Privacy Policy

Information we collect

Directly from you

• Account information: name and email address (via Clerk, our authentication provider).
• Team information: team name, membership, roles, and invitations you send.
• Billing information: Stripe collects and stores your payment details directly — we receive only your Stripe customer ID, subscription status, plan, and billing period. We never see or store your card number.
• Anything you send us directly, such as a support request.

From providers you connect

• Google: when you sign in with Google or connect a Firebase/Google Cloud project, we receive an OAuth token for the access you grant, and basic profile info (name, email). Connecting a project lets Firebrande read and act on that project's Firebase and Google Cloud services on your behalf — only for the operations you start or schedule. See "Google user data" below.
• GitHub: if you connect a repository for Functions or SQL Connect deployment, we receive an OAuth token scoped to the repository access you grant.

Automatically, as you use the product

We keep operational records tied to your account and team — audit events, deployment and job history, and similar metadata — so actions in the product are attributable and recoverable. These records are scoped to your team and are not shared across tenants.

How we use information

• Operate and maintain the product, including authenticating you and enforcing that your team only ever sees its own projects and data.
• Process subscriptions, trials, and billing through Stripe.
• Send transactional email — invitations, account notices, billing receipts — through Postmark.
• Provide optional AI features (see "AI features" below), only when you use them.
• Respond to support requests and investigate reported problems.
• Maintain security, detect abuse, and keep an audit trail for accountability.

We do not sell your personal information, and we do not use your Firebase/Google Cloud project content to train any model or for advertising.

Google user data

When you sign in with Google, Firebrande asks for your name, email address, and access to the Google Cloud projects your Google account can manage (the cloud-platform permission). Firebrande can only do what your own Google account is allowed to do in a project; to limit it further, connect with an account that has only the Google Cloud roles you want Firebrande to use.

• How we use it: only to provide the features you use — browsing and editing Firestore, Storage and Authentication, deploying Functions, Hosting, Rules and SQL Connect, running Scriptlets, Pipes and transfers you start or schedule, and showing usage and costs.
• What we store: your encrypted Google tokens, the operational records described above, and, for single-document Firestore changes made through Firebrande, encrypted copies of the document before and after the change (see "Data retention").
• Who we share it with: no one, except the providers listed below as needed to run the features you use, or where required by law. We don't sell it or use it for advertising.
• People: no one at Firebrande reads your project data unless you ask us to (for example in a support request), it's needed for security or abuse investigations, or the law requires it.
• AI: we don't use Google user data to train AI models. Optional AI features send only the context needed for your request (see "AI features").

Firebrande's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Firebrande's access to your Google account at any time from your Google Account permissions.

What we don't do

• We don't browse your connected project's data outside of the specific action you request — Firebrande reads and writes only what a given operation (a query, an edit, a deployment) requires.
• We don't keep a replica of your Firestore data, Storage objects, or Authentication users — your Firebase/Google Cloud project remains the source of truth. Data you query, transfer, or process passes through our servers to carry out the operation and isn't kept afterwards. The exceptions are the encrypted Firestore document copies kept for document history, and short previews of Scriptlet results kept with their run history.
• Stored provider access and refresh tokens are encrypted, used only by our servers, and never included in logs, exports, or support tickets. Your signed-in session also keeps your Google tokens in secure, HTTP-only cookies, which the page's scripts can't read.

Who we share information with

We use the following providers to operate Firebrande. Each processes information under its own terms and security practices:

• Clerk — authentication and session management.
• Google / Firebase / Google Cloud — the projects you connect and authorize.
• GitHub — repository connections you authorize for deployment.
• Stripe — payment processing and subscription billing.
• Postmark — transactional email delivery.
• Vercel — application hosting.
• Our database provider — stores account, team, and operational metadata.
• Google Gemini — powers optional AI features, only when you use them.

We don't sell or rent your information to third parties for their own marketing purposes.

AI features

Features like Gemini Intelligence and Change Intelligence send relevant, minimized context from the project you're actively working in to our AI provider to generate a response — not your entire connected project. These features are optional and scoped to your current project; you can choose not to use them.

Data retention

• Account data is kept for as long as your account is active. Team data is kept for as long as the team exists, except when its subscription ends, as described next.
• If a team's subscription ends, its Firebrande data — connected projects, audit history, saved queries, scripts and settings — is kept for 90 days and then deleted. We email the team's owners and admins when the subscription ends and again 7 days before deletion. Subscribing again within those 90 days keeps everything. User accounts are not deleted, as people can belong to other teams.
• Document history: when you change a single Firestore document through Firebrande, an encrypted copy of it before and after the change is kept for 30 days so the change can be reviewed and undone, then deleted. The record of the change stays in the audit log. Team owners and admins can turn document history off for each project.
• AI conversation history defaults to 30 days and can be configured per project between 0 and 365 days.
• Billing records are kept as required for accounting and legal purposes.
• Stored Google credentials for a project are deleted when the project is disconnected, when you're removed from its team, and as soon as the team's subscription ends. To also revoke Firebrande's access at Google, use your Google Account permissions.

Disconnecting a project, deleting your Firebrande account (on request, through the contact details below), or the deletion of a cancelled team's data removes our connection and operational metadata — it does not delete or modify anything in your actual Firebase or Google Cloud project. That data remains under your control and is managed directly through Google.

Your rights and choices

Depending on where you live, you may have the right to access, correct, export, delete, or restrict processing of your personal information. To make a request, contact us using the details below — we'll verify your identity before acting on it. Requests that touch your connected Firebase/Google Cloud project data may require you to also act directly through Google, since apart from the document history described above, that data is not stored by us.

Security

• Stored provider credentials and document history copies are encrypted, and only our servers can decrypt them.
• Every request is checked against your team's actual membership and role before it can touch a project, bucket, or resource — a project ID alone is never treated as proof of access.
• We never store your card details — Stripe handles payment collection directly.

No method of transmission or storage is perfectly secure. If we become aware of an incident affecting your information, we will investigate, contain it, and notify affected users as required by law.

International data

Firebrande and the providers we rely on may process and store information in the United States and other countries where our providers operate. Where required, we rely on appropriate safeguards for any international transfer of personal information.

Children's privacy

Firebrande is a professional tool for developers and teams and is not directed at, or knowingly used to collect information from, children under 16.

Changes to this notice

We may update this notice as the product changes. We'll update the date at the top of this page, and for material changes we'll take reasonable steps to let you know, such as an email or an in-product notice.