Brainy Privacy Policy
Brainy is a voice assistant for iPhone that helps you remember notes, reminders, codes, birthdays and meetings. This policy explains what is saved on your device and what is processed by the services that power Brainy.
The short version
- Your saved memories are encrypted on your device. Relevant memories and calendar details can also be included in AI requests to help Brainy answer you.
- Voice, text, photos and meeting recordings used by AI features are processed by Google Gemini. Some requests pass through Brainy's backend; live voice connects directly to Google using a short-lived token issued through our backend.
- Connecting Google Calendar does not give Brainy access to your Gmail messages. Calendar connection is separate from account sign-in.
- Tokens and calendar data are protected with encryption in transit and at rest. See How Brainy protects your data.
- We do not sell your data or use it for advertising. Data is shared with service providers to operate the features described below.
What Brainy processes, and why
Account and authentication. You can sign in with Apple, Google or an email code. Brainy processes your provider identifier and, where provided, your name and email address. Authentication credentials are stored in the device Keychain. When opening a backend session, Brainy sends an identity credential to our server for verification. For Google sign-in, this includes a Google access token. This is used to authenticate you, not to read Gmail messages.
Voice and AI answers. Microphone audio is sent to Google's Gemini API while you use live conversation. Other AI features send text, audio or images through our backend to Gemini. Requests can include remembered facts, profile summaries and calendar context so the answer relates to your question. Google processes API data under its Gemini API terms. Do not share information you do not want processed by these services.
Saved memories. Notes, reminders, dictated codes, conversation text and generated summaries are saved in encrypted device storage, with an encryption key in the Keychain. Brainy may send relevant saved information to Gemini when answering, searching, summarising or updating what it knows about you. Local storage does not mean that information is never transmitted for processing.
Calendar. With permission, Brainy reads calendars and events on your phone. If you separately connect Google Calendar, Brainy requests calendar.readonly to read your calendars and event details, and calendar.events to create, move or cancel events when you request those actions. Details can include titles, times, attendees and meeting links. Upcoming events are cached on your device for the home screen and widget. Calendar details can be sent to Gemini to answer spoken questions and carry out calendar requests. Brainy also requests your account email to identify the connected account; it does not request Gmail mailbox permissions. Brainy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is not used to develop, improve or train generalised AI or machine-learning models.
Contacts. With permission, Brainy uses contact names and birthdays for the people you select. Contact names and email addresses can also be used to find attendees when you request a meeting invitation. Relevant details may be included in the AI conversation and in calendar events you ask Brainy to create.
Photos. Images you provide for recognition, such as a receipt or Wi-Fi sticker, are sent to Gemini. Extracted information can be saved as a memory when you ask. Our backend relays these requests rather than operating a photo library.
Meeting notes. When you ask Brainy to take meeting notes, audio or transcript text is sent to Gemini to generate the write-up. Tell everyone present before recording. The app removes its temporary recording after processing; saved notes and summaries remain in device storage until deleted. Uploaded files are also subject to Google's API processing and retention terms.
Subscriptions. Apple handles App Store payments. RevenueCat processes app-user identifiers and purchase/entitlement information to determine subscription access and restore purchases. Brainy does not receive your payment-card details. See RevenueCat's privacy policy.
Song recognition. Audio fingerprints are processed by Apple's ShazamKit service to identify music. See Apple's privacy policy.
Device checks and service logs. Brainy uses Apple DeviceCheck to help prevent misuse. Backend logs record operational information such as account identifiers, request status, processing times and deletion requests. The backend code does not intentionally log conversation, photo or calendar contents. Our hosting provider may also process network and request metadata to deliver and secure the service.
Feedback and support. Feedback you submit in Settings is sent to our team. Support emails are received by Bondo Studio through Google Workspace. Include only information you want the support team to read.
Notifications. Reminders are scheduled locally through iOS notification permissions.
Service providers and storage
Brainy's backend is hosted on Vercel. Google Gemini processes AI requests; Google also provides Calendar, sign-in and support-email services. Apple provides platform services and payments, and RevenueCat manages subscription entitlements. These providers process data as required to operate their services and under their applicable terms and retention practices. Processing may occur outside your country.
We do not operate a cloud backup of your saved memory library. Saved memories remain on the device until you remove them, although information included in AI requests is also processed by the providers described above. Operational records, purchase records and support correspondence are separate from your device's memory library.
How Brainy protects your data
This section describes the technical and organisational measures Brainy uses to protect personal and sensitive data, including Google user data obtained through Google Calendar and Google sign-in.
Encryption in transit. All communication between the app, our backend, Google and other service providers uses HTTPS with TLS. Brainy never sends calendar data, tokens or memories over unencrypted connections.
Encryption at rest on your device. Google access and refresh tokens are stored only in the iOS Keychain, restricted to this device and unavailable until the device has been unlocked after boot. Saved memories and cached calendar events are encrypted with AES-256-GCM using a key that is generated on the device and kept in the Keychain. The encrypted files also use iOS data protection, so they are unreadable while the device is locked before first unlock.
Where Google Calendar data goes. The app talks to the Google Calendar API directly from your device using your own OAuth token. Our backend does not receive or store your Google Calendar refresh token and does not keep a copy of your calendars or events. Calendar details are sent to Google Gemini only when needed to answer a question or carry out a request you made, and are not retained by our backend. Our backend has no database of user calendar data.
Access controls. Backend secrets, such as API keys, live in the hosting provider's encrypted environment configuration and are never shipped inside the app. Access to backend configuration and logs is limited to the Bondo Studio staff who operate the service. Backend requests are authenticated with a short-lived session issued after identity verification and with Apple DeviceCheck to block abusive clients. No Bondo Studio staff member reads your calendars, memories or conversations, and Google user data is never sold, shared with advertisers, or used to train AI or machine-learning models.
Data minimisation and retention. Brainy requests only the Google scopes needed for the features you use, and asks for calendar access separately from sign-in. Cached calendar data on the device is limited to upcoming events and is replaced on each refresh. Operational backend logs do not intentionally include calendar contents and are retained for a short period by our hosting provider. Disconnecting Google, deleting your account or using Forget everything removes tokens and cached calendar data from the device as described below.
Security practices. The app and backend are updated regularly to address security fixes. Third-party services we rely on (Google, Apple, Vercel, RevenueCat) maintain their own certified security programmes. Should we become aware of a security incident that affects your personal data, we will notify affected users and, where required, the relevant authorities and Google without undue delay.
Reporting a security issue. If you discover a vulnerability or believe your data has been misused, contact support@bondocreative.com.
Your choices and deleting data
You can stop live listening, manage iOS permissions, delete saved items, and use Settings → Forget everything to remove Brainy's saved memories from this device. Disconnecting Google removes Brainy's stored Google connection credentials and cached calendar data from the device. You can also revoke Google's authorization at Google Account permissions.
Settings → Delete account signs you out, disconnects Google and requests account closure through our backend. The current app retains local memories for a 30-day recovery period and clears them when the app next checks after that period. Signing back in during the recovery period cancels the scheduled local wipe. Use Forget everything if you want to remove local memories immediately. Removing the app is not a substitute for revoking Google authorization or cancelling an App Store subscription. To manage or cancel a subscription, use your Apple subscription settings.
Deleting local memories does not automatically erase operational logs, purchase records, support correspondence or data already processed by service providers. Contact us for account or data-deletion assistance.
Children
Brainy is not directed at children under 13 and we do not knowingly process their data.
Changes
If this policy changes, the new version will appear at this address with a new effective date.
Contact
Bondo Studio Pte. Ltd.
support@bondocreative.com