Privacy
No account. No cookies. No advertising trackers. What you paste is read once, analysed, and not kept — the only things stored are a one-way hash that counts your free uses, and your email address if you chose to leave one.
When you paste a link or a block of text, it goes to a server function running on Vercel. That function fetches the page (for a link), then sends the article text, together with the analyst prompt, to Google's Gemini API, which returns the brief.
Debrief does not save the link, the article text, or the brief to its own database. The finished brief is held in your browser's session storage so the result page can display it, and it disappears when you close the tab.
Google processes the text it receives under its own API terms. Treat anything you paste as something a third-party service will read — don't paste confidential or personal material.
Debrief gives everyone a small number of free debriefs. Enforcing that in the browser alone would be meaningless, so the count is kept on the server.
Your IP address is combined with a secret value and run through a one-way cryptographic hash. The stored key is that hash — never the address. It cannot be read back into an IP, and it is not linked to your name, your email, or anything you pasted.
The counter is deleted automatically after 30 days of inactivity. The same counter is what stops an automated script from burning through the free quota before real readers can use it, which is the legitimate interest it rests on.
Some parts of the site invite you to leave an email address. That is always optional, and Debrief works without it.
If you give one, it is stored in a hosted database (Upstash) and a notification is sent to Debrief's own inbox through an email service (Resend). It is used to write to you about Debrief itself. It is never sold, rented, or passed to advertisers.
The basis for holding it is your consent, and you can withdraw that at any time by emailing the address at the bottom of this page. It will be deleted, not merely unsubscribed.
Debrief measures two things: how many people arrive, and how many of them actually paste something. That is the only number that says whether the tool is useful.
Arrivals are counted with Vercel Web Analytics. It is cookieless, it is served from this same domain rather than a third-party server, and it records page-level aggregates — not a profile that follows you elsewhere.
What happens after the paste box is counted by Debrief's own tally: how many debriefs were run on a given day, and roughly how many distinct visitors ran them, identified by the same hashed key described above. These are counts, not people.
Debrief sets no cookies. There is no consent banner because there is nothing to consent to.
The site does use your browser's own local and session storage for two strictly necessary jobs: remembering how many free debriefs you have left, and carrying a finished brief from the loading screen to the result page. Both stay on your device, are never sent anywhere as an identifier, and you can clear them at any time through your browser's site-data settings.
The typefaces are served from this domain too, so reading the site makes no request to a font provider.
Debrief is one person working alone, not a company with departments. These services do the actual processing:
Some of these operate outside the European Economic Area and transfer data under standard contractual clauses. Nobody else receives your data, and none of it is sold.
Under the GDPR you can ask for a copy of any personal data held about you, ask for it to be corrected or deleted, object to it being processed, or withdraw consent you previously gave.
In practice, the only thing tied to an identifiable person here is an email address you chose to leave — so in most cases the request is a single line and the answer is quick. Write to hello@debrief.digital.
Debrief is run by an individual rather than a company, and the address above reaches them directly. If you need the name of the person legally responsible for this data, ask and you will be told.
If you think your data has been handled badly, you can complain to your national data protection authority. In Poland that is the President of the Personal Data Protection Office (UODO).
Debrief is an experiment and it changes often. When something changes that affects what is collected, this page is updated in the same breath and the effective date at the top moves.
Questions about any of this go to the same address: hello@debrief.digital.