Privacy Policy
Effective Date: October 27, 2026
1. Information We Collect
1.1 Information You Provide
When you use Brain Coach, we collect your email address, account sign-in information, the responses you give in our intro questionnaire, and your exercise activity and progress. Supabase manages account sign-in using a password or a one-time email code, depending on the account.
Intro questions may include who you practise for, stroke timing, speech or memory difficulties, and your goals. In iOS version 2.1.3, these intro answers are kept on your device for personalisation. Progress saved to your account includes completed exercises, practice days and streaks, practice priorities, exercise difficulty ratings and skill levels, so it can sync across devices. Brain Coach does not request clinical records or use these answers to make a medical diagnosis.
1.2 Information Collected Automatically
Depending on the platform and features you use, we process device and browser information (such as model and OS/browser version), app or browser identifiers, usage information, and crash or performance diagnostics. RevenueCat validates subscription and purchase status. Apple processes purchases made through the iOS App Store; Stripe processes purchases made through our website. The app analytics and attribution described in Section 3 also apply.
1.3 Information Collected with Your Consent
Microphone: Speech recognition is used during speaking exercises when you tap the microphone and grant permission. In the iOS app, recognition uses Apple’s speech-recognition service and, depending on the language and device, may require Apple’s servers. Brain Coach does not upload speech recordings to its own servers or save recordings. In a browser, speech processing depends on the browser and recognition engine; a browser’s own speech service operates under that browser provider’s privacy terms.
Notifications: In the iOS app, reminders and practice notifications are scheduled locally on your device if you grant notification permission; this does not require a browser/PWA push subscription token. For browser/PWA notifications, we store a push subscription token to deliver reminders and encouragement. You can turn notifications off in the app, browser or device settings, as applicable.
2. How We Use Your Information
We use your information to provide and personalize the Brain Coach service, sync your progress, deliver reminders you've opted into, process subscriptions, understand and improve how the app is used, send service emails (sign-in codes, receipts), and detect fraud or abuse.
Where your exercise activity relates to your recovery, we treat it with care and use it only to run and improve the practice experience — not to make any medical assessment.
3. Third-Party Services
- Supabase — account authentication using passwords or one-time email codes, and account-linked progress storage
- RevenueCat — purchase validation, subscription management and entitlement checks; linked to your account email when you sign in
- Apple — iOS App Store payment processing and speech recognition when you use speaking features
- Stripe — website payment processing
- Mixpanel — product analytics (event-level usage) on our website, intro questionnaire and earlier app versions where enabled; purchase and subscription activity forwarded by RevenueCat where configured
- PostHog, self-hosted by our group — product analytics in the iOS app from version 2.1.3, including app openings, generic onboarding navigation, paywall and purchase outcomes (product, price and store transaction ID), and exercise/practice interactions
- Singular — install and purchase attribution in the iOS app from version 2.1.3, once the iOS tracking-permission prompt has been answered, including installs and app sessions, onboarding completion, and trial and purchase events with the product and, for paid purchases, the price and currency. Singular may share these conversion events with advertising networks such as Meta to measure the performance of our ads.
In the iOS app from version 2.1.3, product analytics and attribution start when you first open the app. You can turn app analytics off at any time in Profile. PostHog uses a random analytics identifier before sign-in and your opaque account identifier after sign-in, so these events and profiles are not anonymous. App analytics does not include your email address, intro-questionnaire answers, assessment results, spoken words or recordings. Automatic screen capture and session recording are disabled. Analytics data is processed on our self-hosted PostHog instance in the United States (Google Cloud, us-central1) and retained until deleted on request.
While app analytics is on, RevenueCat receives the analytics identifier and analytics status metadata to associate purchase activity with the same analytics profile, and Singular receives the analytics identifier for attribution once the iOS tracking-permission prompt has been answered. Singular uses your advertising identifier (IDFA) only if you allow tracking; declining does not prevent you from using Brain Coach. Authentication, progress synchronisation and purchase validation operate independently of app analytics. Website analytics and earlier app versions have separate configurations.
Each provider processes your information under its own privacy terms and our data processing agreements.
4. Data Sharing
We do not sell your personal information. Sharing occurs only with the service providers listed above, when required by law, or in connection with a corporate transaction (merger or acquisition) where the acquiring entity assumes the obligations of this policy.
5. Data Retention
Account data persists for as long as your account is open. If you delete your account, we remove your account information within 30 days, except where retention is legally required (e.g. tax records related to subscriptions). Retention of analytics and attribution records is separate from account storage: app analytics data on our self-hosted PostHog instance is retained until deleted on request, and attribution records are retained under Singular’s terms. Anonymized aggregate analytics may be retained for product improvement.
You can turn app analytics off at any time in Profile. Turning it off stops future app analytics and attribution from that device and clears the analytics identifier and pending analytics events there. It does not itself erase analytics profiles or events already received by PostHog or attribution records already received by Singular. To request deletion of previously received analytics or attribution data, contact [email protected].
6. Data Security
We protect your data with encrypted transmission (HTTPS/TLS), account authentication managed by Supabase using a password or a one-time email code depending on the account, row-level security on the Supabase database, and signed-token authentication. No method of transmission or storage is 100% secure, but we apply industry-standard controls and review them regularly.
7. Cookies and Local Storage
Brain Coach uses essential storage on your device or in your browser to keep you signed in, save your progress and preferences, and schedule local reminders. Our website and intro questionnaire may use analytics and, where you consent, advertising cookies. You can control non-essential cookies through our consent banner and your browser settings. In the iOS app from version 2.1.3, analytics storage is created when the app first opens and is cleared if you turn app analytics off in Profile. Essential app storage is separate.
8. Your Rights (EEA/EU Users)
Under the GDPR you have rights to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. To exercise any of these, email [email protected]; we respond within 30 days. Our legal bases are contract performance (providing the service), your consent (microphone, notifications, non-essential cookies), and our legitimate interests (app analytics, advertising measurement, security, fraud prevention). You can object to app analytics at any time by turning it off in Profile.
9. Your Rights (California Users)
The CCPA grants California residents the rights to know what personal information we collect, request deletion, opt out of sale (we do not sell personal information), and non-discrimination for exercising these rights.
10. Children's Privacy
Brain Coach is intended for adults aged 18 or older. It is not directed at children. If we discover an account was created by someone under 18, we will delete it.
11. International Data Transfers
Your information may be processed in the European Union, the United States, or other regions where our service providers operate, including our self-hosted PostHog analytics instance in the United States (Google Cloud, us-central1). We rely on Standard Contractual Clauses or equivalent safeguards where required by the GDPR.
12. Changes to This Privacy Policy
We post updates here with a revised effective date and surface material changes in-app or by email.