Legal
Privacy policy
bin is a personal capture inbox. This page says what it stores, where that lives, who can reach it, and what happens when you delete your account. It describes what bin does today, and where there is a real limit it states the limit rather than rounding it off.
What bin is
You sign up — in one tap without an email address, or with one — and then you capture things: typed notes, voice recordings, links, mail you forward, pages you clip from your browser. Everything lands in a single inbox. bin is single-user by design: your bin is yours, not a shared workspace, and nobody else has a door into it.
You can also connect your own agents and tools by minting an access token and handing it to them. That is opt-in, one token at a time, and covered in its own section below.
What bin stores
Your account. An account id, when it was created, and
a random address at withbin.com that you can send mail to.
An email address only if you give one — anonymous signup never asks
for it, and you can add one later to turn on sign-in and email capture.
Device identifiers, so a signed-in phone or watch stays signed in.
What you capture. The text of your notes, the URL and page text of your web clips, the subject and body of mail sent to your bin address, and the audio of your voice notes. Voice recordings and other uploaded files are stored as objects in Cloudflare R2. Everything else is rows in a Cloudflare D1 database.
Transcripts. A voice note is transcribed on the server. The audio is passed to Whisper running on Cloudflare Workers AI, inside the same Cloudflare account that holds the rest of bin, and the transcript is written back onto the item. The recording is kept next to the transcript so you can listen back to it.
A search index. The text of your items is turned into embeddings — numeric vectors — and stored in Cloudflare Vectorize, so search can find an item by what it means and not only by the exact words in it. Each vector carries an item id and is deleted with its item.
Access tokens. The tokens you mint for your phone, your agents, a CLI, or the browser extension, along with what kind each one is and what it is allowed to do.
A processing trail. Each item carries a record of what happened to it — captured, transcribed, embedded, viewed, archived — so you can see where something came from and what the system did with it. It exists for the life of your account and is deleted with it.
Where it runs
Your bin runs on Cloudflare: Workers for the API, D1 for accounts, items, and the app's short-lived sign-in codes, R2 for recordings and attachments, Queues for background processing, Workers AI for transcription, Vectorize for search, and KV for the other short-lived codes described below. Mail sent to your bin address arrives through Cloudflare Email Routing.
One thing does leave Cloudflare. The mail bin sends you — a verification code, a sign-in code — goes out through Resend, an email delivery provider. Resend receives the address the message is going to and the message itself, and it handles nothing else: it never sees your items, your recordings, or your transcripts. The contact form on this site is also checked by Cloudflare Turnstile, which is what keeps it from being a spam relay.
There is no analytics SDK in bin, no advertising SDK, no tracking pixels, and no third-party trackers. bin does not sell your data, does not share it with data brokers, and does not use what you capture to train any model. Transcription and search call Cloudflare's hosted models and take back the result.
Short-lived operational data
Email-verification codes and the browser sign-in codes live in a Cloudflare KV store, separate from your items; both are written with an expiry of ten minutes or less and disappear on their own when they lapse. The app's email sign-in codes live in the database instead — and never as the code itself, only a keyed digest of it alongside the address it was sent to. They expire after ten minutes, and expired entries are cleared the next time anyone starts a sign-in. Alongside them sit request counters, which hold a number and nothing you wrote. Most are per-minute and expire within a couple of minutes. Two are daily: how many accounts have been created from one network address today, and how many across the whole service. The per-address one is keyed to that address rather than to an account, and it lives for about a day before expiring on its own.
Daily usage counters — how many items you captured today, how many recordings you uploaded, how many bytes they came to — are rows in the same database as your items, so they are deleted along with your account rather than left to expire. They are counts, not content.
Agents and tools you connect
bin is built to be read by software you run. When you mint a token and give it to an agent, a CLI, or the browser extension, that thing can read and write your bin within the scope of that token until you revoke it. You decide what gets connected; nothing is connected by default.
That has a consequence worth stating plainly. If an agent you authorized copied an item out of bin into somewhere else — a task manager, a notes app, its own memory — that copy now lives in that system. bin deletes what bin holds. It cannot reach into a system you sent your data to, so anything already copied out is that system's to manage, and yours to clean up where it lives.
Deleting your account
You can delete your account from inside the app. It is a real delete rather than a deactivation, and it cannot be undone.
The account closes the moment you confirm: every access token is revoked and your inbox address stops routing, so nothing can be read from your bin or added to it from that instant. Erasing the contents then runs in the background and normally finishes within minutes. It does not depend on your staying online or on the app staying open — if any part of it is interrupted, a job that runs every fifteen minutes picks it up and finishes it.
When you delete:
- your account record, your email addresses, and every access token are removed — every phone, agent, CLI, and extension you connected stops working at once
- your inbox address is released, and mail sent to it stops becoming items
- your items, their attachments, and their processing trail are removed from the database
- your voice recordings and other uploaded files are removed from R2
- your search vectors are removed from Vectorize
- your daily usage counters are removed with the rest of your rows
Recordings upload over signed links that stay valid for up to an hour, so one can still be in flight at the moment you delete. About an hour after the erase, a follow-up sweep removes the recordings that were still on their way, which is what covers that window.
One residual, stated rather than hidden: inbox addresses are random strings, and in the unlikely event a retired one is ever reassigned, mail sent to it would reach whoever holds it then. Turn off any forwarding rule pointed at your bin address when you delete the account.
Children
bin is not directed at children, and it is not designed or marketed for anyone under 13.
Changes to this policy
The date at the top is when this version took effect. If what bin does with your data changes, this page changes with it and the date moves.
Contact
Questions about any of this, or about your own data, go through the contact form. bin is published by Plynth LLC.