App Privacy Policy

The controller under the GDPR for the BrainEase app is Sebastian Wolfgang Dichmann, trading as SD Nightshift Studio, Am Ziegelstadel 20, 87700 Memmingen, Germany. Contact us at sdnightshiftstudio@gmail.com. Further details are in our Legal Notice.

Journal and mood entries: The mood check-in records a general self-assessment of how you feel at the moment; it does not ask about diagnoses, illnesses, or treatment. The journal fields are intended for thoughts, everyday experiences, and personal reflection. You write the entries freely. Depending on what you write, an entry may also contain health-related information. All content is stored in an encrypted SQLCipher database on your iPhone. The database key is stored in the iOS Keychain. We do not receive these contents, cannot view them, and do not automatically analyze them.

iCloud device backup: If iCloud Backup is enabled and BrainEase is included, app data, including the encrypted database, may be part of an automatic device backup. Apple processes that backup under its own privacy terms. This is separate from BrainEase's manual backup feature, which lets you export an additionally password-encrypted file and save it locally or in iCloud Drive. BrainEase does not synchronize data through its own servers, and the backup password is not transmitted to us separately.

Legal basis: Local storage is necessary to provide the journal and routine features you request (Art. 6(1)(b) GDPR).

BrainEase is designed to support general relaxation and personal reflection. It does not diagnose or provide medical or psychotherapeutic treatment. BrainEase does not provide AI analysis, automatic sorting, or voice-based analysis. Journal text and selected mood values are not sent to our servers or to Firebase. If telemetry is enabled, a screen view or usage event may show that you opened the mood check-in, an exercise or article, or saved a journal entry. The journal text and selected mood value are not transmitted.

BrainEase does not require registration or a user account. There is no server-side profile management. A display name you choose, your reminder time, and other settings are stored only on your device. The current app does not collect a gender selection.

Legal basis: Provision of the local features you choose (Art. 6(1)(b) GDPR).

For purchases and restoring purchases, we use RevenueCat, Inc. as a technical service provider. A pseudonymous app user identifier assigned by RevenueCat, product identifiers, purchase, subscription and entitlement status, and purchase receipts may be processed. This identifier is not your name, but it is not automatically anonymous. We do not receive credit card or bank details; App Store transactions are handled through Apple.

Further information: Apple Privacy, RevenueCat Privacy, and the RevenueCat DPA.

Legal basis: Art. 6(1)(b) GDPR for purchase processing, unlocking, and restoration.

Firebase Analytics and Firebase Crashlytics by Google are disabled by default. Only after you consent in the consent dialog may technical usage events, screen views, app and device information, and crash diagnostics be processed. Depending on use, these may include routine, exercise, category and article identifiers, general onboarding-step information, and technical error data.

Journal text, free text, introductory survey answer contents, names, profile details, and the mood value you select are not sent to Firebase. A screen or event name may, however, show that a particular area, such as the mood check-in, was opened. You can withdraw consent in the app settings; the change applies to future processing. More information: Firebase privacy information and Google Privacy Policy.

Legal basis: Your consent (Art. 6(1)(a) GDPR). Analytics and crash reports are enabled and disabled together through the same setting. Withdrawal does not affect the lawfulness of processing before withdrawal.

• Notifications: If you enable reminders, they are scheduled and triggered locally on your iPhone.
• File picker: When importing a backup or selecting a custom audio file, BrainEase accesses only the file you select through the iOS file picker. The app does not access your camera, photo library, or location.
• iCloud: Automatic iCloud device backups and manually saved BrainEase backups are different features. When you manually save or restore a backup, Apple processes the encrypted file you select under its privacy terms. See section 2 for automatic device backups.

Depending on use, Apple (App Store and iCloud), RevenueCat (purchase and entitlement data), Google/Firebase (only after consent for Analytics and Crashlytics), receive data. Some providers or their subprocessors may process data outside the European Economic Area. Any transfer to a third country is made only under a transfer mechanism permitted by GDPR Chapter V, such as an adequacy decision or Standard Contractual Clauses, and supplementary measures where required. The providers' current privacy information and contractual terms are linked above. You can request the mechanism applicable to a provider and a copy of its safeguards from us using the contact details above.

Journal text and selected mood values are not sent to these providers. If iCloud Backup is enabled and BrainEase is included, an automatic device backup may contain the encrypted local database; see section 2.

Local journal and settings data remain on your iPhone until you delete them or remove the app. Manual export files and iCloud device backups remain subject to the settings and retention rules of the relevant storage service until deleted or replaced. Purchase and entitlement data are processed for as long as needed to manage purchases, restore access, meet legal retention requirements, or establish or defend claims. The linked Google Analytics property is configured to retain Firebase Analytics event data for 2 months and user data for 14 months. The user-data period resets when there is new user activity, so it may continue for longer while activity continues. This setting does not affect most aggregated standard reports. Firebase Crashlytics retains crash traces, associated installation identifiers, and certain diagnostic data for 90 days; Google then begins removing them from live and backup systems.

Specific retention periods for other third-party providers may depend on our account and project settings. The relevant provider information appears in the corresponding sections of this policy; contact us with any specific request.

Where statutory requirements are met, you can request access, rectification, erasure, restriction of processing, and data portability, and you can object to processing. You may withdraw consent at any time with future effect. You may also lodge a complaint with a data protection supervisory authority, including the authority responsible in Bavaria or the authority where you usually live.

You can delete local entries in BrainEase; uninstalling the app removes local app data. Exported files and iCloud backups must also be deleted from their storage location. For requests about data held by Apple, RevenueCat, or Firebase, contact us at Sebastian Wolfgang Dichmann, SD Nightshift Studio, Am Ziegelstadel 20, 87700 Memmingen, Germany, sdnightshiftstudio@gmail.com. We will handle requests for processing for which we are responsible.

Supervisory authority in Bavaria: Bavarian State Office for Data Protection Supervision (BayLDA).

BrainEase is not specifically designed for children. Legal requirements for minors' purchases depend on their country and are separate from privacy consent. If an information society service is offered directly to children and processing is based on consent, Article 8 GDPR applies, including any required authorisation by the holder of parental responsibility.

We update this Privacy Policy when our processing or legal requirements change. We will notify users of material changes in an appropriate way. The date above shows the latest version; merely updating this page does not replace consent where consent is required by law.