BeforeMe Privacy Policy
Last updated: 2026-09-27 · Applies to beforeme.ai and all owner pages (default address: beforeme.ai/u/name; business customers may use name.beforeme.ai)
At a glance
Our promises, up front:
- We keep only the minimum information needed for this communication. BeforeMe never reads anyone’s email, chats, calendars, contacts or files.
- Nobody can see content the owner has not approved. Answers come only from items the owner personally published and approved. Hard-coded rules decide who can see what; AI does not decide.
- No selling data, no advertising, no third-party tracking. We do not use your data to train our own models. However, your question is sent to an AI provider to generate an answer, and that provider processes it under its own terms—so please do not put any private information in your question.
- We keep as little as possible and delete it automatically when its time is up. Question records are automatically deleted after 90 days. Visitor identifiers and IP addresses are stored only as salted hashes, never in their original form. This is called “pseudonymisation”: it is difficult to identify you from them, but legally they are still personal data, and we protect them as such.
- You have the same rights wherever you live: access, correction, deletion, export, objection and withdrawal of consent. Just email us. We respond as soon as possible, within 30 days at the latest; for requests subject to Brazil’s LGPD, within 15 days.
- Has someone published content about you? Even if you have never used BeforeMe, you can ask us to remove it. See section 9.
| Who you are | What we keep | How long |
|---|---|---|
| Visitor (someone asking questions on an owner’s page) | Your questions, answers and the items supporting them; hashes of your visitor identifier and IP address; contact details you choose to leave | 90 days (requests passed on to the owner: deleted 90 days after being handled; automatically deleted if not handled within 180 days) |
| Contact (someone the owner sent a personal link to) | The name the owner uses for you, the projects you belong to and records of link use | Links expire after 30 days; the owner can revoke them at any time; records are kept for 90 days |
| Owner (someone with a BeforeMe page) | Your name, Google sign-in email, published content and private notes, contacts you add and activity records | For the life of the account; deleted within 30 days after you email to close it |
1. Who processes your data
- Operator: Feng Bo, operating as an individual (“we”). BeforeMe is currently a small private pilot.
- Contact: fengbomail@gmail.com (for privacy, data and deletion requests)
- Two distinct roles:
- We are responsible for data used to operate the platform (legally, the “controller”): visitor question records, abuse prevention and security logs, and owner accounts.
- The owner is responsible for content they put into BeforeMe: published items, private notes and contacts they add. We store and process it only on the owner’s instructions (legally, as a “processor”). Our respective rights and duties are set out in the Owner Data Processing Terms.
- The owner of the page where you ask a question can see that question.
2. What we collect and why
2.1 Visitors
| Data | Purpose | Legal basis (under the European GDPR; for mainland China and elsewhere, see the explanation below and section 10) |
|---|---|---|
| The question you type and the system’s answer | Answering you; allowing the owner to check that the answer is correct | Legitimate interests (responding to a question you initiated) |
| Which published item supports the answer | Traceability and correction | Legitimate interests (ensuring accurate answers) |
| Visitor identifier (randomly generated, stored in a first-party cookie that expires after at most 90 days; only its salted hash is stored on the server) | Rate limiting; seeing the owner’s replies when you come back on this device | Legitimate interests (abuse prevention) / necessary to provide the service |
| IP address (only a salted hash is stored) | Rate limiting and abuse prevention | Legitimate interests (security) |
| Contact details and additional information you voluntarily leave | Allowing the owner to contact you when the matter needs their personal attention | Your consent (withdrawable at any time) |
| Your optional answer to “Would you otherwise have messaged them?” and a few anonymous events (page opened, question asked, how it was resolved) | Understanding whether BeforeMe actually saves someone a message | Legitimate interests (improving the product); these events contain no question text, IP address or cookie, only a random identifier generated for that single page load |
| What you enter in the “Get your own” form | Responding to your request to join | Your consent / steps taken at your request |
Mainland China’s Personal Information Protection Law does not provide a “legitimate interests” basis. For visitors in mainland China: abuse prevention and security logs are processed to comply with statutory cybersecurity obligations (PIPL, Article 13(3)); all other processing is based on your consent. The note below the ask box tells you who processes your question and where it is stored, so you can read it before asking.
2.2 Contacts
When the owner sends you a personal link, we keep the name they use for you, the projects you are authorised to see, the link’s expiry date and records of each use (to prevent misuse of the link). When you open it, your browser stores a cookie valid for 30 days, used only to recognise you on that owner’s page.
Please do not forward your personal link. Anyone who has it is treated as you. Tell the owner if it is leaked; they can revoke it immediately.
2.3 Owners
- Account: your name, page address and Google sign-in email. Google sign-in only asks Google to confirm which email address is signing in. We immediately revoke Google’s authorisation after receiving the answer and read nothing else in your Google account.
- Your published content: only items you approve are used to answer others. Your private notes are never shown directly to anyone.
- Contacts you add: names, groups and personal links. You must ensure you have the right to record these people’s information.
- Tools you authorise: if you issue an API key to your AI assistant or shortcut, its submissions go through approval first, just like your own, and are only used in answers after approval.
- Activity records: sign-ins, publishing, withdrawals, approvals and similar actions, for security auditing.
3. What we never do
- Never read anyone’s email, chats, calendars, contacts, photos or files.
- Never sell or rent personal data, run advertising, or place third-party tracking cookies or pixels.
- Never let AI decide who can see what.
- Never use content the owner has not approved to answer questions.
- Never use your data to train our own models.
- Never require visitors to register or sign in.
4. What AI does
- Code decides who can see what before AI is involved. AI sees only your question and published items you are authorised to see.
- Sentences in the owner’s private notes involving account passwords, banking information, identity document numbers, home addresses or security arrangements are removed before being sent to AI.
- Your own question is sent to the AI provider exactly as you type it. Please do not include the sensitive information listed above.
- AI generates answers from the owner’s published content. Answers may be incomplete or outdated; each identifies its sources and when they were updated. An answer is not a commitment by the owner.
- We do not make any solely automated decisions that have legal or similarly significant effects on you.
5. Who receives data
We share data only with providers needed to deliver the service, and only the minimum necessary. Below the ask box on every owner’s page, we identify the provider generating that page’s answers and where the servers are located. A page without AI answers by rules only.
| Provider | Role | Data received | Location |
|---|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL) | Website and database hosting | All stored data described in this policy (encrypted in transit and at rest) | USA |
| DeepSeek (Hangzhou DeepSeek)—the default AI provider | Generating answers and organising updates published by owners | Your question + published items you are authorised to see (with sensitive sentences removed); update text submitted by the owner | China |
| Other AI providers selected by the owner (if any) | Generating answers on that owner’s page | Same as above | As stated on the page |
| Google sign-in | Verifying the owner’s identity | The owner’s email address | USA |
Otherwise, we disclose data only when required by law, to protect someone’s physical safety, or if the operator transfers BeforeMe to another person or company (we will notify you in advance).
6. International transfers
Our servers are in the USA; the default AI provider is in China, and some owner pages may use providers in other countries (identified on the page). Wherever you are, your data may be transferred to these countries for processing. Our safeguards: transferring only the minimum data, removing sensitive sentences before sending content to AI, and encryption throughout. Google Cloud’s data processing terms include EU Standard Contractual Clauses. DeepSeek currently does not provide such clauses, so we send it only the minimum content necessary to answer (your question and published items you are authorised to see, with sensitive sentences removed first), and no information that directly identifies you (visitor identifiers, IP addresses and contact details are never sent to it).
7. How long we keep data
| Data | Retention period |
|---|---|
| Question and answer records, audit records and anonymous analytics events | Automatically deleted after 90 days |
| Handled requests passed on to the owner (including contact details you leave) | Automatically deleted 90 days after being handled |
| Unhandled requests passed on to the owner (including contact details you leave) | At most 180 days, then automatically deleted |
| Permission check records (to detect malicious probing) | 30 days |
| Contacts’ personal links | Expire after 30 days by default; revocable at any time |
| Owner accounts and published content | For the life of the account; deleted within 30 days after you email to close it, unless retention is legally required |
| Current conversation (stored in your browser tab) | Cleared when you close the tab |
8. Cookies
We use only first-party cookies necessary to provide the service, with no advertising or third-party analytics cookies, so there is no “accept cookies” banner. The visitor identifier lasts at most 90 days, the same as the question records: it lets you see the owner’s reply to your question when you come back on this device, and it never lasts longer than those records.
| Name | Purpose | Lifetime |
|---|---|---|
bm_vid | Random visitor identifier: rate limiting and seeing replies when you come back on this device | 90 days |
bm_lang | Remembering your chosen language. Written only when a language is specified in the URL (for example, by switching languages or opening a link with a language); a language detected from the browser is not saved | 1 year |
bm_ak_<owner handle> (personal link, one per owner) | Recognising a contact on that owner’s page | 30 days |
bm_owner | Owner console sign-in state | 7 days |
bm_oauth | Preventing forged Google sign-ins; deleted when sign-in completes | At most 10 minutes |
9. Your rights
Wherever you live, you can:
- Access the data we hold about you and find out who received it;
- Correct inaccurate data;
- Delete your data;
- Export your data (in a machine-readable format);
- Object to or restrict processing based on legitimate interests;
- Withdraw consent at any time (without affecting processing before withdrawal);
- Complain to your local data protection authority.
How: email fengbomail@gmail.com. We respond as soon as possible, within 30 days at the latest; for requests subject to Brazil’s LGPD, within 15 days (all periods are calendar days). Visitors are anonymous by default, so please tell us approximately when, on whose page, and what you asked so we can locate the record. We may ask for additional information to prevent impersonation. You can also ask directly on the homepage, for example “Please delete my data”, and it will be passed on to the operator.
If an owner has published content about you: even if you have never used BeforeMe, you can email us identifying the page and the content. We will notify the owner and, after verification, take the content offline first, then handle any further steps.
10. Regional information
- European Economic Area, United Kingdom and Switzerland (GDPR / UK GDPR): section 2 lists the legal basis for each processing activity. You may complain to your country’s data protection authority. Our processing of European users’ data is occasional, small-scale and does not involve special categories of data, so we currently do not designate an EU representative under GDPR Article 27(2). Please email requests directly to us.
- Brazil (LGPD, Law No. 13.709/2018): you have all rights under LGPD Article 18. Data Protection Officer (Encarregado): Feng Bo, fengbomail@gmail.com. You may complain to the ANPD.
- USA: we do not sell any personal information, conduct targeted behavioural advertising or use your personal information for any purpose beyond providing this service. You will not be treated differently for exercising your rights.
- Mainland China (PIPL): your question is transferred outside China (to the USA) for storage; this is stated below the ask box. We have no establishment in mainland China and have not appointed a representative there. Users in mainland China should email requests directly to us.
- Other countries and regions: this policy provides equal protection to everyone; where local law gives you additional rights, local law prevails.
11. Children
BeforeMe is not intended for anyone under 16. This threshold is stricter than the statutory thresholds in the USA (13) and mainland China (14); where local law requires a higher age, that law applies. Owners must be at least 18. When leaving contact details or requesting to join, you are asked to confirm that you are 16 or older. If a parent or guardian discovers that a child has provided personal information to us, please email us; we will delete it after verification.
12. Security
HTTPS encryption in transit; encrypted database storage; visitor identifiers and IP addresses stored only as salted hashes (pseudonymisation); permissions decided by deterministic code; every access and change audited, with records available to the owner at any time. No system is absolutely secure. If a data breach occurs that may affect you, we will notify you and regulators as required by applicable law.
13. Changes to this policy
We will announce material changes on the website in advance and notify owners separately. Email us for previous versions.
14. Contact us
Feng Bo (individual) · fengbomail@gmail.com