BrainFlow Privacy Policy

Our Privacy Promise

• We don’t sell your data or use it for ads.
• Audio is sent only to provide transcription, then deleted.
• We avoid collecting personal data unless you choose to provide it.

Summary (TL;DR)

• Audio: Sent securely to our processors to create a transcript, then deleted after processing.
• Identifiers: We use a device identifier only to deliver results back to your device and prevent abuse. Not used for tracking or profiling.
• Notes & transcripts: Stored on your device. You control export and deletion.
• No analytics tracking and no third-party advertising SDKs.

Data We Process

Processed locally on your device

• Voice recordings you create
• Transcripts/notes and any edits you make
• App preferences and settings

Sent off-device for processing (temporarily)

When you request a transcription:

• Your audio file is uploaded via our infrastructure to a transcription provider.
• The provider generates text and returns it to the app.
• Audio and intermediate data are deleted by the provider after processing (see “Third-Party Services”).

What we do not collect

• Name, email, or contact details (unless you voluntarily contact us)
• Location data
• Advertising identifiers
• Behavioral analytics for profiling

Identifiers

• Device Identifier (e.g., an app-scoped install/device ID) used only to route your jobs and prevent abuse.
  • Not linked to your identity and not used for cross-app tracking.

Why We Use Your Data (Purposes)

• App functionality: Transcribe audio, structure notes, and return results to your device.
• Reliability & abuse prevention: Ensure the service works and isn’t misused (rate limiting, error diagnosis).

Legal Bases (UK GDPR)

• Performance of a contract (Art. 6(1)(b)): To provide the transcription/notes service you request.
• Legitimate interests (Art. 6(1)(f)): To keep the service secure and reliable. We use the minimum data necessary and do not use it for marketing.

Third-Party Services (Processors)

We use trusted processors only to deliver core functionality:

• Railway – hosting/infrastructure to relay processing jobs.
• Deepgram – speech-to-text transcription. Deepgram processes audio to produce text and deletes audio after processing per its retention settings/policies.
• XAI via Openrouter – text refinement.
• App Stores (Apple, Google) – billing and app distribution.

Processors act under our instructions. We configure them to avoid retaining your content beyond what’s necessary to complete your request.

Data Retention & Deletion

• On device: Your recordings and notes remain on your device until you delete them.
• On servers: Audio is held only long enough to complete processing, then deleted. We don’t keep server-side copies of your content.
• Support emails: If you contact us, we keep your message only as long as needed to respond and comply with legal obligations.

Security

• All transfers use HTTPS/TLS.
• App data is stored in your device’s secure storage.
• Access to processing systems is protected by authentication and least-privilege controls.

International Transfers

Our processors may handle data in the US and/or EU/UK. Where required, we rely on appropriate safeguards (e.g., Standard Contractual Clauses) to protect your data.

Your Rights

You can:

• Access/export your notes (from the app).
• Delete recordings and transcripts (from the app).
• Object or restrict processing by not initiating transcription.
• Contact us at hello@brainflow.tech for questions or complaints. You may also lodge a complaint with your local data protection authority.

Children’s Privacy

BrainFlow is not intended for children. We do not knowingly process children’s data.

Changes to This Policy

If we make material changes, we’ll update the “Last updated” date and, where appropriate, notify you in-app at least 30 days before changes take effect.

Contact

Questions or requests: hello@brainflow.tech