Privacy Policy

• Account data – your name and email address when you create an account.
• Learning content you provide – the learning material you choose to upload or paste, and the personalised study content we generate from it for you.
• Usage data – how you use the Service (e.g. study sessions and your learning progress).
• Technical data – device, browser, and log information needed to run and secure the Service.

We use your data to: provide and operate the Service (generate your personalised study content and track your learning progress); maintain and improve the Service; communicate with you about your account and reminders you opt into; and keep the Service secure and prevent abuse.

We process your data on the basis of: performance of our contract with you (to provide the Service); your consent (e.g. for push/email reminders, where applicable); and our legitimate interests in operating, securing, and improving the Service.

To create your study content, we send what you give us for it to our AI provider, Anthropic (USA), which processes it on our behalf under a data-processing agreement. Depending on what you use, this is: the photos or the PDF you upload; the web address you paste, with the text of that page or the subtitles of that video, which our server fetches; the note you type in "Target this quiz"; the text of your material that we have stored; and study content generated from it – for example a term you select to have explained, a summary to be translated, or quiz explanations.

We send it without your name, email address or account ID. What you upload can still contain personal data – for example a name on a page – and that data then reaches the provider too. If what you upload contains personal data about someone else, including health information, that person's data is processed in the same way as described in this section. If your own information appears in material someone else uploaded, write to hello@brainamine.app with "Privacy request" in the subject line; you do not need a Brainamine account.

What it is used for. We use your content to create the study content you ask for – quizzes, summaries, explanations and translations. Anthropic processes it to give us that result. Anthropic also checks requests for misuse with automated safety systems, and may keep and review content where that is needed to enforce its usage policy or where the law requires it (see below). Other uses of your content, such as a quiz you choose to share, are described in their own sections.

No training. We do not use your content to train AI models. By default, Anthropic does not use content from its commercial API to train its models; it does so only if a customer agrees to share data with it or sends it feedback about a request. We do not agree to share data with Anthropic, and we do not send it your content as feedback.

How long the provider keeps it. For the service we use, Anthropic deletes what it receives and generates for us within 30 days. It keeps content longer only where that is needed to enforce its usage policy or where the law requires it; if its automated safety systems flag a request, it may keep the content for up to 2 years and the safety classification scores for up to 7 years. The provider has not confirmed to us whether it notifies its customers individually when this happens.

Learning materials, not medical records. Brainamine is for learning materials. It does not offer the processing of personal medical records, and we do not want them: please do not upload, link to or type into "Target this quiz" personal medical records, diagnosis letters, test results or other health details about yourself or another person. Study material on medical topics, such as textbooks and lecture slides, is allowed. Brainamine does not check uploads for medical content, so material uploaded anyway is processed like any other material – stored in your account and sent to Anthropic as described above. When we learn of such material – because you tell us, or we otherwise become aware of it – we block this material, and the study content made from it, from any further AI processing, and then delete it from Brainamine. If you uploaded something like this by mistake, write to hello@brainamine.app with "Privacy request" in the subject line and name it as it appears in the app; you do not need to send us the document again. Deleting it from Brainamine does not undo what Anthropic has already processed: what Anthropic received is kept or deleted under its retention terms described above.

If you share a quiz, a copy of it becomes readable by anyone who has the link. This happens only when you choose to share, and you can revoke a link at any time.

What the shared page contains: the quiz title, the questions and answer options as they were when you shared them, and the language they are written in.

What it never contains: your name, email address, or profile picture – a shared quiz does not say who shared it; the photos, files, or text you uploaded; your learning progress, scores, streaks, or any other quiz or account data. The shared copy is separate from your account data, so nothing else can be reached from the link.

Anything you typed yourself becomes public. If a title or a question contains personal information – yours or someone else's – sharing publishes it. Please do not share quizzes containing personal data.

People who open a shared link: we record that the link was opened or completed, and limited technical data (such as IP address and device information) to prevent abuse and misuse. The person who shared sees counts only – never who opened or took the quiz. Anyone can take a shared quiz without an account.

Legal bases: publishing the quiz is performance of our contract with you, at your request; abuse prevention and the handling of reports rest on our legitimate interest in keeping the Service lawful and safe. If someone reports a shared quiz, we process the report and the reporter's contact details in order to review it.

Deletion: revoking a link, deleting the underlying material, or deleting your account removes the shared copy; copies that other people already saved to their own reviews are not affected and stay in their accounts. Reports and moderation records may be kept for as long as needed to handle them.

Your rights. The rights set out in section 11 below – access, correction, deletion, restriction, objection, data portability, withdrawal of consent, and complaint to the Austrian Datenschutzbehörde – apply to shared-quiz data in the same way as to the rest of your account data.

If you sign up through someone's referral link (with your consent to the referral cookie, above), we record a link between your account and theirs, and grant them an "Evangelist Brain" badge. If you later make your first payment, they also receive Referral credit of 5% of that payment (excluding VAT). Basis: our legitimate interest in running this programme (Art. 6(1)(f) GDPR) once the referral event occurs; the credit itself is subject to the "Account credit at deletion" section of our Terms, including when it lapses.

How long we keep this. We keep the record of the referral for three years from the day we record it, whether or not a payment follows. If you make a first payment, a separate record of the Referral credit is created, and its own three years run from the day the credit is granted. If that credit is later reversed, the reversal is recorded separately and kept for three years from the day of the reversal; this does not change how long the original credit record is kept. Withdrawing your referral cookie consent stops new attributions; it does not remove a link already recorded (see our Terms, "Account credit at deletion").

The three-year period described above always runs from the date your Referral credit was granted, lapsed, or reversed – never from the date your account is deleted. If that period has already ended by the time your account is deleted, we delete the record at once; if it has not, we keep the record until it ends, even though your account no longer exists.

Where credit was spent together with money of your own before being reversed, we keep that combined record for our own accounting instead, for as long as the law requires – until the end of the seventh calendar year after the year the reversal was recorded – regardless of the three-year period above.

Spending your credit. If you switch on "Use my credit on my next bill," we briefly record, for each payment, how much credit we are about to apply – this record is deleted together with your account and has no retention period of its own (Art. 6(1)(b) GDPR). Once credit is applied, we keep a separate record of that spend for our own accounting until the end of the seventh calendar year after the year it was recorded (Art. 6(1)(c) GDPR, § 132 Bundesabgabenordnung). To apply the amount, we instruct Stripe, our payment processor, to adjust your balance or to apply it as a one-time discount to that payment.

If you apply for the 50% professional discount (Expert), to prove your eligibility you upload one of the following:

• a degree in Psychology, Psychiatry, or Neurology;
• a confirmation that you are currently studying one of those; or
• your certificate in ADHD or neurodivergency coaching.

Review: the uploaded document is reviewed by a human – no automated analysis, no profiling. We reach one of three outcomes: approved, declined, or we need more information – in that case we tell you what's missing and ask you to upload a new document.

Deletion: the file is deleted as soon as we reach any of these three outcomes, including when we ask for more information. If we ask for more information, the new document you upload goes through the same review and is deleted under the same rule when the next outcome is reached.

Which information we keep: which of the three categories it was, the decision, the date, an internal note, and – for the student route – a date five years out when we ask once for confirmation of completion. If approved, we also keep the subscription the discount is attached to. This is kept for as long as the discount applies to your subscription.

Confirming completion after five years. If you received the Expert discount because you were studying, five years later we ask you once, on your subscription page, to upload a document showing that you finished your degree (a degree certificate) or your coach certificate. This upload uses the same consent and the same private storage as your original application (Art. 6(1)(a) GDPR).

If you upload the document by the date in our request, your discount keeps running while we review it. If the date has passed and we have not confirmed a document, the discount stops from your next payment, and starts again once we confirm one.

We do our best to decide within a week of receiving your document. If we have not decided within 14 days, we get a daily reminder until we do.

The review ends in one of four ways:

• Confirmed – the document shows that you finished your degree; your discount becomes permanent, and we do not ask again.
• Declined – we do not find the document convincing. You can upload another one.
• Withdrawn – you press "Withdraw this document" before we decide. You can upload another one.
• No decision within 60 days – if we have not decided within 60 days of the first document you uploaded, it is deleted automatically. Uploading a different document in place of the one waiting for review does not add time. This is not a Decline: you can upload a document again, and a new 60 days begin. If you uploaded that first document by the date in our request, that date moves to 30 days after the deletion, so your discount keeps running while you upload again, and we email you.

Once one of the above has happened, the file is deleted, normally immediately; if a technical fault prevents this, the deletion is retried automatically, and we are alerted if it still fails.

After a Decline, a Withdraw or the automatic deletion after 60 days without a decision, your discount depends on the date in our request, as described above. Withdrawing a document never cancels your Expert discount itself, which rests on our contract with you (Art. 6(1)(b) GDPR).

Purpose: to set the price of your subscription – nothing else.

Legal bases: uploading a document and having it reviewed rest on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time before we reach an outcome – we then stop the review and delete the file. Once we reach "approved" or "declined", the record of that outcome administers a price term of your subscription and rests on our contract with you (Art. 6(1)(b) GDPR). "We need more information" continues the same consent-based review and does not itself change your subscription.

You can see your own verification status in your account. No one else can.

We do not sell your personal data. We share it only with trusted service providers (sub-processors) who help us operate the Service on our behalf, under appropriate data-processing terms. These fall into the following categories:

• Cloud hosting and infrastructure
• Database, authentication, and file storage
• AI processing (to generate your personalised study content, and to help us draft replies to selected ordinary support e-mails, after human review and a filtering step to remove identifying details)
• Email delivery
• Payment processing for paid plans

Stripe also processes your payment data as an independent controller for its own purposes, in particular fraud prevention, anti-money-laundering checks and the security of its services. See Stripe's privacy policy at stripe.com/privacy.

If you sign in with Apple, Apple processes the data it collects through Sign in with Apple – such as your Apple-assigned identifier and, if you choose to share them, your name and e-mail address – as an independent controller under Apple's own privacy policy. See apple.com/legal/privacy.

If you sign in with Google, Google processes the data it collects through Google Sign-In – such as your Google account identifier, name and e-mail address – as an independent controller under Google's own privacy policy. See policies.google.com/privacy.

A current list of the specific service providers we use is available on request at hello@brainamine.app.

Some of our providers are located outside the European Economic Area (e.g. the United States). Where data is transferred internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

We keep each kind of personal data only for as long as its purpose requires:

• your account details: until your account is deleted;
• the material you upload and the study content made from it – photos and PDFs, the text read from photos, a link's web address with the page text or video subtitles, your note in "Target this quiz", and the quizzes, summaries and explanations generated from it: until you delete it yourself in the app, ask us to delete it, or your account is deleted; personal medical records uploaded anyway are deleted once we learn of them (section 4). If you delete a material yourself, the date and score of each quiz you finished on it stay as part of your learning progress until your account is deleted.
• records with their own periods are described where they appear: shared quizzes (section 5), the Referral programme (section 6), Expert discount verification (section 7), the age-correction record (section 12), and invoices, which we keep for as long as tax law requires.

You can delete most individual material yourself at any time in the app – open the material and choose Delete material (see Account deletion for how). This takes effect at once; we keep no request record of it. For anything you cannot delete yourself – your whole account, or material the app does not let you remove – you can ask us to delete it instead. We complete that request within one month of receiving it; in complex cases we may extend this by up to two further months, and we tell you so, with our reasons, within the first month. We then remove the files and the data linked to them from Brainamine. What we keep afterwards is either required by law – for example invoicing records under Austrian tax law – or kept for a specific, documented reason described where it applies: the short record of this request (described below, three years); separately, the age-correction record described in section 12 (up to 7 years); and, unless you ask us to remove it, an entry on our e-mail delivery provider's list of blocked addresses if your address is on it (described at the end of this section, 24 months). None of the latter three is a legal requirement; they are our own proportionate choices under Article 6(1)(f) GDPR, which you can object to. We keep that record – the date, the account and item identifiers, and what was deleted – for three years after we complete the request, so that we can show we handled it; it contains nothing you uploaded. If a dispute about the request is still open after three years, we keep only what that dispute needs until it is resolved. How long our AI provider keeps what it processed is described in section 4.

When you or someone else sends us a report through the app, by email with "Privacy request" in the subject, or as a shared-quiz report, we keep a short queue record of it – a case reference, the channel, the product, when we received it, when we saw it and when we handled it, and the outcome – for three years after we mark it handled, so that we can show how quickly we responded; it holds none of the report's content, no name and no email address. If the report, or an incident linked to it, is still the subject of an authority inquiry or an asserted legal claim when that period ends, we keep the record until that is resolved.

Finishing a material deletion. When you delete a material, we normally remove its files within seconds. If that does not succeed at once, we keep a short server-side record of the storage locations still to be removed, an attempt count, and an error code. We retry automatically through an hourly cleanup process. If removal remains incomplete, we keep retrying and flag records still open after 24 hours for our team. The storage locations it lists begin with the account's internal id, so this record identifies the account; it holds no item id or title, though a storage location created before 22 September 2026 can also include the original file name. We keep each record until its files are gone. Legal basis: our legitimate interest in actually carrying out the deletion that Articles 5(1)(e) and 17 GDPR require of us (Art. 6(1)(f) GDPR).

Guest clean-up after an account merge. When a guest's quizzes and reviews have been attached to an account and the guest's own, temporary profile is then deleted, we keep a short server-side record so that we can find and delete the guest's files that are no longer referenced by any material, page or pending clean-up task. It holds only the deleted guest's id, the relevant timestamps, an attempt count, and an error code if one occurred – no identifier of the account the guest's data was merged into, no file name, and no content. We delete it as soon as that clean-up is complete; automatic clean-up runs hourly. If a record is still open 30 days after it was created, we do not delete it: we flag it for a member of our team to resolve, and keep it until the clean-up is complete. Legal basis: our legitimate interest in actually carrying out the deletion that Articles 5(1)(e) and 17 GDPR require of us (Art. 6(1)(f) GDPR).

When an e-mail we send cannot be delivered, or its recipient reports it as spam, our e-mail delivery provider puts the address on a list of blocked addresses, so that no further e-mails are sent to it; we can also put an address on that list ourselves. The entry holds only the address and the reason – undeliverable, reported as spam, or added by us – and no message content. We delete an entry 24 months after it was added, and at once if you ask us to. Legal basis: our legitimate interest in not e-mailing an address that has been blocked and in keeping our e-mails deliverable (Art. 6(1)(f) GDPR), which you can object to. A request to delete your account or your data does not by itself remove this entry: it stays, with only your address and the reason, so that we do not e-mail you again – unless you also ask us to remove it. If we remove it and the address is given to Brainamine again later, we could e-mail it again.

Under the GDPR you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and the right to data portability and to withdraw consent. To exercise these rights, email hello@brainamine.app with "Privacy request" in the subject line. For deletion of your account or data, see Account deletion. You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde).

Brainamine is currently available only to users aged 14 or older. Users under 14 may not create or use an account during this launch phase.

Before you use the Service, we ask a neutral question about your age. We never store the number or date you enter. What happens next depends on where you are:

– If you are a new visitor and your answer is under 14, the Service stops on your device. No account or guest session is created, nothing is sent to our servers, and no result is stored.

– If your answer is 14 or older and you are trying the Service as a guest, a guest session is created and your device receives a time-limited confirmation (12 hours) that you answered 14 or older. We do not store the result for the guest session. If you later answer under 14 on that device, the confirmation is withdrawn: we record the confirmation's own random identifier and the time it was due to expire, so that a copy of it cannot be reused elsewhere. We do not record your age answer, any account, session, or device identifier, or the confirmation itself. We keep this record only until the confirmation would have expired anyway (at most 12 hours), and delete it at the latest the next time our daily deletion job runs (within one further day). The basis is our legitimate interest in keeping the age confirmation reliable (Art. 6(1)(f) GDPR).

– If your device still holds the guest confirmation that you answered 14 or older, and you then create an account, or log in to an account that has no recorded result yet, we record the result "14 or older" on that account, together with the time it was recorded. A result already recorded on that account stays as it is.

– If you log in directly to an account that has no recorded result, without such a guest confirmation, we ask the question in the account and record the result – "14 or older" or "under 14" – together with the time. If the result is "under 14", the account is blocked from further use; once recorded, this result cannot be changed to "14 or older" except through the correction process below.

If your account already has a recorded result, signing in does not ask the question again and does not change what is recorded.

Your exact date of birth is asked separately, later, and only before your first paid purchase.

If you believe your account's age result is wrong – for example because of a mistyped answer – you, or a parent or guardian, can email us at hello@brainamine.app with "Age correction" in the subject line. We review the request and, if it holds up, a member of our team applies the correction. The account stays blocked until a correction is applied. Please do not attach any identity document, certificate, or photo to this email – we do not ask for one. If one arrives unprompted, we do not copy its contents into our records, and it is deleted under our mailbox deletion schedule.

When we apply a correction, we keep a record of it: which of our team applied it, when, the result before and after, one of a small fixed set of reasons for the change, and – only if needed – a short internal note or reference to the support conversation, which our process is designed to keep free of identity or health information; the reference itself remains personal data, linkable to that conversation, until it is removed at the point described below. This record exists to show that a decision affecting a child-safety control was reviewed and made by a named, authorised person, and to keep the "14 or older" result accurate. The basis is our legitimate interest in keeping this control accurate and accountable (Art. 6(1)(f) GDPR). We keep the record for up to 7 years after the correction and then delete it. We do not keep any summary or statistics of corrections.

If you believe a child under 14 holds an account despite a "14 or older" result, email us at hello@brainamine.app with "Privacy request" in the subject line. We investigate the report and, if we confirm that the account holder is under 14, we delete or restrict the account (the steps on our Account deletion page also apply).

If you write to us with "Under 14" in the subject to ask when our under-14 programme will be available, we use your email address to send you that one update. We retain the whole message you send us – including your email address, the subject, timestamp, and anything else it contains – for no longer than 24 months. If the programme becomes available earlier, we send you that one update and permanently delete your message no later than 30 days after we send it, and in any event no later than 24 months after you sent it to us. We do not use its other contents for any purpose, and we ask that you not include any information about your child. The basis is our legitimate interest in responding to your request (Art. 6(1)(f) GDPR).

We use cookies and browser storage (local storage, session storage) to run and secure the Service, to remember your choices, and – only with your consent, as described below – to attribute referrals and to manage guest access to shared quizzes. We do not use any cookie or similar technology for advertising or analytics, and none of the technologies below is shared with a third party.

Keeping you signed in and secure. A session cookie keeps you signed in; it lasts for your session and is cleared when you sign out. This session cookie is created the moment you use the Service as a guest – before you create an account or sign in – because the guest session and its confirmation are the starting point of the same sign-in mechanism this cookie maintains. A short-lived cookie (10 minutes) protects the sign-in process itself.

Remembering your choices. A cookie stores your chosen display language for up to 365 days. A separate entry in your browser records that you have seen our cookie notice, so we don't show it again, and is kept for up to 365 days.

Running the app you're using. Browser storage keeps track of things like whether you've completed onboarding, which plan features to show you, and the state of tools you're using (focus timer, reschedule, video, banners, explanation mode). These are kept only for as long as needed to run the feature they belong to. Two records – which in-app notices you've read or dismissed, and how many times your shared quizzes have been opened – work the same way, but with a 365-day limit: browser storage has no expiry of its own, so when you next use the Service, either record is discarded and, where needed, replaced with a fresh one if it was last saved more than 365 days before. If you never return, the record stays in your own browser, where we cannot reach it, until you clear your site data – see your browser's settings for how.

Setting up your account. While you're setting up your account, your browser holds the answers you give before the account exists (for example the introductory questions); it never holds the date of birth you enter, at any point (see "Minimum age" above). These answers are cleared as soon as your account is set up. If you try Brainamine as a guest, your device holds the signed 14-or-older confirmation described above. If you later create an account, or log in to one, a single-use secret lets us attach the quizzes and reviews you did as a guest to that account. Your browser's copy of this secret is deleted as soon as the hand-off finishes. We store only a cryptographic hash of it, which grants no access to any account and cannot be used to read your data. We keep that hash only as follows: if the hand-off finishes normally, for up to 7 days afterwards (to investigate the rare case where it turns out to have failed); if the hand-off is interrupted after your guest work has already been attached but before the last step completes, until that step completes, and in any case no more than 30 days after the attachment – deleting the hash sooner would otherwise wrongly tell you your guest work could not be attached, when it was; and if the secret is never used at all, for up to 30 days after it was created. In every case the hash is then deleted automatically. The guest device's own read/dismissed record of in-app notices is deleted once your account's record takes over. If we cannot attach your guest work when you sign in, we tell you once on your dashboard and then remove that notice. Legal basis: taking these steps at your request when you choose to try Brainamine before or during creating an account (Art. 6(1)(b) GDPR), and our legitimate interest in providing this feature securely (Art. 6(1)(f) GDPR).

Two technologies below are activated only with your consent, given through a dedicated banner shown where they apply: the referral cookie and the shared-quiz access marker. Declining is as easy as accepting, and you can change your answer anytime in Cookie settings.

Referral link. If you arrive through a referral link, we ask whether you agree to a cookie (bm_ref, 30 days) that lets us reward whoever invited you: a badge, and – if you make a first payment – Referral credit of 5% of that payment (excluding VAT). Basis: your consent (Art. 6(1)(a) GDPR). Withdraw anytime in Cookie settings; this deletes the cookie and stops any future attribution.

Shared quiz access. If you take a shared quiz as a guest, we ask whether you agree to a marker (bm_qtake, cookie plus a matching entry in your browser's storage, 90 days). If you accept, we remember on this device, for 90 days, that you completed a shared quiz, and you will need a free account to take another one during that time. Basis: your consent (Art. 6(1)(a) GDPR). Withdraw anytime in Cookie settings; this deletes both copies immediately.

Your cookie choices. We store your answer to each of the above (yes or no), the day you answered, and the version of the text you answered, in a cookie (ba_consent, 365 days, no identifier). This lets us honour your choice without asking again, and lets us ask again if the text changes. For the shared-quiz marker, a "yes" answer is honoured only for as long as the marker itself lasts (90 days); after that, we ask again. A "no" answer is honoured for the full 365 days.

We use technical and organisational measures to protect your data, including encryption in transit and access controls. No method of transmission or storage is completely secure, but we work to protect your information.

We may update this Policy from time to time. We will update the "Last updated" date above and, where appropriate, notify you of material changes.

Brainamine – hello@brainamine.app