Last updated: May 3, 2026
BrainBeat ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and safeguard your information when you use our mobile application and related services.
Email address and display name when you create an account, or Apple ID / Google ID if you use social sign-in.
Vocabulary progress, session history, language preferences, CEFR level, flashcards, dialogue transcripts, and learning statistics.
Before using binaural audio features, we collect your explicit acknowledgement regarding pre-existing conditions (epilepsy history, cardiac pacemaker, pregnancy). This data is classified as special category data under GDPR Article 9 and sensitive personal data under LGPD Article 11. We collect this solely to ensure your safety and comply with Apple App Review Guidelines (Guideline 1.4). The legal basis for this processing is your explicit consent (GDPR Art. 9(2)(a)).
Device type, operating system version, app version, IP address (captured automatically for security monitoring), and user agent string.
When you use pronunciation practice or voice recording features, audio is processed in real-time by our text-to-speech provider. We do not store voice recordings on our servers. Voice processing is handled by ElevenLabs (see Section 5).
Anonymous session events (session start/end, feature usage) for improving the app. No personally identifiable information is included in analytics events.
In the event of app crashes, diagnostic data (including a pseudonymised user identifier) is sent to our crash reporting service (see Section 5).
| Data Category | Legal Basis | Purpose |
|---|---|---|
| Account information | Contract performance (Art. 6(1)(b)) | Provide the service |
| Learning data | Contract performance (Art. 6(1)(b)) | Track progress, personalise experience |
| Health & safety consent | Explicit consent (Art. 9(2)(a)) | User safety, regulatory compliance |
| Device/technical info | Legitimate interest (Art. 6(1)(f)) | Security, compatibility, support |
| Usage analytics | Legitimate interest (Art. 6(1)(f)) | Improve the app |
| Crash reports | Legitimate interest (Art. 6(1)(f)) | Fix bugs, maintain stability |
We use the following third-party services to operate BrainBeat:
| Service | Purpose | Data Processed | Location |
|---|---|---|---|
| Supabase | Database, authentication, edge functions | All account and learning data | EU (Frankfurt) |
| Anthropic (Claude) | AI dialogue and conversation generation | Conversation context (no PII sent) | USA |
| ElevenLabs | Text-to-speech voice synthesis | Text for voice generation (no PII) | USA |
| RevenueCat | Subscription and payment management | Purchase receipts, subscription status | USA |
| Sentry | Crash reporting and error tracking | Pseudonymised user ID, crash diagnostics | USA |
| Cloudflare | CDN, DDoS protection, WAF | IP address, request metadata | Global (EU included) |
| Expo/EAS | App builds and over-the-air updates | Build metadata (no user data) | USA |
| Apple / Google | App distribution, in-app purchases | As per their respective privacy policies | USA / Global |
For transfers to the USA, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission, or the service provider's participation in adequate safeguard mechanisms (GDPR Art. 46).
Your primary data is stored on Supabase servers in the European Union (Frankfurt, Germany). We use industry-standard encryption for data in transit (TLS 1.3) and at rest (AES-256). Access is restricted via Row Level Security policies and service-role authentication.
| Data | Retention |
|---|---|
| Account & learning data | Until account deletion or 1 year after last activity |
| Health consent records | Until account deletion (required for legal compliance) |
| Analytics events | 90 days |
| Crash reports | 90 days (Sentry default) |
| Rate limiting logs | 24 hours |
| API usage logs | 30 days |
Under the General Data Protection Regulation, you have the right to:
You may also lodge a complaint with your national Data Protection Authority. For Portugal: CNPD.
Under the California Consumer Privacy Act, California residents have the right to:
To exercise your CCPA rights, email privacy@brainbeat.app.
Under the Lei Geral de Protecao de Dados (LGPD), Brazilian residents have the right to:
To exercise your LGPD rights, email privacy@brainbeat.app.
For all privacy requests, contact us at privacy@brainbeat.app. We will respond within 30 days. You may also delete your account directly within the app (Settings > Delete Account), which permanently removes all your data from our servers.
BrainBeat is rated 12+ and recommended for users aged 14 and above. Users under 14 should use BrainBeat only with parental supervision. We do not knowingly collect personal information from children under 13 (COPPA) or under 16 without parental consent (GDPR Art. 8). If you believe a child has provided us with personal information without parental consent, please contact us immediately.
Your primary data is stored in the EU. Some sub-processors (Anthropic, ElevenLabs, RevenueCat, Sentry) are based in the United States. For these transfers, we rely on:
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes affecting your rights, we will notify you via email or in-app notification.
For privacy-related inquiries, data requests, or concerns: