Privacy Policy for Brain Spill

1. Introduction

Brain Spill ("we", "our", or "us") respects your privacy and is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR).

This Privacy Policy explains how personal data is collected, used, stored, and protected when you use Brain Spill on iOS, iPadOS, or Android ("App"), including guest use.

2. Data Controller

For the purposes of GDPR, the data controller is:

3. Who This App Is For

Brain Spill is not intended for children under the age of 13.

We do not knowingly collect personal data from children under 13. If such data is discovered, it will be deleted without delay.

4. Legal Bases for Processing (GDPR Article 6)

We process personal data under the following legal bases:

In the mobile app, you can withdraw permission for future AI sharing in Settings → Privacy → AI processing, without deleting your account. Turning this off also pauses queued AI uploads. Requests already sent cannot be recalled. Account and content deletion are separate controls.

5. Account Types

6. Personal Data We Collect

6.1 Account Information

• Email address
• Password (stored securely using encryption or hashing)

6.2 User-Generated Content

• Voice recordings
• Voice transcriptions
• Text you type, task titles, and task steps
• AI-generated notes and tasks

This data is processed only to provide app functionality.

6.3 Technical & Usage Data

• Device model, operating system, and app version
• Guest, device, account, and subscription identifiers where applicable
• App usage statistics
• Crash and error reports

7. How We Use Your Data

Your data is used to:

• Operate and maintain the App
• Transcribe voice input and generate notes/tasks using AI
• Sync and back up your content
• Improve performance and reliability
• Detect and resolve errors
• Ensure security and prevent misuse

We do not sell personal data.

8. AI Processing & Third-Party Processors

AI sharing with OpenAI

When you choose an AI feature, the mobile app asks for your explicit permission before sending content. Microphone access, completing onboarding, or creating an account does not grant this permission. You can choose Not Now and continue using features that do not require AI, including saving a note with Save without AI.

• Voice: the recording you select, a filename, and your language setting are sent through Brain Spill servers to OpenAI to convert speech into text. The transcription route does not save a permanent server copy of the audio.
• Text: typed text or the resulting transcript is then sent through Brain Spill servers to OpenAI to generate summaries, notes, tasks, and suggested steps. That text can include personal information you typed or spoke.
• Task suggestions: the task title, associated transcript, and relevant existing steps may be included to provide context and avoid duplicate suggestions.
• Your content can contain personal information, including information about other people that you type or speak. Avoid submitting information you do not want processed by these services.

OpenAI is a third-party AI provider. Brain Spill receives its generated results and the app uses them to display or save your notes and tasks. Permission applies to these AI features on this device, including retrying recordings queued while offline. The app records the disclosure version and acceptance time locally. Missing or outdated permission requires a new choice; turning AI processing off prevents future AI submissions and pauses queued uploads until you grant permission again.

OpenAI documents that API content is not used for model training by default unless the API customer opts in. Its audio transcription endpoint lists no abuse-monitoring or application-state retention; text processing through Chat Completions can have abuse-monitoring logs retained for up to 30 days, or longer where legally required. These are provider defaults, not a promise that all Brain Spill data is immediately deleted. See OpenAI’s API data controls for details and exceptions.

Other processing and protections

Brain Spill uses third-party data processors to deliver its services, including:

• AI services (OpenAI - for transcription and task generation)
• Cloud storage providers (for backup and sync)
• Firebase Analytics (Google) - for anonymous usage statistics and app improvement
• Crash reporting services
• Authentication providers (e.g. Google, Apple)
• RevenueCat and the applicable app store (Apple or Google) — to process purchases and validate subscription access

We require third-party processors that receive personal data to provide the same or equal protection described in this policy, including appropriate security, purpose limitations, and safeguards for retention, deletion, and international transfers. Processing arrangements must protect your data consistently with this policy and applicable data-protection requirements.

Analytics Opt-Out: You can disable analytics collection at any time in the app settings under Privacy → Share usage analytics.

9. International Data Transfers

Some data may be processed outside the European Union. When this occurs, we ensure appropriate safeguards such as:

• Standard Contractual Clauses (SCCs)
• GDPR-compliant processing agreements

10. Data Retention

Recordings and drafts may be stored on your device for playback or offline retries. Disabling AI sharing pauses queued submissions rather than deleting recordings. Brain Spill does not save a permanent server copy of audio as part of transcription, but transcripts and AI results may be saved with notes and tasks. If you are signed in, notes and tasks may sync to Brain Spill servers. Any audio separately uploaded for storage has a different lifecycle from a transcription request. See Section 8 for OpenAI’s separate retention practices.

We retain personal data:

• While your account remains active
• Until you delete your content or account

After account deletion:

• Your account and associated notes and tasks are removed from the active account database
• Operational logs, backups, and separately stored files may have separate retention periods; contact support@brainspill.net for a deletion request covering residual copies

11. Your GDPR Rights

Under GDPR, you have the right to:

• Access your personal data
• Rectify incorrect or incomplete data
• Erase your data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

You can exercise most of these rights directly inside the app, including full account deletion.

12. Data Deletion

You may delete your account at any time using the in-app account deletion feature.

If you don’t have access to the app, you can request account deletion by email using our request page:

Once deleted:

• Your account and its associated notes and tasks are removed from the active account database
• Deletion does not recall content already submitted to a processor or instantly erase all logs and backups; the retention distinctions in Sections 8 and 10 apply

13. Data Security

We apply appropriate technical and organizational measures to protect your data, including:

• Encrypted data transmission
• Secure storage
• Restricted access controls

While no system is completely secure, we take data protection seriously.

14. Ads & Tracking

Brain Spill:

• Does not show ads
• Does not use advertising trackers
• Does not share data for marketing or profiling

15. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected by updating the "Last updated" date. Material changes may be communicated within the app.

16. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local EU Data Protection Authority (DPA).

17. Contact

For any questions regarding this Privacy Policy or your personal data: