Privacy Policy

Brainspill is a voice-first task capture app for iPhone, made by ScarabCrafts. This policy describes what data the app processes, why, who it is shared with, and the choices you have. It applies to the Brainspill iOS app (bundle identifier com.scarabcrafts.brainspill) and to this marketing website.

The short version: we don’t have user accounts, we don’t store your tasks on our servers, and we don’t sell your data. Most of what the app does happens on your iPhone. Some narrow things — cloud AI extraction, push notifications, crash reporting, paywall delivery, optional calendar sync (Apple and Google), and anonymous product analytics — require talking to third parties, and those are listed below in plain language.

1. Who we are

Brainspill is operated by ScarabCrafts Inc., a company incorporated under the laws of Nova Scotia, Canada (“ScarabCrafts”, “we”, “us”). ScarabCrafts Inc. is the data controller for personal information processed by the Brainspill app and this website.

ScarabCrafts Inc. was incorporated under the laws of Nova Scotia, Canada on 22 June 2026 and is the successor to the ScarabCrafts sole proprietorship named as data controller in earlier versions of this policy. ScarabCrafts Inc. has assumed all data-controller obligations described here; personal information collected under earlier versions of this policy continues to be processed under the same terms.

The fastest way to reach us is by email. For privacy-specific requests, write to brainspill.legal@scarabcrafts.com and we will respond within 30 days. For general support, write to brainspillsupport@scarabcrafts.com.

2. What the app does on your device

When you record a brain-dump in Brainspill, two things happen on your iPhone:

1. Speech-to-text. Your speech is transcribed into text using iOS’s built-in speech-recognition framework. On supported iPhones, transcription runs entirely on-device. On older iPhones where on-device transcription is not available, iOS may send the audio to Apple’s speech-recognition servers for processing under Apple’s privacy policy — Brainspill never sees that audio either way. We do not store, upload, or retain any audio recording after the session ends.
2. Task extraction. The transcribed text is then turned into a structured task list. Where this step runs depends on your device and your subscription tier (see the next section).

Your tasks are saved locally on your iPhone in an encrypted SQLite database that lives inside the app’s sandbox. Tasks are never uploaded to a Brainspill server. We do not operate user-content servers.

3. When data leaves your device

Cloud AI task extraction (some users)

On older iPhones, on iOS versions before 26, or for users on the Free or Pro tiers, the task-extraction step is performed in the cloud by a third-party AI provider (currently OpenAI). Only the transcribed text is sent — never audio. The text contains whatever you said: it may include names, places, and personal context. We send the text, the provider returns a structured task list, and the response is discarded after we display it to you. We do not retain the transcript on our side. The request does not travel directly from your iPhone to the AI provider — it passes through a proxy service we operate on Cloudflare, described in “Our AI proxy (Cloudflare)” below.

Our current cloud AI provider processes the request under their published data policy: openai.com/policies/api-data-usage-policies. As of this policy’s last-updated date, that provider does not train on API inputs and retains them for up to 30 days for abuse monitoring. We may change cloud AI providers in the future; this section will be updated and the “Last updated” date revised when that happens.

The first time the app is about to send a transcript to the cloud AI provider, the app shows you an explicit disclosure and asks for your permission. You can decline; if you decline, the spill is not sent and no cloud extraction happens for that session. You can revoke consent at any time by deleting the app, which clears the stored consent flag along with all other app data. No identifier of any kind (no email, account ID, device ID, or installation ID) is attached to the request that goes to OpenAI.

On iPhone 15 Pro or newer, running iOS 26 or later, while subscribed to Brainspill Max, the extraction step runs on-device using Apple’s Foundation Models framework. In that case, the transcript text never leaves your device either.

Snap-a-spill (camera or photo library, optional)

When you tap the camera icon inside Brainspill or share an image to Brainspill from another app via the iOS Share Sheet, you choose a photo (a snapshot of notes, a whiteboard, a flyer, or a screenshot). That image is sent to the same cloud AI provider (currently OpenAI) that handles voice transcripts, under the same consent gate — if you have not consented to cloud AI extraction, the snap is refused. The provider returns a structured task list, and the image is discarded after extraction. We do not retain photos on our servers, and the image is not used to train the model (subject to the same data policy linked in the “Cloud AI task extraction” section above).

Camera permission is requested the first time you tap the in-app camera. Photo Library permission is requested the first time you pick from your library. Both can be revoked at any time in iOS Settings › Brainspill. We do not read photo metadata such as EXIF or location tags — only the pixels needed for task extraction are sent to the AI provider.

Our AI proxy (Cloudflare)

Cloud AI requests — the voice transcripts and snapped photos described in the two sections above, plus AI chat and task-related AI features — do not go straight from your iPhone to OpenAI. They are sent to a proxy service that we operate on Cloudflare Workers, and the proxy forwards them to OpenAI. Cloudflare, Inc. therefore acts as a processor (subprocessor) for this traffic: the request content transits Cloudflare’s infrastructure on its way to the AI provider. The proxy exists to keep our AI credentials off your device, to verify that requests come from a genuine copy of Brainspill, and to enforce fair-usage limits.

What passes through the proxy:

• The content being processed. The transcribed text or snapped photo, together with limited context the app includes so extraction is accurate (for example, the titles of your existing tasks and lists). The proxy forwards this to OpenAI over TLS and does not write it to any database. Transcripts and photos are not stored on the proxy.
• A device attestation. Before the app can use cloud AI, iOS produces an Apple App Attest proof that the request comes from an unmodified copy of Brainspill on a real iPhone. From this, the proxy keeps an anonymous cryptographic device key identifier — generated by iOS, and not derived from your name, email, phone number, or Apple ID — for up to 30 days.
• A session token. After attestation the proxy issues the app a short-lived session token, valid for one hour, which accompanies each AI request. It contains the anonymous device key identifier, your subscription tier, and (for subscribers) an Apple transaction identifier — no name, email, or account information, because none exists.
• Usage counters. The proxy keeps rate-limit counters keyed on the anonymous device key identifier (retained for about a day), and a per-device service record — the device key identifier, subscription tier, Apple transaction identifier, and a last-seen timestamp — retained for 7 days and used to verify subscriptions and prevent abuse.

Beyond those counters, the proxy’s own database stores only anonymous daily aggregates — request counts, AI token counts, and processing cost per day and tier, with no device identifier and no content. To avoid double-charging your usage limits if a request is retried, the proxy may briefly cache the AI provider’s response (not your transcript or photo) for up to 10 minutes. The proxy also records usage telemetry events in PostHog, the same analytics provider described in “Anonymous product analytics” below — request counts, token counts, processing time, and cost, tied to the anonymous device key identifier and the per-install analytics ID. No transcript, photo, or task content is included in telemetry.

The content itself is forwarded to OpenAI for processing under the data policy linked in the “Cloud AI task extraction” section above: as of this policy’s last-updated date, OpenAI does not use API inputs or outputs to train its models, and retains them for up to 30 days for abuse monitoring.

Cloudflare’s privacy policy: cloudflare.com/privacypolicy.

Push notifications (optional)

If you grant notification permission, the app registers a push token with OneSignal so we can deliver per-task reminders (Max tier) and occasional product messages (all tiers). The push token is a device identifier, not your identity. We may also tag your device with your subscription tier (free / pro / max) so notifications are relevant. We do not send the content of your tasks to OneSignal — only short notification copy that the app or our team writes.

OneSignal’s privacy policy: onesignal.com/privacy_policy.

Crash and error reporting

If the app crashes or hits an error, technical diagnostics are sent to Sentry: device model, iOS version, app version, the line of code that crashed, and (where they exist) the values of internal app variables. We strip user content out of crash reports before they leave your device. Sentry does not receive your transcripts, tasks, or audio.

Sentry’s privacy policy: sentry.io/privacy.

Paywall delivery

Subscriptions and the paywall UI are managed by Superwall. Superwall receives a generated device identifier and events about which paywall you saw and whether you tapped the buy button. It does not receive your transcripts, tasks, or audio. Purchases themselves are processed by Apple via StoreKit2 — we never see or store your payment details.

Superwall’s privacy policy: superwall.com/privacy.

Apple Reminders sync (optional, Pro and Max)

If you turn on Apple Reminders sync, Brainspill writes your tasks into the iOS Reminders app on your device. From there, Apple may sync them to your other Apple devices via your iCloud account, under Apple’s privacy policy. Brainspill never sees your iCloud data. The hand-off goes from the app, through Apple’s system frameworks, to your own iCloud.

Apple’s privacy policy: apple.com/legal/privacy.

Apple Calendar sync (optional)

If you turn on Apple Calendar sync, Brainspill works with your iPhone’s Calendar app via Apple’s EventKit framework. With your permission, Brainspill (a) writes timed tasks you create in Brainspill to your default writable calendar, (b) reads events from any other calendars you opt-in to (iCloud, Gmail-via-Apple, work, etc.) so they appear on the Schedule tab, and (c) can remove an event when you ask it to by voice (“cancel my standup”) — always after an on-device confirmation prompt that names the event being deleted. The delete action is restricted to events Brainspill itself imported or wrote; an arbitrary event cannot be removed by voice.

Brainspill never sees your iCloud data and never uploads your calendar events to our servers. The hand-off goes from the app, through Apple’s system frameworks, to your own calendars. Calendar permission can be revoked at any time in iOS Settings › Brainspill › Calendars.

Apple’s privacy policy: apple.com/legal/privacy.

Google Calendar (optional, read-only)

If you choose to connect a Google account in Settings › Sync › Google Calendar, Brainspill uses Google’s OAuth flow to request read-only access to your Google Calendar events. We never write, edit, or delete Google Calendar events — the access scope (calendar.readonly) does not permit it. When you open the Schedule tab, Brainspill fetches events from the calendars you select and displays them inline. We do not store Google Calendar events on our servers — events are held in memory on your device during the session and dropped when the app is closed.

The OAuth refresh token is stored in your iPhone’s Keychain (encrypted by iOS) so the connection persists between launches. You can disconnect at any time in Settings › Sync › Google Calendar, which also clears the stored token from your device. To revoke access from Google’s side, visit myaccount.google.com/permissions.

Brainspill’s use of Google APIs adheres to Google’s API Services User Data Policy, including the Limited Use requirements: developers.google.com/terms/api-services-user-data-policy. We use Google Calendar data only to display your events inside Brainspill; we do not transfer it to others, use it for advertising, or permit humans to read it (except as required for security or with your explicit consent). While Google’s verification of our app is in progress, you may see an “unverified app” warning the first time you connect — this is a standard Google notice for newer apps; tapping “Advanced › Go to brainspill.app” is your explicit consent to proceed.

Google’s privacy policy: policies.google.com/privacy.

Anonymous product analytics (PostHog)

Brainspill sends anonymous usage events to PostHog so we can see where users get stuck during onboarding and improve the app. The events are things like “onboarding step viewed”, “paywall shown”, “permission granted”. We send no transcripts, no task content, no audio, no email, no name, and no advertising identifier (no IDFA). The only identifier attached is a random per-install anonymous ID that PostHog generates; we cannot tie it to any real-world identity.

You can stop sending events by deleting the app (which clears the local anonymous ID), or by contacting us at brainspill.legal@scarabcrafts.com and asking us to delete events tied to your install ID (which you would need to provide).

PostHog’s privacy policy: posthog.com/privacy.

4. What we do not collect

• We do not run user accounts, so we do not have your name, email, password, or login record.
• We do not collect your contacts or your location.
• We do not record or upload audio.
• We do not store your tasks, your calendar events, or your reminders on our servers. Calendars and reminders are read directly on your device with your permission (see section 3); we never upload them.
• We do not place advertising trackers in the app or on this website. We do not use IDFA.
• We do not sell, rent, or share personal information with data brokers.

5. Summary table

6. Children

Brainspill is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has used the app, contact us and we will delete any related diagnostic data we hold.

7. Your rights

Because the app does not run user accounts, the simplest way to delete your data is to delete the Brainspill app from your iPhone. That removes the local SQLite database and all stored tasks. To also remove tasks that were synced to Apple Reminders, delete them inside the iOS Reminders app.

Depending on where you live, you may have additional rights under privacy law:

• European Economic Area, United Kingdom (GDPR / UK GDPR): the right to access, correct, delete, restrict, or object to processing of your personal data, the right to data portability, and the right to lodge a complaint with your supervisory authority.
• California (CCPA / CPRA): the right to know what personal information we have collected, the right to delete it, the right to correct it, and the right to opt out of any sale or sharing of personal information. We do not sell or share personal information.
• Other jurisdictions: similar rights may apply under your local law.

To exercise any of these rights, email brainspill.legal@scarabcrafts.com with “Privacy” in the subject. Because we do not run accounts, we will ask you to verify your request by replying from the email address you wish to associate with the request, and to provide enough detail (for example, an approximate date the app was used) for us to locate any diagnostic records.

8. Security

Data on your device is protected by iOS’s standard app sandbox and device encryption. Locally-persisted app state (such as your subscription tier) is encrypted at rest using a key stored in the iPhone’s Keychain. Data sent to third-party processors (OpenAI, Cloudflare, OneSignal, Sentry, Superwall, Google, PostHog, Apple) travels over TLS. We use the minimum scope necessary for each service (e.g. Google Calendar is requested at read-only scope), and review their security postures before integrating them.

9. International transfers

ScarabCrafts Inc. is based in Nova Scotia, Canada. The third parties listed in this policy operate servers in the United States and the European Union. By using the app you understand that data described above may be processed in those regions under their respective privacy frameworks.

10. Changes to this policy

If we make material changes, we will update this page and revise the “Last updated” date at the top. Continued use of the app after a change indicates acceptance of the revised policy.

11. Contact

ScarabCrafts Inc. · brainspill.legal@scarabcrafts.com