Privacy Policy

Brainspill is a voice-first task capture app for iPhone, made by ScarabCrafts. This policy describes what data the app processes, why, who it is shared with, and the choices you have. It applies to the Brainspill iOS app (bundle identifier com.scarabcrafts.brainspill) and to this marketing website.

The short version: we don’t have user accounts, we don’t store your tasks on our servers, and we don’t sell your data. Most of what the app does happens on your iPhone. Some narrow things — cloud AI extraction, push notifications, crash reporting, paywall delivery — require talking to third parties, and those are listed below in plain language.

1. Who we are

Brainspill is currently operated by Kosisochukwu Victor Eneze, an individual based in Halifax, Nova Scotia, Canada, trading under the name “ScarabCrafts.” Kosisochukwu Victor Eneze is the data controller for personal information processed by the Brainspill app and this website.

ScarabCrafts is in the process of being incorporated as a registered company. Once incorporation is complete, this policy will be updated to reflect the successor data controller (a registered entity), and the change will be reflected by an updated “Last updated” date at the top of this page. The corporate entity will assume all data-controller obligations going forward; personal information already collected under this policy continues to be processed under the same terms.

The fastest way to reach us is by email. For privacy-specific requests, write to brainspill.legal@scarabcrafts.com and we will respond within 30 days. For general support, write to brainspillsupport@scarabcrafts.com.

2. What the app does on your device

When you record a brain-dump in Brainspill, two things happen on your iPhone:

1. Speech-to-text. Your speech is transcribed into text using iOS’s built-in speech-recognition framework. On supported iPhones, transcription runs entirely on-device. On older iPhones where on-device transcription is not available, iOS may send the audio to Apple’s speech-recognition servers for processing under Apple’s privacy policy — Brainspill never sees that audio either way. We do not store, upload, or retain any audio recording after the session ends.
2. Task extraction. The transcribed text is then turned into a structured task list. Where this step runs depends on your device and your subscription tier (see the next section).

Your tasks are saved locally on your iPhone in an encrypted SQLite database that lives inside the app’s sandbox. Tasks are never uploaded to a Brainspill server. We do not operate user-content servers.

3. When data leaves your device

Cloud AI task extraction (some users)

On older iPhones, on iOS versions before 26, or for users on the Free or Pro tiers, the task-extraction step is performed in the cloud by a third-party AI provider (currently OpenAI). Only the transcribed text is sent — never audio. The text contains whatever you said: it may include names, places, and personal context. We send the text, the provider returns a structured task list, and the response is discarded after we display it to you. We do not retain the transcript on our side.

Our current cloud AI provider processes the request under their published data policy: openai.com/policies/api-data-usage-policies. As of this policy’s last-updated date, that provider does not train on API inputs and retains them for up to 30 days for abuse monitoring. We may change cloud AI providers in the future; this section will be updated and the “Last updated” date revised when that happens.

The first time the app is about to send a transcript to the cloud AI provider, the app shows you an explicit disclosure and asks for your permission. You can decline; if you decline, the spill is not sent and no cloud extraction happens for that session. You can revoke consent at any time by deleting the app, which clears the stored consent flag along with all other app data. No identifier of any kind (no email, account ID, device ID, or installation ID) is attached to the request that goes to OpenAI.

On iPhone 15 Pro or newer, running iOS 26 or later, while subscribed to Brainspill Max, the extraction step runs on-device using Apple’s Foundation Models framework. In that case, the transcript text never leaves your device either.

Push notifications (optional)

If you grant notification permission, the app registers a push token with OneSignal so we can deliver per-task reminders (Max tier) and occasional product messages (all tiers). The push token is a device identifier, not your identity. We may also tag your device with your subscription tier (free / pro / max) so notifications are relevant. We do not send the content of your tasks to OneSignal — only short notification copy that the app or our team writes.

OneSignal’s privacy policy: onesignal.com/privacy_policy.

Crash and error reporting

If the app crashes or hits an error, technical diagnostics are sent to Sentry: device model, iOS version, app version, the line of code that crashed, and (where they exist) the values of internal app variables. We strip user content out of crash reports before they leave your device. Sentry does not receive your transcripts, tasks, or audio.

Sentry’s privacy policy: sentry.io/privacy.

Paywall delivery

Subscriptions and the paywall UI are managed by Superwall. Superwall receives a generated device identifier and events about which paywall you saw and whether you tapped the buy button. It does not receive your transcripts, tasks, or audio. Purchases themselves are processed by Apple via StoreKit2 — we never see or store your payment details.

Superwall’s privacy policy: superwall.com/privacy.

Apple Reminders sync (optional, Pro and Max)

If you turn on Apple Reminders sync, Brainspill writes your tasks into the iOS Reminders app on your device. From there, Apple may sync them to your other Apple devices via your iCloud account, under Apple’s privacy policy. Brainspill never sees your iCloud data. The hand-off goes from the app, through Apple’s system frameworks, to your own iCloud.

Apple’s privacy policy: apple.com/legal/privacy.

4. What we do not collect

• We do not run user accounts, so we do not have your name, email, password, or login record.
• We do not collect your contacts, calendar, photos, or location.
• We do not record or upload audio.
• We do not store your tasks on our servers.
• We do not place advertising trackers in the app or on this website.
• We do not sell, rent, or share personal information with data brokers.

5. Summary table

6. Children

Brainspill is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has used the app, contact us and we will delete any related diagnostic data we hold.

7. Your rights

Because the app does not run user accounts, the simplest way to delete your data is to delete the Brainspill app from your iPhone. That removes the local SQLite database and all stored tasks. To also remove tasks that were synced to Apple Reminders, delete them inside the iOS Reminders app.

Depending on where you live, you may have additional rights under privacy law:

• European Economic Area, United Kingdom (GDPR / UK GDPR): the right to access, correct, delete, restrict, or object to processing of your personal data, the right to data portability, and the right to lodge a complaint with your supervisory authority.
• California (CCPA / CPRA): the right to know what personal information we have collected, the right to delete it, the right to correct it, and the right to opt out of any sale or sharing of personal information. We do not sell or share personal information.
• Other jurisdictions: similar rights may apply under your local law.

To exercise any of these rights, email brainspill.legal@scarabcrafts.com with “Privacy” in the subject. Because we do not run accounts, we will ask you to verify your request by replying from the email address you wish to associate with the request, and to provide enough detail (for example, an approximate date the app was used) for us to locate any diagnostic records.

8. Security

Data on your device is protected by iOS’s standard app sandbox and device encryption. Data sent to third-party processors (OpenAI, OneSignal, Sentry, Superwall, Apple) travels over TLS. We use the minimum scope necessary for each service, and review their security postures before integrating them.

9. International transfers

ScarabCrafts is based in Canada (Halifax, Nova Scotia). The third parties listed in this policy operate servers in the United States and the European Union. By using the app you understand that data described above may be processed in those regions under their respective privacy frameworks.

10. Changes to this policy

If we make material changes, we will update this page and revise the “Last updated” date at the top. Continued use of the app after a change indicates acceptance of the revised policy.

11. Contact

ScarabCrafts · brainspill.legal@scarabcrafts.com