BrightMind

Privacy Policy

Last updated

This policy covers the BrightMind app and brightmind.club. BrightMind is run by Stanislav Shelemekh, a sole proprietorship registered in Kraków, Poland ("BrightMind", "we", "us"), which is responsible for your personal data as its controller. Full business details are at the end of this page.

The short version

  • You can use BrightMind without creating an account. Signing in is optional.
  • We keep your conversations so you can come back to them. You can delete them, or your whole account, whenever you like.
  • We rely on a small set of service providers (hosting, AI, voice, analytics) to run the app. They work on our instructions.
  • We don't sell your data, and neither we nor our providers use your conversations to train AI models.
  • Data from apps you connect, like your calendar, is used only to answer what you ask.

What we collect

  • Your account. The app creates an anonymous account for you automatically, identified by a random ID. If you choose to sign in with email, Apple or Google, we also keep your email address and how you signed in. To keep automated sign-ups out, sign-in is protected by a bot check that looks at technical signals from your device.
  • Conversations. The messages you send, the assistant's replies, the actions it took for you, and any images or documents you share with it.
  • Voice calls. Your voice is streamed in real time so the assistant can understand and answer you. Call audio and transcripts are kept for up to 30 days to help us investigate quality problems, then deleted automatically.
  • Memory. The assistant remembers useful context from past conversations, such as goals or routines you mentioned, so it doesn't have to ask again.
  • Apps you connect. When you connect a task manager or calendar (such as Todoist, TickTick, Google Calendar or Google Tasks), we keep the access token that keeps the connection alive. We don't copy your lists or calendars: each request fetches only what is needed at that moment. Details that show up in a reply, like an event title or time, become part of that conversation.
  • Settings and preferences. Things like your language, theme, custom instructions, sleep schedule and preferred task manager. If you tell the assistant which city you're in, we remember it for weather and local times. We never access your device's precise location.
  • Device and usage information. Device model, operating system, app version, time zone, a push notification token, which features you use, and crash reports. Our analytics tools also derive an approximate location (city and country) from your IP address, and if you have signed in, your analytics profile includes your email address.
  • Advertising ID (Android only). On Android, our analytics tools read your device's advertising ID so we can see which of our marketing campaigns bring people to BrightMind. We don't use it to show you ads. You can reset or delete it at any time in Android Settings, under Privacy, then Ads; once deleted, apps receive only a blank ID. We don't collect the advertising identifier on iOS.
  • Purchases. If you subscribe to BrightMind Plus, we receive your subscription status, plan and renewal dates from the App Store or Google Play. They handle the payment, so we never see your card details.
  • Email updates. If you opt in to product news, we use your email address to send it.
  • On our website. A cookie-less visit counter, plus analytics, session recording and ad measurement tools that only run if you accept them in the cookie banner. If you arrive from one of our ads and accept advertising cookies, the ad platform may receive a click ID, the pages you view, sign-up events and, in hashed form, an email address you enter on the page.

How we use it

Data protection law asks us to name a legal basis for each use. Here is ours:

  • Running BrightMind for you (chat, voice calls, memory, reminders, connected apps, your subscription, sign-in emails): this is needed to provide the service you asked for.
  • Keeping BrightMind safe and working (fixing bugs, preventing abuse and fraud): our legitimate interest in a secure, reliable service.
  • Improving BrightMind (understanding which features are used, reviewing the quality of answers): our legitimate interest in making the product better.
  • Measuring our marketing (the Android advertising ID and our website ad tools): your consent through the cookie banner on the website; in the app, our legitimate interest in knowing which campaigns work. You can object at any time.
  • Sending product news: your consent, which you can withdraw with the unsubscribe link.
  • Meeting legal duties (tax and accounting records, answering lawful requests): legal obligation.

Your conversations and AI

Your conversations are sent to our AI providers to generate replies. We choose settings that stop them from training on your data and, where available, from keeping it at all. Neither BrightMind nor its providers use your conversations, voice recordings, tasks or calendar data to train AI models, and we won't allow it unless you have given us separate, explicit consent.

A small number of people at BrightMind can read stored conversations, and only to investigate a bug or support request you raised, keep the service secure, meet a legal obligation, or review the quality of the assistant's answers. Conversations are never read for advertising or marketing. Most accounts are anonymous, so a conversation is usually tied only to a random ID.

You can opt out of voice call recording and of quality review by emailing stan@brightmind.club. BrightMind is built for everyday planning, not for storing medical records, bank details or passwords, so please keep that in mind when deciding what to share.

Google user data (Google Calendar and Google Tasks) & Limited Use

Data accessed. BrightMind accesses Google Calendar data via the https://www.googleapis.com/auth/calendar scope when you connect Google Calendar in Settings. This includes your list of calendars and events, event details, and free/busy availability across all connected calendars. The event fields BrightMind requests by default are the event's title, start and end time, status, link, location, attendees, reminders, and recurrence; it can additionally request the description when needed. BrightMind both reads and writes the location field: it can see the location on an existing event, and it can set or change one when you ask it to create or edit an event. Free-text event search is passed to Google, which matches against titles, descriptions, locations, and attendees. Separately, BrightMind accesses Google Tasks data via the https://www.googleapis.com/auth/tasks scope when you connect Google Tasks in Settings. This includes your task lists and the tasks in them, with their title, notes, due date, completion status, and subtask relationships. The two integrations are independent: connecting one does not grant access to the other, and each is authorized and disconnected separately.

Data usage. Google Calendar data is used solely to provide BrightMind's in-app scheduling features: showing your schedule, finding open time, and creating, editing, rescheduling, and deleting events at your request. Google Tasks data is used solely to provide BrightMind's in-app task features: showing what is on your list, and creating, editing, completing, and deleting tasks and task lists at your request. Google user data is never used for advertising, measurement, or to train generalized AI or ML models.

Data sharing. Calendar and task data is processed in transit by OpenAI (our AI processor) to generate scheduling and coaching suggestions, under no-training and zero-data-retention settings where available. We will not use, and will not authorize any of our processors to use, your calendar or task data to train or improve generalized AI or ML models, unless we have separately and explicitly obtained your prior consent. We do not sell Google user data or share it with any third party for any other purpose. BrightMind's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data storage & protection. The only Google data we hold in its own right is the OAuth tokens required to maintain your connection, stored in EU-hosted, encrypted storage with row-level access controls. We do not maintain a copy of your calendars or task lists: raw API responses are used to answer the request in front of us and are then discarded. However, calendar and task content that appears in an assistant reply is stored as part of your conversation history, in the same way as the rest of that conversation, for as long as the conversation exists. In practice this can include event titles, dates and times, locations, and attendee names. This is a consequence of keeping your chat history so you can return to it, and it is deleted when you delete the conversation or your account. All data is transmitted over TLS.

Data retention & deletion. OAuth tokens are retained only while the integration is active, and are held per integration. They are deleted immediately when you disconnect Google Calendar or Google Tasks in Settings, delete your account (in-app or at brightmind.club/delete-account), or revoke access at myaccount.google.com/permissions.

Google Calendar and Google Tasks content. Where a conversation contains content derived from Google Calendar or Google Tasks, human review is further restricted to the cases Google's Limited Use requirements permit: with your affirmative consent, for security purposes such as investigating a bug or abuse, to comply with applicable law, or where the data is aggregated and used for internal operations. We do not read Google-derived content for general product-quality review without your consent.

Who we share it with

We share data only with service providers that help us run BrightMind, and only what each one needs:

  • Cloud hosting, database and file storage
  • AI model providers, which generate replies and handle voice
  • Real-time voice infrastructure, which carries your calls
  • A memory service that helps the assistant remember context
  • Analytics and crash reporting
  • Push notification services from Apple and Google
  • The App Store, Google Play and our subscription management provider
  • Email delivery and bot protection
  • Website analytics and advertising partners, only with your consent

These providers process data on our behalf under data processing agreements and may not use it for their own purposes. If you'd like the current list of providers, email us and we'll send it. We may also disclose data when the law requires it, or to a successor if BrightMind is ever sold or transferred. We do not sell your personal data.

Where your data is processed

Our main database is hosted in the European Union. Some providers process data in the United States or other countries outside the EU. When they do, the transfer is protected by the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

How long we keep it

  • Account, settings, conversations, memory and files: until you delete them or your account.
  • Voice call audio and transcripts: up to 30 days.
  • Connected-app tokens: until you disconnect the app or delete your account.
  • Analytics and crash reports: only as long as they are useful for spotting trends and fixing problems, then deleted.
  • Copies held by AI providers: up to 30 days for abuse monitoring, where zero retention is not available.
  • Email for product news: until you unsubscribe.
  • Purchase records: as long as tax and accounting law requires.

Deleting your account

If you've signed in, go to Settings → Manage account → Delete account in the app. If you haven't signed in, or no longer have the app, follow the steps at brightmind.club/delete-account or email us. We delete your account, conversations, memory, files, connected-app tokens, subscription record and analytics identifiers. Short-lived copies at our providers, such as voice recordings and AI abuse-monitoring logs, expire on the schedules above. Deletion is usually complete within 30 days, and we keep only what the law requires, such as purchase records.

Deleting your account does not cancel a subscription. Apple or Google bills it, so cancel it in your App Store or Google Play account.

Your choices and rights

  • Disconnect any connected app in Settings.
  • Unsubscribe from product news using the link in any email.
  • Reset or delete your Android advertising ID in Android Settings.
  • Change your cookie choices on the website with the cookie settings link in the footer.

You also have the right to access your data and get a copy of it, correct it, delete it, restrict or object to how we use it, and withdraw consent you gave us. Email stan@brightmind.club and we'll respond within one month. If you're unhappy with how we handle your data, you can complain to the Polish data protection authority, UODO, or the authority where you live.

Children

In the EU, BrightMind is for people aged 16 and over, or younger with a parent's or guardian's consent. Elsewhere, we follow the local age of digital consent, which is between 13 and 16. If we learn that a child is using BrightMind without the consent they need, we will close the account and delete its data.

Security

Data is encrypted in transit, stored with access controls so each account can reach only its own data, and handled by providers with established security programs. No system is perfectly secure, but we work to protect your data and will tell you if a breach puts it at risk.

Changes to this policy

When we change this policy, we update the date at the top. For significant changes, we give notice in the app or on this page before they take effect.

Contact us

BrightMind is operated by Stanislav Shelemekh, a sole proprietorship (jednoosobowa działalność gospodarcza) entered in the Polish CEIDG register, ul. Kazimierza Morawskiego 5 lok. 127, 30-102 Kraków, Poland, NIP 9452335637, VAT-UE PL9452335637, REGON 545629210. For anything about your data, write to stan@brightmind.club.