until they expire, as described under "Backups" below. • Unfinished uploads expire after 24 hours and are discarded by the same daily job. • Run reports are kept for as long as their workbook is. • Failure notice records, the log of changes in your workspace, and the records of devices you have revoked are kept until you ask us to delete them. • Diagnostic reports: the log bundle of a report is deleted automatically after 90 days. The rest of the report (its code, your account identifier, the versions, the counts, the user agent and country, and when it was sent) is kept so we can see patterns across reports. Deleting your Bravely Account deletes your diagnostic reports from our live systems; our data warehouse keeps the rest of each report, without the user agent and country, under your account identifier, as the Bravely Account policy describes. • Usage analytics events are kept for as long as they are useful for understanding how the product is used. They contain none of your data. • Request logs used to operate the service are kept for a short period and then expire. This release has no control in the apps that deletes a published workbook or a whole workspace from Bellwether Cloud. To have published workbooks, a diagnostic report or your whole workspace deleted, email privacy@bravely.dev from the address on your account and tell us what to remove. Deleting your Bravely Account does not by itself remove your Bellwether workspace in this release, so ask for both if you want both.

Bellwether is intended for adults. We do not knowingly collect personal information from children under 13, or under 16 in places where 16 is the relevant age for information-society services.

We keep backups so that we can recover our customers' data if it is ever lost. Each night we copy the databases that hold accounts, purchases and the content our apps and services keep for their users, including sign-in records and the protected form of passwords, and we copy the files stored with us, such as documents, screenshots and attachments. Unless a section above says otherwise, the account, purchase and content records this policy describes, and the files you store with us, are in these backups. Where backups are kept Backups are kept in two places, both in the United States: on storage equipment that we own, and in Amazon S3, a storage service run by Amazon Web Services. Every copy of a database or of sign-in records is encrypted, with a key that only we hold, before it is stored in either place. The copies of stored files that we keep in Amazon S3 are also encrypted with a key that only we hold, file names included; the copy of those files on our own equipment is not separately encrypted. Amazon does not have our keys, so it cannot read your data in the backups. How long backups are kept Each night's copy of our databases and sign-in records is deleted after 90 days and fully purged within 30 days after that, so it is kept for about four months at most. One copy each month is kept for up to 12 months instead, and fully purged within 30 days after that, so it is kept for about 13 months at most. The backup of stored files keeps each file for as long as it is stored with us; when a file is deleted or replaced, the backup keeps the earlier version for 90 days and then deletes it. Separately, Cloudflare, which runs most of our databases, keeps a recovery history of each of them for 30 days. How backups are used We use backups and that recovery history only to restore data after it has been lost, for example in an outage, through a mistake or in an attack, and we also use backups to test that restoring works. Deleting something, or deleting your account, does not remove it from backups made before the deletion or from the recovery history: those copies stay until they are deleted on the schedules above. If we restore data from a backup or from the recovery history, we re-apply the deletions made after the point we restore to, including account deletions, so that the restore does not bring back data that had been deleted.

Depending on where you live, you have rights over the personal data we hold about you. We honor these rights for everyone who asks, regardless of where you live. • Access — ask what personal data we hold about you and get a copy. • Correction — ask us to fix data that is wrong or incomplete. • Deletion — ask us to delete your personal data by emailing privacy@bravely.dev from the address on your account. Where a product has a built-in Delete Account control you can use that instead; bravely.dev/delete-account explains what applies to each product. • Portability — ask for your data in a portable, machine-readable format. • Objection and restriction — ask us to stop or limit certain processing. • Withdraw consent — where we rely on consent (for example, marketing email), you can withdraw it at any time without affecting processing that already happened. • Non-discrimination — we will not degrade your service or charge you more for exercising any of these rights. EEA and UK residents also have the right to lodge a complaint with your local supervisory authority. California residents may use an authorized agent; we may verify the agent's authority and confirm the request with you first. Other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as they take effect) have equivalent rights, including a right to appeal a denied request — reply to our decision email with "Appeal" and we will respond in writing within the period the law requires. Canadian residents have access, correction, and consent-withdrawal rights under PIPEDA; Australian residents have access and correction rights under the Australian Privacy Principles. To exercise any right, email privacy@bravely.dev. We respond within the timeframe the applicable law requires — generally 30 days under GDPR and 45 days under the CCPA, with an extension where the law permits one. We may need to verify your identity before acting, usually by confirming control of the email address on the account.

If you are in the EEA or UK, we rely on these lawful bases under the GDPR and UK GDPR: • Performance of a contract — creating and securing your account, delivering the features you paid for, syncing your content, processing purchases, and providing support. • Legitimate interests — keeping the service secure and reliable, preventing fraud and abuse, understanding how our products are used through usage events tied to an installation or to your account, and improving the product. We balance these against your rights and do not use them to justify intrusive tracking. Where an app lets you turn its usage analytics off, doing so is one way to object. • Consent — marketing email, and anything else we ask your permission for before we collect it. You can withdraw consent at any time. • Legal obligation — keeping tax, accounting, and consent records, and responding to lawful requests.

Bravely Studios LLC is a US company. We and our sub-processors process data in the United States and in other countries where they operate. For personal data originating in the EEA, UK, or Switzerland, we rely on appropriate transfer safeguards in our processor agreements — such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum — where those safeguards are required. Email privacy@bravely.dev if you want more detail about the safeguards that apply to you.

For California residents, the categories of personal information we collect for this product are: • Identifiers: your Bravely Account identifier, the email address on your account (used to send refresh failure notices), the name of a Mac you register for background publishing, and an installation identifier. • Your content: the workbooks, snapshots and tables you publish to Bellwether Cloud, described in the sections above. • Internet or other electronic network activity: usage events, app and macOS versions, run reports and their error messages, the contents of a diagnostic report, and request details such as your network address. • Coarse geolocation: a country-level signal derived from your network connection, recorded with a diagnostic report and used by your Bravely Account for consent rules. We collect this from you, your device, and our own systems, and we use it to run the product, honor what you have bought, keep the service secure, and support you. We disclose it to the service providers listed under "Sub-processors," each for a business purpose under a written contract. We do not sell your personal information and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA and CPRA, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for any purpose that would trigger the right to limit. If that ever changes we will update this policy and provide the required opt-out before the practice begins. Retention is described under "Data Retention" and "Backups" above and, for account-level data, in the Bravely Account privacy policy.

We use the following service providers to run this product. They receive only what they need to perform their service for us, and each is bound by the data-processing terms that apply to our use of their service. Where a provider is not yet covered by a written data-processing agreement with us, its entry below says so. If you need a data-processing agreement in place before you use this product, email privacy@bravely.dev: • Cloudflare, Inc.: hosting for bravely.dev, for the account and diagnostics services, and for Bellwether Cloud, including the database and file storage that hold what you publish. See cloudflare.com/privacypolicy. • Google LLC: Firebase Authentication, which backs Bravely Account sign-in (including Sign in with Google). See policies.google.com/privacy. • Apple Inc.: Sign in with Apple, when you choose that sign-in method. See apple.com/legal/privacy. • PostHog Inc.: product analytics from the Mac app, which you can turn off in Settings. See posthog.com/privacy. • Resend Inc.: sends our transactional email, which for Bellwether means sign-in codes and password resets for your Bravely Account, and refresh failure notices. See resend.com/legal/privacy-policy. • Amazon Web Services, Inc.: Amazon S3, which stores our backups in the United States, as described under "Backups". The copies of your data that we keep there are encrypted, with a key that only we hold, before they leave our systems, so Amazon cannot read them. See aws.amazon.com/privacy. • jsDelivr (cdn.jsdelivr.net): a public content delivery network that the web viewer loads its charting code and query engine from. It receives the request your browser makes, which includes your IP address and browser details, and nothing about your workbook or its data. It is not covered by a written data-processing agreement with us. See jsdelivr.com/terms/privacy-policy. • The DuckDB project (extensions.duckdb.org): the query engine in the web viewer downloads components it needs from this server. It receives the request your browser makes, which includes your IP address and browser details, and nothing about your workbook or its data. It is not covered by a written data-processing agreement with us. If we add or change a sub-processor in a way that materially changes how your data is processed, we will update this policy and give additional notice where the law or our data-processing commitments require it.

We protect your data with authenticated accounts, encryption in transit, access controls on our backend systems, and a deliberately small number of people who can reach production. No system is perfectly secure, and we do not claim guarantees we have not built and verified. Where a product makes a specific security claim, that claim appears in the app-specific sections above and is limited to what we have actually shipped. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulators as required by law.

We may update this Privacy Policy from time to time. If we make a material change — a new category of data, a new sub-processor, a new purpose, or a new legal basis — we will update the "Last updated" and "Effective" dates and give additional notice where the law requires it. Where a change requires fresh consent under the GDPR, UK GDPR, CASL, or a similar regime, we will ask for it before relying on the new purpose. Non-material changes (typos, clarifications, link fixes) are reflected by updating the "Last updated" date.

Bravely Studios LLC Privacy and data rights: privacy@bravely.dev Product support: support@bravely.dev Website: https://bravely.dev Postal address: available on request to privacy@bravely.dev.