BrainTrust — Privacy Policy

This Privacy Policy describes how BrainTrust ("BrainTrust," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the BrainTrust mobile application (the "App") and any related services (collectively, the "Services"). BrainTrust is operated by Lukas Mekler-Culbertson and David Rastall, individuals based in Baltimore, Maryland, United States. By downloading, accessing, or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Services.

1. Information We Collect

1.1 Information You Provide to Us

• Account information. When you sign in with Apple, we receive the unique user identifier that Apple assigns to your account and, if you choose to share it, your name and email address (which may be an Apple private relay address). If you choose to continue without an account, we create an anonymous account associated with your device that contains no name or email address.
• Communications with the AI coach. The messages you send to the in-app AI coach and the responses generated for you, which are retained so that your conversation can continue across sessions.
• Correspondence. If you contact us by email, we collect the information you provide in that correspondence.

1.2 Information Collected Automatically

• Activity data. Your activity within the App, including the games you play and the scores you achieve, the exercises you complete or skip, whether you exercised before playing, your streak, the content you have unlocked, and the preferences you select (for example, your chosen coach and whether reminders are enabled).
• Usage data. Information about how you interact with the App, including when the App is opened, the time the App is in the foreground, the screens you view, and the actions you take (for example, starting a game, skipping an exercise, or responding to a reminder prompt).
• Device and technical data. Your device's operating system and version, time zone, language and locale settings, and, where crash reporting is enabled, diagnostic information such as the device model, App version, and error reports.

1.3 Camera

The optional "head scan" step during setup displays a live camera preview on your device. No photograph, video, depth data, or biometric information is captured, stored, or transmitted during this step. You may skip this step, and you may revoke camera permission at any time in your device settings.

1.4 Information We Do Not Collect

We do not collect your precise geolocation, your contacts, your photos or media library, or advertising identifiers. We do not access Apple HealthKit or any other health-record platform. Scores and metrics displayed in the App describe your performance in the App's games and activities only and are not health information.

2. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Services, including saving your progress and syncing it across devices and reinstalls;
• Generate responses from the AI coach and personalize the content presented to you;
• Understand how the Services are used, measure engagement and retention, and improve the design, features, and performance of the App;
• Detect, prevent, and address technical issues, abuse, and security incidents;
• Respond to your inquiries and provide support;
• Comply with applicable law, regulation, legal process, or governmental request; and
• Enforce our terms and protect our rights, property, and safety and those of our users and others.

We do not use your information to serve you targeted advertising, and we do not sell your personal information.

3. Legal Bases for Processing (EEA, UK, and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases: (a) performance of a contract, to provide the Services you request; (b) our legitimate interests, including improving and securing the Services, provided those interests are not overridden by your rights; (c) your consent, where required, such as for optional device permissions (camera, notifications), which you may withdraw at any time; and (d) compliance with legal obligations.

4. The AI Coach

When you send a message to the AI coach, your message, the recent conversation history, and a short summary of your activity data in the App are transmitted to Anthropic, PBC, the provider of the Claude AI model, in order to generate a response. Transmission occurs through our servers, and only the information required to generate the response is sent. Anthropic processes this information as our service provider under its applicable terms. The AI coach is an automated system and is not a physician, therapist, or other healthcare professional. Nothing the coach says constitutes medical, psychological, or other professional advice, and you should not rely on it as such. Please do not share sensitive personal information (such as health conditions, financial information, or government identifiers) in your messages to the coach.

5. How We Share Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We may share information in the following circumstances:

• Service providers. We share information with third-party vendors that perform services on our behalf, including: Supabase, Inc. (database hosting, authentication, and server functions); Anthropic, PBC (AI model provider for the coach); Apple Inc. (Sign in with Apple, App Store distribution, and push notifications); Sentry (crash and error reporting, where enabled); and Netlify, Inc. (hosting of this policy). These providers are permitted to use your information only to perform services for us and are obligated to protect it.
• Legal requirements. We may disclose information if required to do so by law or in the good-faith belief that such action is necessary to comply with a legal obligation, protect and defend our rights or property, prevent fraud, act in urgent circumstances to protect the personal safety of users or the public, or protect against legal liability.
• Business transfers. If BrainTrust is transferred to a corporate entity, or in connection with any merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction, subject to this Privacy Policy.
• With your consent. We may share information for any other purpose with your consent.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Services. When you delete your account, your account and the information associated with it are deleted from our servers and from your device. Anonymous accounts that have not been used for an extended period may be deleted. We may retain certain information for longer where required by law, to resolve disputes, to enforce our agreements, or in de-identified or aggregated form that does not identify you.

7. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect your information, including encryption in transit, access controls that restrict each user to their own data, and server-side handling of credentials for third-party services. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights and Choices

• Access, correction, and deletion. You may delete your account and all associated data at any time in the App by opening Settings and selecting Delete account. This action is permanent and cannot be undone. You may also contact us at the address below to request access to, correction of, a copy of, or deletion of your personal information.
• Notifications. You may enable or disable reminder notifications in the App or in your device's notification settings.
• Camera. You may deny or revoke camera permission in your device settings; the App will continue to function without it.
• Do Not Track. Because we do not track users across third-party websites or services, we do not respond to "Do Not Track" signals.

8.1 Residents of the European Economic Area, United Kingdom, and Switzerland

Subject to applicable law, you have the right to request access to, rectification of, or erasure of your personal data; to restrict or object to its processing; to data portability; and to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You also have the right to lodge a complaint with your local data protection supervisory authority. To exercise these rights, contact us at the address below.

8.2 California Residents

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), provides you with specific rights regarding your personal information, including the right to know what personal information we collect, use, and disclose; the right to request deletion of your personal information; the right to correct inaccurate personal information; and the right not to be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA. In the preceding twelve months we have collected the categories of personal information described in Section 1 and disclosed them to the service providers described in Section 5 for the business purposes described in Section 2. To exercise your rights, contact us at the address below. You may designate an authorized agent to make a request on your behalf; we may require verification of your identity and of the agent's authority.

8.3 Other United States Residents

Residents of other states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, and Oregon) may have similar rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising, sales, and certain profiling. We do not engage in targeted advertising, sales, or such profiling. To exercise your rights, contact us at the address below. If we decline to act on your request, you may appeal by replying to our response.

9. International Data Transfers

We are based in the United States, and the information we collect is stored and processed in the United States, where data protection laws may differ from those in your jurisdiction. If you access the Services from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States. Where required by applicable law, we rely on appropriate safeguards for such transfers, such as standard contractual clauses.

10. Children's Privacy

The Services are not directed to children under the age of 13 (or under 16 in the European Economic Area and United Kingdom), and we do not knowingly collect personal information from children. If you believe that a child has provided us with personal information, please contact us at the address below and we will take steps to delete it.

11. Third-Party Services

The Services rely on third-party platforms and services, including Apple's App Store and Sign in with Apple. Your use of those platforms is governed by their respective terms and privacy policies, which we encourage you to review. We are not responsible for the privacy practices of third parties.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the effective date at the top of this page and, where appropriate, by providing notice within the App. Your continued use of the Services after the effective date of the revised Privacy Policy constitutes your acceptance of the changes.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: braintrustappprivacy@gmail.com.