App Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) for data processing in the "BrainEase" app is SD Nightshift Studio. You can find the controller's full contact details in our Legal Notice.

BrainEase is developed according to the "privacy by design" principle. Your journal entries and sorted thoughts are, by default, strongly encrypted (database encryption) and stored exclusively locally on your device. The corresponding key is stored in your device's secure system storage (Keychain / Keystore).

We have no access to your stored history data. If you want to create a backup, you can manually export your data as an additionally password-encrypted file and store it in a location of your choice. There is no automatic cloud synchronization via our servers.

Legal basis: Local processing is carried out to provide the core function of the app that you requested (Art. 6(1)(b) GDPR).

To structure your recorded thoughts, the app uses artificial intelligence. For this purpose, the text you enter is sent via a secure, encrypted connection to our server infrastructure (hosted on Google Firebase in Frankfurt am Main, Germany / EU) and forwarded from there via an application programming interface (API) to OpenAI.

• No storage: Your texts are processed on our servers only in memory, for a fraction of a second, and are deleted immediately afterward. No logs of your content are created.
• No AI training: OpenAI strictly does not use data sent via the API to train or improve its AI models.
• Voluntary: The AI analysis is only triggered when you actively submit text for sorting. Without your input, no content leaves your device.

Forwarding to OpenAI involves a transfer to the USA. See Section 9 (Data transfer to third countries) for details.

Legal basis: Performance of a contract / provision of the premium feature you requested (Art. 6(1)(b) GDPR).

BrainEase does not require registration, and we do not create personal user accounts for you. You remain completely anonymous while using the app.

To protect our interfaces from abuse, an invisible, anonymous technical session (via Firebase Auth) is generated in the background when the app starts. We additionally use Firebase App Check to ensure that requests to our servers actually originate from the unmodified app. No contact details such as name or email address are collected or linked to you in the process.

During setup, the app asks you for a display name, a gender selection (used to personalize your evening routine display), and your desired bedtime (used to schedule your reminder). This information is stored exclusively locally on your device and is not transmitted to us.

Legal basis: Legitimate interest in secure, abuse-free operation of the app (Art. 6(1)(f) GDPR).

To process premium subscriptions, we use the service RevenueCat (RevenueCat, Inc., USA). RevenueCat only processes anonymized identifiers and purchase receipts in order to verify your app's unlock status. Neither we nor RevenueCat gain access to your credit card or bank details, since all payments are processed entirely via your Apple App Store or Google Play Store.

The privacy terms of the respective store operator (Apple or Google) through which the purchase is processed apply in addition.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).

To find bugs and improve the app, we use Firebase Analytics and Firebase Crashlytics (Google). These services are disabled by default.

Only if you expressly grant permission (opt-in) in the consent dialog the first time the app is started do we collect anonymized usage data (e.g. screens visited, device type, crash logs). You can withdraw this consent at any time with future effect in the app settings under "Privacy".

Legal basis: Your explicit consent (Art. 6(1)(a) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected by the withdrawal.

If you send us feedback through the app, you open a form provided by our service provider Tally (Tally B.V., Belgium / EU). To assign and process your feedback, the app version and your anonymous technical identifier (see Section 4) are transmitted. If you contact us by email, we process the data you provide (e.g. email address, message content) exclusively to handle your inquiry.

Legal basis: Legitimate interest in responding to inquiries and improving the app (Art. 6(1)(f) GDPR).

Some of the services we use are operated by providers based in the USA (in particular OpenAI for AI analysis, as well as — only if consent has been given — Google Analytics/Crashlytics, and RevenueCat as part of purchase processing). This may result in the transfer of personal data to the USA.

We base these transfers on appropriate safeguards within the meaning of Art. 44 et seq. GDPR, in particular the EU Commission's Standard Contractual Clauses and, where applicable, a provider's certification under the EU-U.S. Data Privacy Framework. The data-protection agreements required for data processing are in place with the providers.

Your journal entries remain on your device until you delete them yourself or uninstall the app. Text submitted for AI analysis is not stored permanently (see Section 3). Optionally collected, anonymized analytics and crash data is processed according to the standard retention periods of the respective Firebase services.

Under the General Data Protection Regulation (GDPR), you have — where the statutory requirements are met — the following rights: right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21). You can withdraw any consent given at any time with future effect.

Since we do not store any personal content or accounts on our servers, these rights regarding your journal data lie primarily in your own hands.

Data deletion: Since all your journal entries and settings are stored exclusively, in encrypted form, on your own smartphone, uninstalling the app from your device is sufficient to completely and irrevocably delete all your app data.

Right to complain: You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR.

If you have any questions about data protection, feel free to contact us at any time. Contact details can be found in the Legal Notice.

BrainEase is not directed at children. Use of the app is only permitted from the age of 16. If a lower age limit applies for effective consent under national law, use by minors is only permitted with the consent of their legal guardians.

We reserve the right to amend this Privacy Policy so that it always complies with current legal requirements or to implement changes to our services. The version available at the time of your use applies. The date above ("last updated") indicates the time of the last update.