1line Privacy Policy
The short version
- Your Brain is yours. Your messages, your Library, your files. We do not sell personal data, we do not run ads, and we do not use your content to train AI models.
- An agent can only ever reach its own owner's data. That wall is built into the data path, not bolted on as a setting.
- If you connect Gmail, we ask for the smallest access that works, we encrypt the connection token, and you can cut it off in one tap. Revoking works on the very next call.
- You can export everything and leave. A Brain is owned, not rented.
- Questions go to a human: dalton@galaxyco.ai.
Who we are
1line is a product of Galaxy Co LLC, a Texas limited liability company ("1line", "we", "us"). This policy covers the 1line app at 1line.galaxyco.ai, the pages at brain.galaxyco.ai, and the services they run on. When this policy says "you", it means the account holder and, where the context fits, the people and agents they invite into a Brain.
What we collect, and why
We collect the minimum that makes the product work. The table is the whole list; if it is not here, we do not collect it.
| What | Why we have it | How long we keep it |
|---|---|---|
| Account details: name, email address, account settings | To run your account, sign you in, and bill the right person | While your account is active |
| Brain content: messages, Library items, files, agent profiles and rules you create | It is the product. Your agent works from it, and it is shown to the members of that Brain | Until you delete it, or 30 days after account closure |
| Sign-in and session data: session cookies, sign-in events | To keep you signed in and to detect account misuse | Session cookies clear on sign-out; sign-in events 12 months |
| Agent connection tokens (for example a Gmail connection) | So your agent can act for you without holding your password | Encrypted at rest, until you revoke the connection or close your account |
| Billing records: plan, invoices, payment status | To run subscriptions and meet tax and accounting law | 7 years, as the law expects; card numbers are held by Stripe, never by us |
| Support messages you send us | To answer you and fix what you reported | 24 months |
Connected accounts: Gmail and Google Calendar
Connecting Google is always your choice, per account, and you can undo it from your account page at any time.
- Scopes. We request read access, draft creation, and sending for Gmail, and read plus event drafting for Calendar. Sending mail and creating calendar events never happen silently: a send your agent proposes waits for your approval in your Brain, and denial kills it.
- The wall. A connection belongs to one participant. An agent token can only ever resolve to its own owner's mailbox. There is no setting, parameter, or support request that widens it, and attempts to cross it are refused and logged.
- Limited Use. 1line's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: Google data is used only to provide and improve the features you asked for, it is never sold, never used for advertising, and no human at Galaxy Co reads your mail or calendar as part of normal operations.
- Token storage. Refresh tokens are encrypted at rest with a dedicated escrow key, never logged, never shown in the product, and never included in exports of your content.
- Revocation. Revoking in 1line, or in your Google account, blocks agent access on the next call. Your own Gmail is untouched.
Who sees your data
- Members of a Brain see that Brain's content, because that is what a Brain is. Content in one Brain is never visible in another.
- Service providers who run parts of the infrastructure, under contract, only for the job they do: Clerk (accounts and sign-in), Vercel (hosting), Neon (database), Stripe (payments), and Google (only when you connect a Google account). That is the complete list as of this version.
- The law. We disclose data when a valid legal order requires it. Where the law allows, we tell you first.
- A sale of the company. If Galaxy Co is ever sold or merged, data moves with the business. If that happens, we announce it here and by email before the transfer, and this policy's promises travel with the data.
Nobody else. No data brokers, no advertisers, no affiliates buying access.
Security
- All traffic is encrypted in transit (TLS). Connection tokens and Vault entries are encrypted at rest.
- Access inside Galaxy Co is limited to what a task requires, and agent access is fenced per owner by design (see the wall above).
- No system is perfect. If we learn of a breach that affects your data, we will notify you and the relevant authorities within the time the law requires, and say plainly what happened.
Your rights
Wherever you live, we honor these for every account:
- See it. Your content is visible in the product, and your agent can fetch an export of your Brain on your instruction.
- Take it. Export your Library in open formats, any time, without asking permission.
- Fix it. Edit or ask us to correct anything inaccurate.
- Delete it. Delete content in the product, revoke connections, or close your account. Closing your account starts a 30 day window: export anything you want during it, and at the end of the window your Brains and content are deleted, except billing records the law requires us to keep.
- Object or limit. Write to us and a human will work it out with you.
Exercising a right never changes your price and never degrades your service.
Children
1line is a work tool. It is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has an account, write to us and we will remove it.
Changes to this policy
This page is versioned. Material changes are announced in the product and by email at least 14 days before they take effect, and the changelog below records every version. Continuing to use 1line after a change takes effect means you accept the new version; if you do not, export and close before the date, and the old version governs until then.
Contact
Privacy questions, requests, or complaints: dalton@galaxyco.ai. We answer within 5 business days, usually faster. If we ever get it wrong, you also have the right to complain to your local data protection authority, and we would rather hear it from you first.
Changelog
- 1.0 (October 16, 2026): First published version, including the Google connected-accounts section ahead of the email connect launch.