Privacy policy | BrainAIstorm

1. Introduction

BrainAIstorm ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

Data controller

BrainAIstorm is the data controller for the personal data described in this policy. BrainAIstorm is currently operated by an individual and is not yet a registered company; a registered entity and its address will be named here once established. For any privacy matter in the meantime, contact privacy@brainaistorm.com.

2. Information we collect

Information you provide

Account information: Email address, name, password
Assessment data: Responses to decision-making assessment questions
Decision data: Decision descriptions, analyses, commitments, and outcomes
Follow-up entries: Outcome check-ins and letters to your future self, written after a decision and stored with your decision data
Paid-plan interest: Whether you asked to hear when a paid plan opens, with the date, where in the app you asked (Settings, the decision limit, patterns or the dashboard) and the plan you picked, if any
Reports you send us: If you report an analysis from the app, the reason you pick, the note you write (optional), the decision's id, your account's id, the language of the analysis and the time of the report. We may read the reported analysis to review the report

The service is currently free during validation. We do not collect payment or billing information, and there is no payment processor.

Voice input (optional)

You can type your decision, or use the optional voice input to dictate it. Voice input appears only in browsers that support it and in the Android app, and it starts only when you turn it on. When you use it in a browser, your browser records your speech and sends the audio to its own speech-recognition service (for example Google for Chrome, or Apple for Safari) to turn it into text. That step is carried out by your browser and its provider under their own privacy terms, not by us. Our page asks your browser for microphone access only so dictation can start; it does not read, record, or store any audio. Only the resulting text reaches us, and only if you submit your decision. You can type instead at any time.

In the Android app, your phone's speech-recognition service (Google on most Android phones) receives your speech and turns it into text under that provider's own privacy terms; the app itself does not read or store any audio, and no audio reaches us. The app asks for microphone permission the first time you tap the mic, never when it starts, and you can withdraw it at any time in your phone's app settings.

Automatically collected information

Usage data: Pages visited, features used, time spent
Device information: Browser type, operating system, IP address
Cookies: Session cookies for authentication and preferences (see our Cookie policy)

3. How we use your information

We use your information to:

Provide and maintain the Service
Process your decisions through AI analysis (using Claude by Anthropic)
Personalize your experience and provide insights
Send you notifications and reminders (if enabled)
Review analyses you report to us
Improve and optimize the Service
Detect and prevent abuse
Comply with legal obligations

4. Legal bases for processing

Where the General Data Protection Regulation (GDPR) applies, we rely on the following legal bases under Article 6 GDPR:

Processing purpose	Legal basis	Notes
Account and authentication	Contract, Art. 6(1)(b)	Needed to create, secure, and operate your account
Decision data and AI analysis	Contract, Art. 6(1)(b)	The core service you request when you submit a decision
Product analytics (PostHog)	Consent, Art. 6(1)(a)	Runs only after you accept analytics in the cookie banner. This applies to both in-browser analytics and analytics events sent from our servers
Error tracking (Sentry)	Legitimate interest, Art. 6(1)(f)	Keeping the service reliable and secure; error reports only
Abuse prevention and device fingerprinting	Legitimate interest, Art. 6(1)(f)	Detecting and preventing abuse of the service
Transactional email (account and security messages)	Contract, Art. 6(1)(b)	For example email verification and password reset
Session replay (Sentry)	Consent, Art. 6(1)(a)	Records how you use the interface, with all text masked; off until you accept analytics
Improving the Service (error reports and aggregate usage counts from our own systems)	Legitimate interest, Art. 6(1)(f)	Never your decision text
Pro waitlist: noting that you asked to hear when a paid plan opens, and the one email that follows	Your request, Art. 6(1)(b)	Only if you press the button in the app
Reports you send us about an analysis: the reason, your note, the ids, and reading the reported analysis	Your request, Art. 6(1)(b)	Only if you send a report from the app
Abuse prevention after account deletion (record of your email address)	Legitimate interest, Art. 6(1)(f)	See data retention
Legal obligations, for example answering a lawful request	Legal obligation, Art. 6(1)(c)	Rare
Reminder and notification email	Legitimate interest, Art. 6(1)(f)	On by default with an opt-out: you can disable these at any time in Settings

Where we rely on legitimate interest, you have the right to object; see your rights and choices below.

5. AI processing

Your decision data is processed by Anthropic's Claude AI to provide analysis and insights. Key points about AI processing:

Decision descriptions and context are sent to Anthropic's API
Anthropic processes this data to generate analysis
Anthropic does not use your data to train their models (per their commercial data policy)
Anthropic retains the text sent to its API for up to 30 days, during which it may be accessed by Anthropic for safety and security purposes, and then deletes it
Analysis results are stored in our secure database

Decision text is free-form and may include sensitive information about you, for example about health, relationships, or finances. We process it only to provide the analysis you request and the safety features described in this policy, and to review an analysis you report to us. Share only what you are comfortable sharing, and do not include another person's personal data unless you have the right to share it.

6. Data sharing and disclosure

We share your information only in these circumstances:

Service providers: Anthropic (AI analysis of the decision text you submit), Supabase (database and authentication), Resend (transactional email), PostHog (product analytics, loaded only with your consent), Sentry (error tracking), Vercel (hosting), ImprovMX (forwarding of email sent to our addresses) and Google (Gmail, the mailbox behind our support address). A report you send us about an analysis travels as an email through Resend to support@brainaistorm.com; ImprovMX forwards it to that Gmail mailbox, where the team reads it
Legal requirements: When required by law or to protect rights and safety
Business transfers: In connection with a merger, sale, or acquisition

We do NOT sell your personal information to third parties.

7. Data security

We implement security measures to protect your information:

Encryption in transit (HTTPS/TLS)
Encryption at rest (database-level encryption)
Secure authentication
Row-level security policies
Periodic security reviews and updates

8. Your rights and choices

You have the right to:

Access: Request a copy of your personal data
Correction: Update or correct your information
Deletion: Request deletion of your account and data
Export: Download your decision data
Restriction: Ask us to restrict processing while a dispute about accuracy or our legal basis is resolved
Portability: Receive the data you gave us in a machine-readable format (the JSON export in Settings)
Withdrawal of consent: Withdraw consent at any time where we rely on it (analytics and session replay); this does not affect processing before withdrawal
Opt-out: Disable email notifications in Settings, and accept or reject analytics cookies at any time through the cookie settings link in the footer
Objection: Object to processing we base on legitimate interest (see the legal bases for processing above)
Complaint: Lodge a complaint with a data protection supervisory authority. The supervisory authority for us is the Polish authority, Prezes Urzędu Ochrony Danych Osobowych (Prezes UODO, uodo.gov.pl). If you live or work in another EU country, you may also complain to the authority there

To create an account you need to give an email address and a password; without them we cannot provide the Service. Everything else you share is your choice. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects; the analysis is a thinking aid and the decision stays with you.

To exercise these rights, visit your Settings page or contact us at privacy@brainaistorm.com.

9. Data retention

We retain your information:

Account data: until you delete your account
Decision data: until you delete individual decisions or your account
Usage and technical logs: kept while we need them to operate and secure the Service, and removed on request
Reports you send us: kept as emails in our support mailbox while we need them to review the report, and removed on request; the reports themselves are not stored in our database

You can delete your account yourself, without asking us: open Settings, then Danger zone, choose Delete account and confirm by typing DELETE. This works on brainaistorm.com and inside the Android app, and takes effect immediately.

When you delete your account, your account and decision data are removed from the live database immediately. We keep one record of your email address together with the date of deletion, the account's internal id, the number of decisions it had and whether it had a paid plan; it stops a deleted account being re-created for 30 days and free-plan limits being reset by registering again. We keep it only for as long as that purpose requires and never use it to contact you. Reports you sent us stay in the support mailbox until we no longer need them or you ask us to remove them; deleting your account does not remove them. Encrypted backups of the database are retained for up to 30 days, and your data ages out of all backups within that window.

10. Children's privacy

The Service is intended for adults. By using the Service, you confirm that you are at least 18 years old. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. International data transfers

Some of our providers process personal data in the United States. In particular, the decision text you submit is processed by Anthropic in the United States to generate your analysis, and our hosting and email providers, including Google, which hosts our support mailbox, may also process data there. Where personal data leaves the EU, we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework for providers certified under it, and on the Commission's standard contractual clauses otherwise. You can ask for a copy of the safeguards we rely on, including the standard contractual clauses, by writing to privacy@brainaistorm.com.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 14 days before they take effect; where a change needs your consent, we ask for it.

13. Contact us

For privacy-related questions or requests, contact us at:

Email: privacy@brainaistorm.com